Function at 0x4b8cc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d523b
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0xac
test eax, eax
push ebx
push ebp
push esi
push edi
jne 0x4b8cee
xor eax, eax
jmp 0x4b91b9
mov edi, str.ServicesProvided
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebp, dword [esp + 0xcc]
mov eax, ecx
mov esi, edi
mov edi, edx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x38]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push edx
push ebp
call ebx
test eax, eax
jne 0x4b8e45
mov eax, dword [esp + 0x14]
inc eax
push eax
call fcn.004bf598
mov ecx, dword [esp + 0x18]
add esp, 4
inc ecx
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
mov dword [esp + 0x18], esi
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x14]
lea ecx, [esp + 0x38]
push eax
push esi
push 0
push 0
push ecx
push ebp
call ebx
test eax, eax
je 0x4b8d8d
push esi
call fcn.004be17b
add esp, 4
xor eax, eax
jmp 0x4b91b9
mov dl, byte [esp + 0x23]
push 0
lea ecx, [esp + 0x2c]
mov byte [esp + 0x2c], dl
call fcn.00406ad6
mov al, byte [esi]
mov dword [esp + 0xc4], 0
test al, al
mov ebx, esi
je 0x4b8e20
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x2c]
push ebp
call fcn.00406a51
test al, al
je 0x4b8df5
mov edi, dword [esp + 0x2c]
mov ecx, ebp
mov eax, ecx
mov esi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2c]
call fcn.0042bb00
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0xd0]
lea edx, [esp + 0x28]
push edx
push 1
mov eax, dword [ecx + 8]
push eax
call fcn.004b9a90
mov eax, dword [esp + 0x30]
lea ebx, [ebx + eax + 1]
cmp byte [ebx], 0
jne 0x4b8db3
mov ebp, dword [esp + 0xcc]
push esi
call fcn.004be17b
add esp, 4
lea ecx, [esp + 0x28]
mov dword [esp + 0xc4], 0xffffffff
push 1
call fcn.00406ad6
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, str.Capabilities
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x38]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], 0
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x14]
push ecx
push 0
push 0
push 0
push edx
push ebp
call ebx
test eax, eax
jne 0x4b91b4
mov eax, dword [esp + 0x14]
push eax
call fcn.004bf598
add esp, 4
lea ecx, [esp + 0x14]
mov esi, eax
lea edx, [esp + 0x38]
push ecx
push esi
push 0
push 0
push edx
push ebp
mov dword [esp + 0x34], esi
call ebx
test eax, eax
je 0x4b8ec7
push esi
call fcn.004be17b
add esp, 4
xor eax, eax
jmp 0x4b91b9
mov ecx, dword [esp + 0xd4]
test ecx, ecx
jne 0x4b8f12
mov edi, dword [esp + 0xd0]
mov ecx, dword [edi + 4]
test ecx, ecx
jne 0x4b8ee4
xor eax, eax
jmp 0x4b8eec
mov eax, dword [edi + 8]
sub eax, ecx
sar eax, 4
test eax, eax
jbe 0x4b91ab
add edi, 0x10
mov ebx, eax
mov eax, dword [edi + 8]
push esi
push 1
push eax
mov ecx, edi
call fcn.0042c590
add esi, 4
dec ebx
jne 0x4b8ef9
jmp 0x4b91a7
mov ebp, dword [esp + 0x14]
mov eax, dword [ecx + 0x34]
shr ebp, 2
test eax, eax
mov dword [esp + 0x10], ebp
jne 0x4b8f28
xor edi, edi
jmp 0x4b8f30
mov edi, dword [ecx + 0x38]
sub edi, eax
sar edi, 2
test ebp, ebp
je 0x4b91ab
cmp edi, ebp
jbe 0x4b9009
test ebp, ebp
jbe 0x4b8f6a
mov ecx, dword [esp + 0xd0]
mov esi, dword [esp + 0x1c]
lea ebx, [ecx + 0x10]
mov edx, dword [ebx + 8]
push esi
push 1
push edx
mov ecx, ebx
call fcn.0042c590
add esi, 4
dec ebp
jne 0x4b8f52
mov ebp, dword [esp + 0x10]
mov ebx, dword [esp + 0xd0]
mov dword [esp + 0x18], 0
mov eax, dword [ebx + 0x14]
lea esi, [ebx + 0x10]
test eax, eax
jne 0x4b8f87
