Function at 0x4b5800
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4d41d2
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x2d8
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x2e8]
mov ecx, 0xb6
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov eax, dword [0x51e710]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x20], 0
xor eax, eax
mov word [ebp - 0x230], ax
push 0x206
push 0
lea ecx, [ebp - 0x22e]
push ecx
call fcn.0048a180
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx], 0x104
mov esi, esp
lea eax, [ebp - 0x20]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesPEAuth
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp esi, esp
call fcn.004cc645
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x4b597a
push 0x17
push ecx
mov ecx, esp
mov dword [ebp - 0x268], esp
push 0x4e6d6c
call fcn.004aaf30
mov dword [ebp - 0x2b0], eax
mov ecx, dword [ebp - 0x2b0]
mov dword [ebp - 0x2b4], ecx
mov byte [ebp - 4], 1
push ecx
mov ecx, esp
mov dword [ebp - 0x26c], esp
push str.RegOpenKeyEx
call fcn.004a68d0
mov dword [ebp - 0x2b8], eax
mov edx, dword [ebp - 0x2b8]
mov dword [ebp - 0x2bc], edx
mov byte [ebp - 4], 2
push ecx
mov ecx, esp
mov dword [ebp - 0x270], esp
push str.Cannot_open_registry_key.
call fcn.004a68d0
mov dword [ebp - 0x2c0], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.004ab0a0
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0x2c8], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x2c8]
push ecx
lea ecx, [ebp - 0x254]
call fcn.004ab000
push 0x519084
lea edx, [ebp - 0x254]
push edx
call fcn.0048a653
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x264]
call fcn.004ab2c0
mov esi, esp
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x230]
push ecx
push 0
push 0
push str.DataPath
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp esi, esp
call fcn.004cc645
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x4b5a78
push 0x1d
push ecx
mov ecx, esp
mov dword [ebp - 0x294], esp
push 0x4e6e74
call fcn.004aaf30
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x2d0], eax
mov byte [ebp - 4], 4
push ecx
mov ecx, esp
mov dword [ebp - 0x298], esp
push str.RegQueryValueEx
call fcn.004a68d0
mov dword [ebp - 0x2d4], eax
mov ecx, dword [ebp - 0x2d4]
mov dword [ebp - 0x2d8], ecx
mov byte [ebp - 4], 5
push ecx
mov ecx, esp
mov dword [ebp - 0x29c], esp
push str.Cannot_found_key_value.
call fcn.004a68d0
mov dword [ebp - 0x2dc], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x290]
call fcn.004ab0a0
mov dword [ebp - 0x2e0], eax
mov edx, dword [ebp - 0x2e0]
mov dword [ebp - 0x2e4], edx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x2e4]
push eax
lea ecx, [ebp - 0x280]
call fcn.004ab000
push 0x519084
lea ecx, [ebp - 0x280]
push ecx
call fcn.0048a653
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x290]
call fcn.004ab2c0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0048a180
add esp, 0xc
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0048976d
add esp, 0xc
mov eax, 1
jmp 0x4b5b46
push edx
mov ecx, ebp
push eax
lea edx, [0x4b5b84]
call fcn.004cc5ed
pop eax
pop edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00487e85
add esp, 0x2e8
cmp ebp, esp
call fcn.004cc645
mov esp, ebp
pop ebp
ret 8