Function at 0x4dbe10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b7b0
mov eax, dword fs:[0]
push eax
sub esp, 0x164
mov eax, dword [0x596c60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
push 0
call fcn.00509ff6
add esp, 4
mov dword [ebp - 0x3c], edx
mov esi, eax
lea eax, [ebp - 0x30]
push eax
push 0x20019
push 0
push str.SOFTWAREMcAfeeAVSolutionInstallHistory
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4dc01c
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 8
push eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push str.InstallTime
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4dc014
mov eax, dword [0x59f554]
test al, 1
jne 0x4dbecf
or eax, 1
mov dword [0x59f554], eax
mov dword [ebp - 4], 0
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4dbee4
cmp byte [eax + 0x19], 6
jb 0x4dbee4
mov al, 1
jmp 0x4dbee6
xor al, al
cmp byte [0x59f560], 0
jne 0x4dbf00
cmp byte [0x59f561], 0
jne 0x4dbf00
test al, al
je 0x4dbff2
sub esp, 8
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xd8]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xd8]
call fcn.0047ee50
mov edx, str.._telemetry.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x13d
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_read_last_install_time
mov ecx, eax
call fcn.0047f0b0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x10
jb 0x4dbf88
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dbf88
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xd8]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 4
cmp dword [esi + 0x14], 0x10
jb 0x4dbfa5
mov esi, dword [esi]
call fcn.004a1320
push esi
push 6
mov ecx, eax
call fcn.004a1510
cmp dword [ebp - 0x18], 0x10
jb 0x4dbfca
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dbfca
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.0047b5a0
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005072fd
mov esp, ebp
pop ebp
ret
sub esi, dword [ebp - 0x40]
mov dword [edi + 0x48], esi
jmp 0x4dbff2
mov eax, dword [0x59f554]
test al, 1
jne 0x4dc04d
or eax, 1
mov dword [0x59f554], eax
mov dword [ebp - 4], 6
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x597f88]
test byte [eax + 0x1c], 2
je 0x4dc062
cmp byte [eax + 0x19], 6
jb 0x4dc062
mov al, 1
jmp 0x4dc064
xor al, al
cmp byte [0x59f560], 0
jne 0x4dc07e
cmp byte [0x59f561], 0
jne 0x4dc07e
test al, al
je 0x4dbff2
sub esp, 8
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x170]
call fcn.0047b4d0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.004a1680
mov edx, eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x170]
call fcn.0047ee50
mov edx, str.._telemetry.cpp
mov ecx, eax
call fcn.0047f0b0
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
push 0x146
mov ecx, eax
call fcn.0047b130
mov edx, 0x56b378
mov ecx, eax
call fcn.0047f0b0
mov edx, str.Failed_to_open_reg_key
mov ecx, eax
call fcn.0047f0b0
mov edx, str.SOFTWAREMcAfeeAVSolutionInstallHistory
mov ecx, eax
call fcn.004a1820
mov byte [ebp - 4], 8
cmp dword [ebp - 0x18], 0x10
jb 0x4dc112
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dc112
push eax
call fcn.00507b54
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x170]
call fcn.0047b620
mov esi, eax
mov byte [ebp - 4], 0xa
cmp dword [esi + 0x14], 0x10
jb 0x4dc12f
mov esi, dword [esi]
mov eax, dword [0x59f554]
test al, 1
jne 0x4dc15a
or eax, 1
mov dword [0x59f554], eax
mov byte [ebp - 4], 0xb
call fcn.004a1290
push 0x54f080
call fcn.00507cdd
add esp, 4
mov byte [ebp - 4], 0xa
push esi
push 6
mov ecx, 0x59f560
call fcn.004a1510
cmp dword [ebp - 0x18], 0x10
jb 0x4dc17d
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dc17d
push eax
call fcn.00507b54
add esp, 4
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x2c], 0
mov byte [ebp - 4], 7
call fcn.0047b5a0
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x56b700
push eax
call fcn.00528f2f
add esp, 4
jmp 0x4dbff2