Function at 0x4b6ec7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x470
mov eax, 0x50a8ae
call fcn.004fb730
mov edi, edx
mov esi, ecx
and dword [ebp - 0x470], 0
mov ecx, edi
and dword [ebp - 0x46c], 0
xor bl, bl
push 0x548a50
call fcn.00455536
lea eax, [ebp - 0x470]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x4b71a0
xor ecx, ecx
xor eax, eax
push 7
pop edx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x424], edx
mov word [ebp - 0x438], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x440], ecx
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x440], ecx
lea ecx, [ebp - 0x450]
push 0x535204
mov dword [ebp - 0x43c], edx
mov word [ebp - 0x450], ax
call fcn.00455536
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x450]
push dword [ebp - 0x470]
call fcn.0045adc8
push str.LocalServer32
lea ecx, [ebp - 0x450]
call fcn.0045adc8
cmp dword [ebp - 0x43c], 8
lea ecx, [ebp - 0x46c]
push ecx
lea eax, [ebp - 0x450]
cmovae eax, dword [ebp - 0x450]
xor esi, esi
push 0x20019
push esi
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b70ea
push 0x410
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.004d37c0
add esp, 0xc
mov dword [ebp - 0x474], 0x208
lea eax, [ebp - 0x474]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x47c]
push eax
push esi
push 0x548a50
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4b70de
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x438]
call fcn.00455536
cmp dword [ebp - 0x424], 8
lea edx, [ebp - 0x438]
mov eax, dword [ebp - 0x428]
cmovae edx, dword [ebp - 0x438]
test eax, eax
je 0x4b706e
dec eax
or ecx, 0xffffffff
cmp eax, ecx
push 0x5c
cmovb ecx, eax
lea eax, [edx + ecx*2]
pop ecx
jmp 0x4b7063
cmp eax, edx
je 0x4b706e
sub eax, 2
cmp word [eax], cx
jne 0x4b705c
sub eax, edx
sar eax, 1
jmp 0x4b7071
or eax, 0xffffffff
push eax
push 0
lea eax, [ebp - 0x468]
push eax
lea ecx, [ebp - 0x438]
call fcn.0045d1a7
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x438]
cmp ecx, eax
je 0x4b70a7
mov byte [ebp - 0x478], 0
push dword [ebp - 0x478]
push eax
call fcn.00458734
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x468]
call fcn.00455d7e
lea eax, [ebp - 0x438]
cmp edi, eax
je 0x4b70dc
cmp dword [ebp - 0x424], 8
mov ecx, edi
push dword [ebp - 0x428]
cmovae eax, dword [ebp - 0x438]
push eax
call fcn.00455cf3
mov bl, 1
push dword [ebp - 0x46c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x470]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [ebp - 4], 0
mov esi, 0x1000
mov edx, dword [ebp - 0x43c]
cmp edx, 8
jb 0x4b7136
mov ecx, dword [ebp - 0x450]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, esi
jb 0x4b712d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b71a8
push edx
push ecx
call fcn.0047834a
pop ecx
pop ecx
and dword [ebp - 0x440], 0
xor eax, eax
push 7
pop edi
mov dword [ebp - 0x43c], edi
mov word [ebp - 0x450], ax
or dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x424]
cmp edx, 8
jb 0x4b718a
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, esi
jb 0x4b7181
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4b71a8
push edx
push ecx
call fcn.0047834a
pop ecx
pop ecx
and dword [ebp - 0x428], 0
xor eax, eax
mov dword [ebp - 0x424], edi
mov word [ebp - 0x438], ax
mov al, bl
call fcn.004fb6da
ret
call fcn.004d7bfa
int3