Function at 0x4a6bf710
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x4a
push 0
push 0
dec ecx
jne 0x4a6bf719
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a6bfa96
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x22c]
push eax
mov cl, 0x5c
mov edx, 1
mov eax, esi
call fcn.4a611210
mov eax, dword [ebp - 0x22c]
mov edx, 0x4a6bfab4
call fcn.4a60f314
test al, al
je 0x4a6bf922
lea eax, [ebp - 0x10]
push eax
push 9
push 0
lea eax, [ebp - 0x234]
push eax
mov cl, 0x5c
mov edx, 2
mov eax, esi
call fcn.4a611210
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
mov edx, 0x4a6bfad0
call fcn.4a60843c
mov eax, dword [ebp - 0x230]
call fcn.4a60824c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a6bf9f6
xor ebx, ebx
mov dword [ebp - 0x1c], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x226]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4a6bf914
lea eax, [ebp - 0x14]
push eax
push 1
push 0
lea eax, [ebp - 0x226]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a6bf90e
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x226]
push eax
push 0
push 0
push 0x4a6bfb20
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a6bf905
lea eax, [ebp - 0x23c]
push eax
mov cl, 0x5c
mov edx, 3
mov eax, esi
call fcn.4a611210
push dword [ebp - 0x23c]
push 0x4a6bfb3c
lea eax, [ebp - 0x240]
push eax
mov cl, 0x5c
mov edx, 4
mov eax, esi
call fcn.4a611210
push dword [ebp - 0x240]
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.4a6084c4
mov eax, dword [ebp - 0x238]
push eax
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x226]
mov ecx, 0x105
call fcn.4a6082f8
mov eax, dword [ebp - 0x244]
pop edx
call fcn.4a60f314
test al, al
je 0x4a6bf905
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push 0x4a6bfb40
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a6bf905
mov dword [ebp - 0x1c], 0x1000
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0x4a6bfb64
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc ebx
jmp 0x4a6bf7cb
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a6bf9f6
lea eax, [ebp - 0x248]
push eax
mov cl, 0x23
mov edx, 1
mov eax, esi
call fcn.4a611210
mov eax, dword [ebp - 0x248]
mov edx, 0x4a6bfb7c
call fcn.4a60f314
test al, al
je 0x4a6bf9f6
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4a6bfad0
lea eax, [ebp - 0x250]
push eax
mov cl, 0x23
mov edx, 2
mov eax, esi
call fcn.4a611210
push dword [ebp - 0x250]
push 0x4a6bfb3c
lea eax, [ebp - 0x254]
push eax
mov cl, 0x23
mov edx, 3
mov eax, esi
call fcn.4a611210
push dword [ebp - 0x254]
push 0x4a6bfba0
lea eax, [ebp - 0x24c]
mov edx, 5
call fcn.4a6084c4
mov eax, dword [ebp - 0x24c]
call fcn.4a60824c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a6bf9f6
mov dword [ebp - 0x1c], 0x1000
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0x4a6bfb64
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [ebp - 9], 0
je 0x4a6bfa78
mov eax, dword [ebp - 0x1c]
and eax, 0x7f
sub dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x80
jbe 0x4a6bfa70
xor edx, edx
mov ebx, dword [ebp - 0x1c]
sub ebx, 0x80
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, ebx
jl 0x4a6bfa33
inc eax
mov ecx, dword [ebp - 4]
cmp byte [ecx + ebx], 0
je 0x4a6bfa2f
mov dl, 1
jmp 0x4a6bfa33
inc ebx
dec eax
jne 0x4a6bfa22
test dl, dl
je 0x4a6bfa5c
xor edx, edx
mov ebx, dword [ebp - 0x1c]
sub ebx, 0x80
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, ebx
jl 0x4a6bfa5c
inc eax
mov ecx, dword [ebp - 4]
cmp byte [ecx + ebx], 0xff
je 0x4a6bfa58
mov dl, 1
jmp 0x4a6bfa5c
inc ebx
dec eax
jne 0x4a6bfa4b
test dl, dl
jne 0x4a6bfa70
sub dword [ebp - 0x1c], 0x80
cmp dword [ebp - 0x1c], 0x80
ja 0x4a6bfa0e
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6bfa9d
lea eax, [ebp - 0x254]
mov edx, 0xb
call fcn.4a6075e8
ret