Function at 0x494ab0
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xa8
mov esi, esp
mov eax, dword [ebp + 8]
mov ecx, eax
mov edx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esi + 0x9c], eax
mov eax, dword [0x88c650]
mov dword [esi + 0x98], eax
mov eax, dword [0x88c654]
mov dword [esi + 0x94], eax
mov eax, dword [esi + 0x98]
sub eax, 1
call fcn.00495200
mov eax, dword [esi + 0x98]
mov dword [esi + 0x8c], ecx
mov ecx, dword [esi + 0x90]
imul eax, ecx
and eax, 1
cmp eax, 0
sete al
mov ecx, dword [esi + 0x94]
cmp ecx, 0xa
setl ah
or al, ah
test al, 1
mov dword [esi + 0x88], edi
mov dword [esi + 0x84], ebx
mov dword [esi + 0x80], edx
jne 0x494b50
jmp 0x495110
mov eax, 4
mov dword [esi + 0x7c], eax
call fcn.00437f10
mov eax, edx
mov eax, esp
call fcn.00495210
mov dword [esi + 0x78], eax
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x7c]
mov dword [esi + 0x74], eax
mov eax, 0x1fffff
mov eax, ecx
call fcn.00437f10
mov eax, esp
call fcn.00495220
mov dword [esi + 0x70], eax
mov eax, esi
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x7c]
call fcn.00495230
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x7c]
mov dword [esi + 0x68], eax
mov eax, 0x4373cc
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, 0x5a6664
mov ecx, dword [ecx]
mov dword [esi + 0x64], eax
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x7c]
call fcn.00495240
mov eax, ecx
mov eax, ecx
call fcn.00437f10
mov eax, esp
call fcn.00495250
call fcn.00495260
mov eax, ecx
mov eax, ecx
call fcn.00437f10
mov eax, esp
call fcn.00495270
mov dword [esi + 0x58], eax
mov eax, 0x437240
mov eax, ecx
call fcn.00437f10
mov eax, 1
mov eax, esp
call fcn.00495280
mov dword [esi + 0x54], eax
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, 0x18
mov dword [esi + 0x50], eax
mov eax, 0x437324
mov eax, ecx
call fcn.00437f10
mov eax, edx
mov eax, esp
and eax, 0xfffffff8
mov esp, eax
mov ecx, dword [esi + 0x7c]
mov dword [esi + 0x4c], eax
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x78]
mov edx, dword [esi + 0x80]
mov dword [ecx], edx
call fcn.00495290
mov ebx, dword [esi + 0x88]
mov dword [edi], ebx
mov ecx, dword [esi + 0x70]
mov edx, dword [esi + 0x84]
mov dword [ecx], edx
mov ecx, dword [edi]
call fcn.004952a0
call fcn.004952b0
sub esp, 0x14
mov ebx, 0x1ff
mov edi, esp
call fcn.004952c0
mov dword [edi + 0x10], ebx
mov dword [edi + 4], ecx
mov dword [edi], edx
mov dword [edi + 0xc], 0x20019
mov dword [edi + 8], 0
call fcn.004952d0
mov dword [esi + 0x48], eax
call ecx
mov ecx, dword [esi + 0x68]
call fcn.004952e0
mov eax, dword [esi + 0x64]
mov byte [eax], 0
call fcn.004952f0
call fcn.004bb4d0
mov ecx, dword [esi + 0x68]
cmp dword [ecx], 0
sete cl
mov edx, dword [0x88c650]
call fcn.00495300
mov ebx, 0x7fffff
mov ebx, edx
sub ebx, 1
imul edx, ebx
and edx, 1
cmp edx, 0
sete ch
cmp edi, 0xa
setl dl
or ch, dl
test ch, 1
mov dword [esi + 0x44], eax
mov byte [esi + 0x43], cl
jne 0x494d1c
jmp 0x495110
mov al, byte [esi + 0x43]
test al, 1
jne 0x494d2c
jmp 0x4950c7
mov eax, dword [0x88c650]
mov ecx, dword [0x88c654]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
push ecx
mov ecx, 0xa25813db
xor ecx, 0xa25813db
cmp eax, ecx
pop ecx
sete bl
cmp ecx, 0xa
setl bh
or bl, bh
test bl, 1
jne 0x494d72
jmp 0x4950f8
mov eax, dword [esi + 0x5c]
call fcn.00495310
call fcn.00495320
mov edx, dword [ecx]
call fcn.00495330
mov ebx, dword [edi]
mov eax, dword [0x88c650]
mov ecx, dword [0x88c654]
mov edi, eax
add edi, 0xffffffff
imul eax, edi
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl ah
or al, ah
test al, 1
mov dword [esi + 0x3c], ebx
call fcn.00495340
jne 0x494dcb
jmp 0x4950f8
sub esp, 0x18
mov eax, 0x437324
mov eax, esp
call fcn.00495350
mov dword [eax + 0x14], ecx
mov edx, dword [esi + 0x60]
mov dword [eax + 0x10], edx
mov edi, dword [esi + 0x58]
mov dword [eax + 0xc], edi
mov ebx, dword [esi + 0x38]
mov dword [eax + 4], ebx
mov ecx, dword [esi + 0x3c]
call fcn.00495360
mov dword [eax + 8], 0
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call eax
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x68]
mov ecx, dword [esi + 0x34]
mov dword [eax], ecx
