Function at 0x489cc0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
mov eax, dword [0x4ae248]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0x104
mov dword [ebp - 8], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov ecx, dword [str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x489d1e
xor eax, eax
jmp 0x489f22
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xc]
push edx
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x489f15
cmp dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
jne 0x489f15
mov dword [ebp - 0xc], reloc.NETAPI32.dll_NetApiBufferFree
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
add eax, 1
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
mov byte [ebp - 0x238], 0
push 0x104
push 0
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x104
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
mov eax, dword [str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002bE10318]
push eax
push 0x495868
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
call fcn.0048a9e0
add esp, 0x10
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
push 0x20019
push 0
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x489f10
mov byte [ebp - 0x348], 0
push 0x104
push 0
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x104
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 1
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push 0
mov edx, dword [str.NetCfgInstanceId]
push edx
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x489f03
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
jne 0x489f03
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 4
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 4
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
lea edx, reloc.NETAPI32.dll_NetApiBufferFree
push edx
push 0
mov eax, dword [str.Characteristics]
push eax
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x489ef9
mov edx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
and edx, 1
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edx
je 0x489ee1
mov dword [ebp - 0x10], 2
jmp 0x489ef9
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
and eax, 4
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], eax
je 0x489ef9
mov dword [ebp - 0x10], 1
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 1
mov ecx, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x489d32
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00492cee
mov esp, ebp
pop ebp
ret