Function at 0x4b022c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x470
mov eax, 0x502842
call fcn.004e3d69
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x45c], edx
test eax, eax
jne 0x4b0269
xor eax, eax
jmp 0x4b0762
push ecx
lea ecx, [ebp - 0x430]
call fcn.00402305
and dword [ebp - 4], 0
lea edi, [ebp - 0x430]
call fcn.004140e6
push str.wow6432node
xor ecx, ecx
mov esi, edi
call fcn.0040788c
test eax, eax
jle 0x4b02a6
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.0040285b
jmp 0x4b0262
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.0040285b
push dword [ebp - 0x470]
xor esi, esi
lea eax, [ebp - 0x430]
push 0x5d04a8
push eax
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x440], 0x400000
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x448], esi
call fcn.0040dc86
add esp, 0xc
push 0x5d04a0
push eax
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], 1
call fcn.00402187
add esp, 0xc
lea edi, [ebx + 8]
mov byte [ebp - 4], 2
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004c96e8
mov ecx, dword [ebp - 0x438]
add ecx, 0xfffffff0
call fcn.0040285b
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.0040285b
push esi
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x47c]
push eax
push esi
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x460], eax
mov eax, 0x4000
cmp dword [ebp - 0x444], eax
ja 0x4b03a5
mov eax, dword [ebp - 0x444]
lea ecx, [eax + 2]
mov eax, 0x400000
mov dword [ebp - 0x444], ecx
cmp dword [ebp - 0x448], eax
ja 0x4b03c1
mov eax, dword [ebp - 0x448]
add eax, 2
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x44c], ecx
mov byte [eax], 0
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x440]
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x450]
push eax
push esi
lea eax, [ebp - 0x44c]
push eax
push dword [ebx]
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x438], 1
jmp 0x4b0573
cmp eax, esi
jne 0x4b057e
call fcn.004be6f3
push eax
lea ecx, [ebp - 0x430]
call fcn.004027f9
push 3
pop ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x44c], esi
jne 0x4b0451
mov eax, dword [ebx]
push 0x40
pop edx
mov word [eax], dx
mov eax, dword [ebx]
xor edx, edx
mov word [eax + 2], dx
mov eax, dword [ebp - 0x450]
dec eax
je 0x4b04bf
sub eax, ecx
je 0x4b048e
lea eax, [ebp - 0x430]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
call fcn.0040253b
push dword [ebp - 0x450]
push dword [ebp - 0x440]
push dword [ebx + 4]
call fcn.004b0ba6
add esp, 0x14
jmp 0x4b04f7
mov eax, dword [ebx + 4]
movzx eax, byte [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
mov dword [ebp - 0x464], eax
call fcn.0040253b
push dword [ebp - 0x464]
lea ecx, [ebp - 0x430]
call fcn.004b0920
pop ecx
pop ecx
jmp 0x4b04f7
lea eax, [ebp - 0x430]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
call fcn.0040253b
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x46c], esp
push dword [ebx + 4]
call fcn.0040253b
mov byte [ebp - 4], 3
call fcn.004b0aa4
add esp, 0xc
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x430]
push ecx
push eax
mov ecx, edi
call fcn.004c96e8
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.0040285b
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 4]
mov byte [eax], 0
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x440]
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x450]
push eax
push esi
lea eax, [ebp - 0x44c]
push eax
push dword [ebx]
push dword [ebp - 0x438]
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x438]
cmp eax, 0x103
jne 0x4b041a
lea eax, [ebp - 0x454]
push eax
mov eax, dword [ebp - 0x45c]
mov eax, dword [eax]
or eax, 0x20019
push eax
push esi
push esi
push dword [ebp - 0x434]
mov dword [ebp - 0x454], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4b075f
cmp dword [ebp - 0x460], esi
jne 0x4b0262
push 0x412
lea eax, [ebp - 0x42c]
push esi
push eax
call fcn.004e38a0
add esp, 0xc
mov dword [ebp - 0x434], esi
cmp dword [ebp - 0x468], esi
jbe 0x4b0753
push 0x208
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x434]
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
jne 0x4b073b
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 4], 5
push dword [ebp - 0x454]
mov eax, dword [eax]
lea edi, [ebp - 0x43c]
call fcn.0041455e
test eax, eax
jne 0x4b0723
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x460]
call fcn.0040253b
push 0x5b2de4
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00413eb9
test eax, eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x460]
setne bl
add ecx, 0xfffffff0
call fcn.0040285b
test bl, bl
je 0x4b0718
cmp dword [ebp - 0x43c], esi
je 0x4b0718
lea ebx, [ebp - 0x458]
call fcn.00436ef7
push eax
push dword [ebp - 0x470]
lea eax, [ebp - 0x46c]
push eax
mov byte [ebp - 4], 7
call fcn.00402130
add esp, 0xc
lea ecx, [ebp - 0x42c]
push ecx
push eax
lea eax, [ebp - 0x464]
push eax
mov byte [ebp - 4], 8
call fcn.00402187
add esp, 0xc
push dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x474]
push eax
mov byte [ebp - 4], 9
push dword [ebp - 0x43c]
call fcn.004b022c
mov ecx, dword [ebp - 0x464]
add ecx, 0xfffffff0
call fcn.0040285b
mov ecx, dword [ebp - 0x46c]
add ecx, 0xfffffff0
call fcn.0040285b
mov ecx, dword [ebp - 0x458]
add ecx, 0xfffffff0
call fcn.0040285b
xor esi, esi
lea ecx, [ebp - 0x43c]
call fcn.0041459a
or dword [ebp - 4], 0xffffffff
xor eax, eax
lea ecx, [ebp - 0x43c]
mov word [ebp - 0x42c], ax
call fcn.0041459a
inc dword [ebp - 0x434]
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x468]
jb 0x4b05e2
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
call fcn.004e3dec
ret 0xc