call fcn.00495370
mov edi, dword [edx]
mov ebx, dword [esi + 0x60]
mov byte [ebx + edi], 0
cmp dword [eax], 0
jne 0x494f1c
mov eax, dword [esi + 0x58]
call fcn.00495380
mov dword [esi + 0x30], ecx
call fcn.00495390
add eax, 0xffffffff
cmp eax, 2
ja 0x494e95
call fcn.004953a0
mov ecx, dword [eax]
sub esp, 8
mov edx, esp
call fcn.004953b0
mov ecx, dword [esi + 0x60]
mov dword [edx], ecx
mov ecx, dword [esi + 0x4c]
call fcn.004eceb0
mov dword [esi + 0x2c], eax
sub esp, 4
mov eax, esp
call fcn.004953c0
call fcn.004953d0
mov ecx, dword [esi + 0x9c]
call fcn.004fe0f0
mov ecx, dword [esi + 0x4c]
mov dword [esi + 0x28], eax
call fcn.00551e20
jmp 0x494e9a
jmp 0x494e9a
mov eax, dword [0x88c650]
mov ecx, dword [0x88c654]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete bl
cmp ecx, 0xa
setl bh
or bl, bh
test bl, 1
jne 0x494ed6
jmp 0x495106
mov eax, dword [0x88c650]
mov ecx, dword [0x88c654]
mov edx, 0x3ff
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete bl
cmp ecx, 0xa
setl bh
or bl, bh
test bl, 1
jne 0x494f17
jmp 0x495106
jmp 0x494f1c
call fcn.004953e0
mov ecx, dword [0x88c654]
mov edx, esi
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete bl
cmp ecx, 0xa
setl bh
or bl, bh
test bl, 1
jne 0x494f5a
jmp 0x49510b
mov eax, dword [0x88c650]
mov ecx, dword [0x88c654]
mov edx, 0x80000
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete bl
cmp ecx, 0xa
setl bh
or bl, bh
test bl, 1
jne 0x494f9b
jmp 0x4951ec
mov eax, dword [esi + 0x6c]
mov ecx, dword [eax]
mov edx, dword [0x88c650]
mov edi, dword [0x88c654]
mov ebx, edx
sub ebx, 1
imul edx, ebx
and edx, 1
cmp edx, 0
sete al
push edx
mov edx, 0x22aaee5d
xor edx, 0x22aaee57
cmp edi, edx
pop edx
setl ah
or al, ah
test al, 1
mov dword [esi + 0x24], ecx
jne 0x494fea
jmp 0x4951ec
call fcn.004953f0
mov ecx, dword [0x88c654]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete bl
cmp ecx, 0xa
setl bh
or bl, bh
test bl, 1
jne 0x495026
jmp 0x49510b
sub esp, 4
mov eax, esp
call fcn.00495400
mov dword [eax], ecx
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call eax
mov dword [esi + 0x20], eax
call fcn.00495410
mov ecx, dword [0x88c654]
mov edx, 0x40
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete bl
push ebx
mov ebx, 0x40d70c99
xor ebx, 0x40d70c93
cmp ecx, ebx
pop ebx
setl bh
or bl, bh
test bl, 1
jne 0x495086
jmp 0x4951f1
mov eax, dword [0x88c650]
mov ecx, dword [0x88c654]
mov edx, eax
sub edx, 1
imul eax, edx
and eax, 1
cmp eax, 0
sete bl
cmp ecx, 0xa
setl bh
or bl, bh
test bl, 1
jne 0x4950c2
jmp 0x4951f1
jmp 0x4950c7
mov eax, dword [esi + 0x64]
mov byte [eax], 1
call fcn.00495420
mov dword [ecx], 1
test byte [eax], 1
jne 0x4950eb
call fcn.00495430
call fcn.00551e20
call fcn.00495440
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [esi + 0x5c]
mov dword [eax], 0x1000
jmp 0x494d72
jmp 0x494ed6
jmp 0x494f5a
mov eax, 4
mov dword [esi + 0x1c], eax
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x18], eax
mov eax, 0x437258
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x14], eax
mov eax, 0x43724c
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0x10], eax
mov eax, ecx
call fcn.00437f10
mov eax, 0x4373c0
mov eax, esp
mov ecx, dword [esi + 0x1c]
mov dword [esi + 0xc], eax
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x1c]
mov dword [esi + 8], eax
mov eax, ecx
call fcn.00437f10
mov eax, esp
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x80]
mov dword [ecx], edx
mov edi, dword [esi + 0x14]
mov ebx, dword [esi + 0x88]
mov dword [edi], ebx
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x84]
mov dword [ecx], edx
mov ecx, dword [edi]
mov edx, dword [esi + 0x10]
mov edx, dword [edx]
sub esp, 0x14
mov ebx, 0x437420
mov edi, esp
mov ebx, dword [esi + 0xc]
mov dword [edi + 0x10], ebx
mov dword [edi + 4], ecx
mov dword [edi], edx
mov dword [edi + 0xc], 0x20019
mov dword [edi + 8], 0
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [esi + 4], eax
call ecx
mov ecx, dword [esi + 8]
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov byte [eax], 0
mov ecx, dword [esi + 0x9c]
call fcn.004bb4d0
mov dword [esi], eax
jmp 0x494b50
jmp 0x494f9b
jmp 0x495086