xor ecx, ecx
jmp 0x4b8f8f
mov ecx, dword [esi + 8]
sub ecx, eax
sar ecx, 2
cmp ecx, edi
jae 0x4b8fba
test eax, eax
jne 0x4b8f9b
xor ecx, ecx
jmp 0x4b8fa3
mov ecx, dword [esi + 8]
sub ecx, eax
sar ecx, 2
lea eax, [esp + 0x18]
mov edx, edi
push eax
mov eax, dword [esi + 8]
sub edx, ecx
mov ecx, esi
push edx
push eax
call fcn.0042c590
jmp 0x4b8fd8
test eax, eax
je 0x4b8fdc
mov ecx, dword [esi + 8]
mov edx, ecx
sub edx, eax
sar edx, 2
cmp edi, edx
jae 0x4b8fdc
lea eax, [eax + edi*4]
push ecx
push eax
mov ecx, esi
call fcn.00437f70
mov ebp, dword [esp + 0x10]
cmp ebp, edi
jae 0x4b91a7
sub edi, ebp
jmp 0x4b8fec
mov ebp, dword [esp + 0x10]
mov ecx, dword [ebx + 0x14]
mov eax, dword [esi + 8]
lea edx, [ecx + ebp*4 - 4]
mov ecx, esi
push edx
push 1
push eax
call fcn.0042c590
dec edi
jne 0x4b8fe8
jmp 0x4b91a7
test edi, edi
jbe 0x4b91ab
mov ecx, dword [esp + 0xd0]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], edi
lea esi, [ecx + 0x10]
mov eax, dword [esi + 8]
mov edx, dword [esi + 0xc]
sub edx, eax
mov edi, eax
sar edx, 2
cmp edx, 1
jae 0x4b9107
mov edx, dword [esi + 4]
test edx, edx
je 0x4b9050
mov ecx, eax
sub ecx, edx
sar ecx, 2
cmp ecx, 1
ja 0x4b9055
mov ecx, 1
test edx, edx
jne 0x4b905d
xor eax, eax
jmp 0x4b9062
sub eax, edx
sar eax, 2
add eax, ecx
test eax, eax
mov dword [esp + 0x24], eax
jge 0x4b906e
xor eax, eax
shl eax, 2
push eax
call fcn.004bf598
mov ecx, dword [esi + 4]
add esp, 4
mov ebp, eax
push ebp
push edi
push ecx
mov ecx, esi
call fcn.0042c7d0
mov edx, dword [esp + 0x10]
mov ebx, eax
push edx
push 1
push ebx
mov ecx, esi
call fcn.0042c7a0
mov eax, dword [esi + 8]
add ebx, 4
push ebx
push eax
push edi
mov ecx, esi
call fcn.0042c7d0
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push ecx
push edx
mov ecx, esi
call fcn.0045a920
mov eax, dword [esi + 4]
push eax
call fcn.004be17b
mov ecx, dword [esp + 0x28]
mov eax, dword [esi + 4]
add esp, 4
lea edx, [ebp + ecx*4]
test eax, eax
mov dword [esi + 0xc], edx
jne 0x4b90ec
mov ebx, dword [esp + 0x10]
xor ecx, ecx
mov dword [esi + 4], ebp
lea eax, [ebp + ecx*4 + 4]
mov dword [esi + 8], eax
jmp 0x4b9191
mov ecx, dword [esi + 8]
mov ebx, dword [esp + 0x10]
sub ecx, eax
mov dword [esi + 4], ebp
sar ecx, 2
lea eax, [ebp + ecx*4 + 4]
mov dword [esi + 8], eax
jmp 0x4b9191
mov ecx, eax
sub ecx, edi
sar ecx, 2
cmp ecx, 1
jae 0x4b9151
lea ecx, [edi + 4]
push ecx
push eax
push edi
mov ecx, esi
call fcn.0042c7d0
mov eax, dword [esi + 8]
mov ecx, 1
mov edx, eax
push ebx
sub edx, edi
sar edx, 2
sub ecx, edx
push ecx
push eax
mov ecx, esi
call fcn.0042c7a0
mov ecx, dword [esi + 8]
mov eax, edi
cmp edi, ecx
je 0x4b918d
mov edx, dword [ebx]
mov dword [eax], edx
add eax, 4
cmp eax, ecx
jne 0x4b9144
jmp 0x4b918d
lea ecx, [eax - 4]
push eax
push eax
mov dword [esp + 0x2c], ecx
push ecx
mov ecx, esi
call fcn.0042c7d0
mov ecx, dword [esi + 8]
lea eax, [ecx - 4]
cmp edi, eax
je 0x4b917b
mov edx, dword [eax - 4]
sub eax, 4
sub ecx, 4
cmp eax, edi
mov dword [ecx], edx
jne 0x4b916c
lea eax, [edi + 4]
cmp edi, eax
je 0x4b918d
mov ecx, dword [ebx]
mov dword [edi], ecx
add edi, 4
cmp edi, eax
jne 0x4b9182
add dword [esi + 8], 4
mov eax, dword [esp + 0x18]
add ebx, 4
dec eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], eax
jne 0x4b9027
mov esi, dword [esp + 0x1c]
push esi
call fcn.004be17b
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0xbc]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xb8
ret 0xc