Function at 0x49d4ee
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3bc
xor eax, eax
mov dword [ebp - 0x40], eax
lea edx, [ebp - 4]
push edx
push 9
push 0
push 0x7718dc
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x49d524
xor eax, eax
jmp 0x49da99
xor edx, edx
mov dword [ebp - 0x18], edx
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
test eax, eax
jne 0x49da8e
mov dword [ebp - 0x30], 0x400
push 0x400
push 0
lea edx, [ebp - 0x444]
push edx
call fcn.0066cc88
add esp, 0xc
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x444]
push eax
mov edx, dword [ebp - 0x18]
inc dword [ebp - 0x18]
push edx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x49da83
lea eax, [ebp - 0x444]
push eax
call fcn.0049cb24
pop ecx
mov byte [ebp - 0x41], al
lea edx, [ebp - 0xc]
push edx
push 1
push 0
lea ecx, [ebp - 0x444]
push ecx
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x49d52e
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
push 0x400
push 0
lea edx, [ebp - 0x844]
push edx
call fcn.0066cc88
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x844]
push eax
lea edx, [ebp - 0x34]
push edx
push 0
push 0x7718f4
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x49da7b
lea eax, [ebp - 0x844]
push eax
push str.SYSTEMCurrentControlSetServices_s
lea edx, [ebp - 0xc44]
push edx
call fcn.006712b0
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push 0
lea eax, [ebp - 0xc44]
push eax
push SysStringLen
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
test edx, edx
jne 0x49d52e
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
push 0x400
push 0
lea ecx, [ebp - 0x844]
push ecx
call fcn.0066cc88
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x844]
push edx
lea ecx, [ebp - 0x34]
push ecx
push 0
push str.Group
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x49d6b1
push str.SCSI_miniport
lea edx, [ebp - 0x844]
push edx
call fcn.0066d004
add esp, 8
test eax, eax
je 0x49d6be
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x49d52e
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
push 0x400
push 0
lea ecx, [ebp - 0x844]
push ecx
call fcn.0066cc88
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
lea edx, [ebp - 0x844]
push edx
lea ecx, [ebp - 0x34]
push ecx
push 0
push str.ImagePath
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x49d717
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_RegCloseKey
jmp 0x49d52e
push dword [ebp + 8]
push 0x77193e
lea edx, [ebp - 0x444]
push edx
call fcn.006712b0
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
push 1
push 0
lea eax, [ebp - 0x444]
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
test edx, edx
jne 0x49d52e
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov byte [ebp - 0x42], 0
lea ecx, [ebp - 8]
push ecx
push 9
push 0
push 0x77194c
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x49d52e
xor edx, edx
mov dword [ebp - 0x1c], edx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0x400
push 0x400
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.0066cc88
add esp, 0xc
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x444]
push ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
push eax
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegEnumKeyExA
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
test edx, edx
jne 0x49da68
push 0xa
push 0x771957
lea ecx, [ebp - 0x444]
push ecx
call fcn.0066d09c
add esp, 0xc
test eax, eax
jne 0x49da68
lea eax, [ebp - 0x444]
push eax
call fcn.0049cb24
pop ecx
mov byte [ebp - 0x43], al
mov byte [ebp - 0x44], 0
lea edx, [ebp - 0x444]
push edx
push 0x771962
lea ecx, [ebp - 0x844]
push ecx
call fcn.006712b0
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 1
push 0
lea edx, [ebp - 0x844]
push edx
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x49da68
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
push 0x400
push 0
lea edx, [ebp - 0x844]
push edx
call fcn.0066cc88
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x844]
push eax
lea edx, [ebp - 0x34]
push edx
push 0
push 0x771977
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x49d9fb
push dword [ebp + 0xc]
call fcn.0066ce38
pop ecx
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x82c]
push eax
call fcn.0066d09c
add esp, 0xc
test eax, eax
jne 0x49d9fb
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
push 0x400
push 0
lea edx, [ebp - 0x844]
push edx
call fcn.0066cc88
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x844]
push eax
lea edx, [ebp - 0x34]
push edx
push 0
push 0x771982
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x49d92b
push 0x77198d
lea eax, [ebp - 0x844]
push eax
call fcn.0066d004
add esp, 8
test eax, eax
jne 0x49d92b
inc dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
push 0x400
push 0
lea edx, [ebp - 0x844]
push edx
call fcn.0066cc88
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x844]
push eax
lea edx, [ebp - 0x34]
push edx
push 0
push 0x77199d
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x49d992
push 0x7719a2
lea eax, [ebp - 0x844]
push eax
call fcn.0066d004
add esp, 8
test eax, eax
jne 0x49d992
inc dword [ebp - 0x2c]
mov dword [ebp - 0x30], 0x400
mov dword [ebp - 0x34], 1
push 0x400
push 0
lea edx, [ebp - 0x844]
push edx
call fcn.0066cc88
add esp, 0xc
lea ecx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x844]
push eax
lea edx, [ebp - 0x34]
push edx
push 0
push 0x7719b2
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegQueryValueExA
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x49d9fb
push 5
push 0x7719bd
lea eax, [ebp - 0x844]
push eax
call fcn.0066d09c
add esp, 0xc
test eax, eax
jne 0x49d9fb
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
dec edx
jl 0x49da60
lea ecx, [ebp - 0x43a]
push ecx
call fcn.00674df8
pop ecx
imul edx, dword [ebp - 0x40], 0x23
mov dword [edx*8 + 0xbca750], eax
imul eax, dword [ebp - 0x40], 0x23
mov cl, byte [ebp - 0x41]
mov byte [eax*8 + 0xbca85a], cl
imul eax, dword [ebp - 0x40], 0x23
mov dl, byte [ebp - 0x42]
mov byte [eax*8 + 0xbca85b], dl
imul ecx, dword [ebp - 0x40], 0x23
mov al, byte [ebp - 0x43]
mov byte [ecx*8 + 0xbca85c], al
imul edx, dword [ebp - 0x40], 0x23
mov cl, byte [ebp - 0x44]
mov byte [edx*8 + 0xbca85d], cl
imul eax, dword [ebp - 0x40], 0x23
mov byte [eax*8 + 0xbca755], 0
inc dword [ebp - 0x40]
push dword [ebp - 0x10]
call sub.ADVAPI32.DLL_RegCloseKey
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x49d78c
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
push dword [ebp - 0xc]
call sub.ADVAPI32.DLL_RegCloseKey
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x49d539
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, dword [ebp - 0x40]
mov esp, ebp
pop ebp
ret