Function at 0x498a17
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x858
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x854], ecx
mov dword [ebp - 0x834], eax
lea eax, [ebp - 0x824]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x830], eax
lea eax, [ebp - 0x61c]
push esi
xor esi, esi
mov dword [ebp - 0x82c], eax
mov dword [ebp - 0x858], esi
lea eax, [ebp - 0x414]
mov dword [ebp - 0x848], esi
mov dword [ebp - 0x828], eax
mov dword [ebp - 0x844], 0x41f6c8
mov dword [ebp - 0x840], 0x41f6e0
mov dword [ebp - 0x83c], 0x41f700
mov dword [ebp - 0x838], 0x41f724
push edi
test ebx, ebx
jne 0x498ab8
mov edi, 0x80004003
push edi
push 0x88a013c
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x498cc3
lea eax, [ebp - 0x848]
mov dword [ebx], esi
push eax
push 0x41f748
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test edi, edi
je 0x498ae2
push edi
push 0x891013c
jmp 0x498ca3
lea eax, [ebp - 0x850]
mov dword [ebp - 0x850], 0x208
push eax
push dword [ebp + esi - 0x834]
xor eax, eax
push eax
push eax
push dword [ebp + esi - 0x844]
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x498c9d
add esi, 4
cmp esi, 0x10
jb 0x498ae2
lea edx, [ebp - 0x20c]
xor esi, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
cmp ax, si
jne 0x498b2e
mov esi, dword [ebp - 0x854]
sub edx, ecx
mov ecx, esi
sar edx, 1
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x858]
jne 0x498b48
sub ecx, edi
lea eax, [edx + 5]
sar ecx, 1
add eax, ecx
cmp eax, 0x104
jb 0x498b7e
mov edi, 0x8007006f
push edi
push 0x8a5013c
push esi
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x498ca9
push 0x4050fc
lea ecx, [ebp - 0x20c]
call fcn.00463e4a
push esi
lea ecx, [ebp - 0x20c]
call fcn.00463e4a
push 0x41f7b8
lea ecx, [ebp - 0x20c]
call fcn.00463e4a
lea eax, [ebp - 0x850]
mov dword [ebp - 0x850], 4
push eax
lea eax, [ebp - 0x84c]
xor esi, esi
push eax
push esi
push esi
mov edi, 0x41c364
push edi
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x498bf0
push eax
push 0x8b5013c
push edi
call dword [sym.imp.certcli.dll_Ordinal_359]
mov eax, 0xb0
jmp 0x498bf6
mov eax, dword [ebp - 0x84c]
and eax, 0xfffffffe
mov ecx, 0x1b9
mov dword [ebp - 0x84c], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004cf8b9
push eax
call fcn.004c5942
push 0x406520
call fcn.004c5942
add esp, 0xc
push ebx
push 0x432b44
push 1
push esi
push 0x432b34
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, eax
test edi, edi
je 0x498c45
push edi
push 0x8c5013c
jmp 0x498ca3
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x84c]
or edx, 0x401
mov dword [ebp - 0x84c], edx
mov eax, dword [ecx]
mov esi, dword [eax + 0xc]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x41f7c4
push 1
push 2
push edx
push ecx
mov ecx, esi
call dword [0x51cbac]
call esi
mov edi, eax
test edi, edi
je 0x498cc3
push edi
push 0x8d8013c
jmp 0x498ca3
push edi
push 0x89d013c
call dword [sym.imp.certcli.dll_Ordinal_357]
mov ecx, dword [ebx]
test ecx, ecx
je 0x498cc3
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x51cbac]
call esi
xor eax, eax
mov dword [ebx], eax
cmp dword [ebp - 0x848], 0
je 0x498cd8
push dword [ebp - 0x848]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 4