Function at 0x49ef70
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x582b9c
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x5f0524]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x5b9058
lea ecx, [ebp - 0x10]
call fcn.00437a90
mov dword [ebp - 4], 0
cmp byte [0x6176c4], 0
jne 0x49efba
call fcn.00474a20
or edi, 0xffffffff
cmp byte [0x614271], 0
je 0x49f539
mov eax, dword fs:[0x2c]
mov ecx, dword [eax]
mov eax, dword [0x619d74]
cmp eax, dword [ecx + 4]
jle 0x49f022
push 0x619d74
call fcn.0051a2e0
add esp, 4
cmp dword [0x619d74], edi
jne 0x49f022
push str.ntdll.dll
mov ecx, 0x619d78
mov byte [ebp - 4], 1
call fcn.00461ed0
push 0x5887b0
call fcn.0051a637
push 0x619d74
mov byte [ebp - 4], 0
call fcn.0051a2a1
add esp, 8
mov eax, dword [0x619d80]
test eax, eax
je 0x49f4fe
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NtOpenThread
push eax
call esi
mov dword [0x61619c], eax
test eax, eax
jne 0x49f058
push str.Could_not_find_NtOpenThread_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtCreateKey
push dword [0x619d80]
call esi
mov dword [0x616198], eax
test eax, eax
jne 0x49f080
push str.Could_not_find_NtCreateKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtOpenKey
push dword [0x619d80]
call esi
mov dword [0x6161a4], eax
test eax, eax
jne 0x49f0a8
push str.Could_not_find_NtOpenKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtFlushKey
push dword [0x619d80]
call esi
mov dword [0x6161a0], eax
test eax, eax
jne 0x49f0d0
push str.Could_not_find_NtFlushKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtDeleteKey
push dword [0x619d80]
call esi
mov dword [0x61618c], eax
test eax, eax
jne 0x49f0f8
push str.Could_not_find_NtDeleteKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtQueryKey
push dword [0x619d80]
call esi
mov dword [0x616188], eax
test eax, eax
jne 0x49f120
push str.Could_not_find_NtQueryKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtEnumerateKey
push dword [0x619d80]
call esi
mov dword [0x616194], eax
test eax, eax
jne 0x49f148
push str.Could_not_find_NtEnumerateKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtClose
push dword [0x619d80]
call esi
mov dword [0x616190], eax
test eax, eax
jne 0x49f170
push str.Could_not_find_NtClose_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtSetValueKey
push dword [0x619d80]
call esi
mov dword [0x61617c], eax
test eax, eax
jne 0x49f198
push str.Could_not_find_NTSetValueKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtSetInformationKey
push dword [0x619d80]
call esi
mov dword [0x616178], eax
test eax, eax
jne 0x49f1c0
push str.Could_not_find_NtSetInformationKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtQueryValueKey
push dword [0x619d80]
call esi
mov dword [0x616184], eax
test eax, eax
jne 0x49f1e8
push str.Could_not_find_NtQueryValueKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtEnumerateValueKey
push dword [0x619d80]
call esi
mov dword [0x616180], eax
test eax, eax
jne 0x49f210
push str.Could_not_find_NtEnumerateValueKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtDeleteValueKey
push dword [0x619d80]
call esi
mov dword [0x61616c], eax
test eax, eax
jne 0x49f238
push str.Could_not_find_NtDeleteValueKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtRenameKey
push dword [0x619d80]
call esi
cmp dword [0x61616c], 0
mov dword [0x616168], eax
jne 0x49f265
push str.Could_not_find_NtRenameKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtQueryMultipleValueKey
push dword [0x619d80]
call esi
mov dword [0x616174], eax
test eax, eax
jne 0x49f28d
push str.Could_not_find_NtQueryMultipleValueKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtNotifyChangeKey
push dword [0x619d80]
call esi
mov dword [0x616170], eax
test eax, eax
jne 0x49f2b5
push str.Could_not_find_NtNotifyChangeKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtCreateFile
push dword [0x619d80]
call esi
mov dword [0x61615c], eax
test eax, eax
jne 0x49f2dd
push str.Could_not_find_NtCreateFile_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.RtlAllocateHeap
push dword [0x619d80]
call esi
mov dword [0x616158], eax
test eax, eax
jne 0x49f305
push str.Could_not_find_RtlAllocateHeap_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.RtlFreeHeap
push dword [0x619d80]
call esi
mov dword [0x616164], eax
test eax, eax
jne 0x49f32d
push str.Could_not_find_RtlFreeHeap_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtRestoreKey
push dword [0x619d80]
call esi
mov dword [0x616160], eax
test eax, eax
jne 0x49f355
push str.Could_not_find_NtRestoreKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtSaveKey
push dword [0x619d80]
call esi
mov dword [0x61614c], eax
test eax, eax
jne 0x49f37d
push str.Could_not_find_NtSaveKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtLoadKey
push dword [0x619d80]
call esi
mov dword [0x616148], eax
test eax, eax
jne 0x49f3a5
push str.Could_not_find_NtLoadKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtLoadKey2
push dword [0x619d80]
call esi
mov dword [0x616154], eax
test eax, eax
jne 0x49f3cd
push str.Could_not_find_NtLoadKey2_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtReplaceKey
push dword [0x619d80]
call esi
mov dword [0x616150], eax
test eax, eax
jne 0x49f3f5
push str.Could_not_find_NtReplaceKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.NtUnloadKey
push dword [0x619d80]
call esi
mov dword [0x61613c], eax
test eax, eax
jne 0x49f41d
push str.Could_not_find_NtUnloadKey_entry_point_in_NTDLL.DLL
lea ecx, [ebp - 0x10]
call fcn.00426ee0
jmp 0x49f539
push str.RtlInitString
push dword [0x619d80]
call esi
push str.RtlInitAnsiString
push dword [0x619d80]
mov dword [0x616138], eax
call esi
push str.RtlInitUnicodeString
push dword [0x619d80]
mov dword [0x616144], eax
call esi
push str.RtlAnsiStringToUnicodeString
push dword [0x619d80]
mov dword [0x616140], eax
call esi
push str.RtlUnicodeStringToAnsiString
push dword [0x619d80]
mov dword [0x61612c], eax
call esi
push str.RtlFreeAnsiString
push dword [0x619d80]
mov dword [0x616128], eax
call esi
push str.RtlFreeUnicodeString
push dword [0x619d80]
mov dword [0x616134], eax
call esi
cmp dword [0x616138], 0
mov dword [0x616130], eax
je 0x49f539
cmp dword [0x616144], 0
je 0x49f539
cmp dword [0x616140], 0
je 0x49f539
cmp dword [0x61612c], 0
je 0x49f539
cmp dword [0x616128], 0
je 0x49f539
cmp dword [0x616134], 0
je 0x49f539
test eax, eax
je 0x49f539
call fcn.0049f820
push dword [0x6166ac]
push str.RegistryUser_s
push 0x6166b8
call fcn.0043f5a0
add esp, 0xc
mov bl, 1
jmp 0x49f53b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.0049f570
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00476cc0
mov byte [ebp - 4], 0
mov eax, edi
mov edx, dword [ebp - 0x14]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x49f539
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x49f55a
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret