Function at 0x4e0b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x7441fd
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1033fe0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x90949c]
cmp eax, dword [ecx + 0x64c]
jg 0x4e0e17
cmp dword [0x84a6d8], 0
push esi
jne 0x4e0ba9
mov edx, dword [0x84a6ac]
mov ecx, edx
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4e0b50
sub ecx, esi
push ecx
push edx
mov ecx, 0x84a6c8
call fcn.00486af0
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push str.HARDWAREDESCRIPTIONSystemBIOS
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4e0ba9
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
push str.BaseBoardManufacturer
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4e0bc8
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
push 0x84a6c8
call fcn.004838a0
mov eax, dword [ebp + 8]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0xf
mov byte [ebp - 0x34], 0
cmp edi, 0xf
ja 0x4e0c04
push edi
lea eax, [ebp - 0x34]
mov dword [ebp - 0x24], edi
push 0
push eax
call fcn.007051b0
mov byte [ebp + edi - 0x34], 0
mov ebx, dword [ebp - 0x34]
jmp 0x4e0c52
cmp edi, 0x7fffffff
ja 0x4e0e4d
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4e0c24
mov esi, bind
jmp 0x4e0c2e
mov eax, 0x16
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x34]
call fcn.00486a30
push edi
mov ebx, eax
mov dword [ebp - 0x24], edi
push 0
push ebx
mov dword [ebp - 0x20], esi
call fcn.007051b0
mov byte [ebx + edi], 0
mov dword [ebp - 0x34], ebx
add esp, 0xc
cmp dword [ebp - 0x20], 0x10
lea ecx, [ebp - 0x14]
push ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0
cmovae eax, ebx
push eax
push 0
push 0
push str.BaseBoardManufacturer
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4e0ce0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x84a6c8
call fcn.004838a0
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x4e0ccd
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4e0cc3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e0e12
push edx
push ecx
call fcn.00516d60
add esp, 8
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop ebx
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x20], 0x10
lea eax, [ebp - 0x34]
mov edi, dword [ebp - 0x24]
cmovae eax, dword [ebp - 0x34]
mov ebx, dword [0x84a6dc]
mov dword [ebp - 0x18], eax
cmp edi, ebx
ja 0x4e0d24
cmp ebx, 0x10
mov dword [0x84a6d8], edi
push edi
mov esi, 0x84a6c8
cmovae esi, dword [0x84a6c8]
push eax
push esi
call fcn.00704c30
add esp, 0xc
mov byte [edi + esi], 0
jmp 0x4e0dc8
cmp edi, 0x7fffffff
ja 0x4e0e52
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x4e0d44
mov esi, bind
jmp 0x4e0d62
mov ecx, ebx
mov eax, bind
shr ecx, 1
sub eax, ecx
cmp ebx, eax
jbe 0x4e0d5a
mov esi, bind
jmp 0x4e0d62
lea eax, [ebx + ecx]
cmp esi, eax
cmovb esi, eax
lea eax, [esi + 1]
mov ecx, 0x84a6c8
push eax
call fcn.00486a30
push edi
push dword [ebp - 0x18]
mov dword [0x84a6dc], esi
mov esi, eax
push esi
mov dword [ebp - 0x1c], eax
mov dword [0x84a6d8], edi
call fcn.00704c30
add esp, 0xc
mov byte [edi + esi], 0
cmp ebx, 0x10
jb 0x4e0dc2
mov ecx, dword [0x84a6c8]
inc ebx
mov eax, ecx
cmp ebx, 0x1000
jb 0x4e0db8
mov ecx, dword [ecx - 4]
add ebx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4e0e12
push ebx
push ecx
call fcn.00516d60
add esp, 8
mov dword [0x84a6c8], esi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp + 8]
mov ecx, esi
push 0x84a6c8
call fcn.004838a0
mov edx, dword [ebp - 0x20]
cmp edx, 0x10
jb 0x4e0ccd
mov ecx, dword [ebp - 0x34]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x4e0cc3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x4e0cc3
call fcn.0070f5b4
push 0x90949c
call fcn.00702d61
add esp, 4
cmp dword [0x90949c], 0xffffffff
jne 0x4e0b3b
push 0x753be0
call fcn.00702bca
push 0x90949c
call fcn.00702d17
add esp, 8
jmp 0x4e0b3b
call fcn.00486890
call fcn.00486890
int3