Function at 0x494e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd3c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.VerifyRegOptions
mov esi, str.____BEGIN___
xor edi, edi
call fcn.0047fb10
mov eax, dword [0x4cd380]
add esp, 4
mov dword [0x4cc87c], eax
test eax, eax
jle 0x4954df
cmp dword [0x4d2afc], edi
je 0x494ea9
mov eax, dword [0x4c6444]
mov dword [ebp - 0xd28], eax
mov dword [0x4c6444], 0x20119
call fcn.00488640
mov ecx, dword [0x4cc87c]
push ecx
push eax
push str.RunCount___d__OptionMinutes___d
lea edx, [ebp - 0x908]
push 0x200
push edx
mov dword [0x4cd38c], eax
call fcn.00402830
add esp, 0x14
push str.VerifyRegOptions
lea esi, [ebp - 0x908]
call fcn.0047fb10
mov eax, dword [0x4cd38c]
xor edi, edi
add esp, 4
mov dword [ebp - 0xd24], eax
mov dword [ebp - 0xd0c], edi
test eax, eax
jle 0x4954c5
jmp 0x494f16
mov edi, dword [ebp - 0xd0c]
mov eax, dword [edi*4 + 0x4cd390]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x494f6f
push esi
call ebx
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x408]
mov eax, 0x80
jne 0x494f58
push str.Title_Not_Found
call fcn.00401000
push str.Title_Not_Found
jmp 0x494f5f
push esi
call fcn.00401000
push esi
call ebx
mov ecx, dword [edi*4 + 0x4cd390]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea esi, [ebp - 0x208]
call fcn.0048fb30
mov esi, dword [ebp - 0xd0c]
mov edx, dword [esi*4 + 0x4cd390]
mov edi, dword [sym.imp.KERNEL32.dll_GlobalLock]
push edx
call edi
test eax, eax
je 0x494fe5
lea esi, [eax + 0x184]
push esi
call ebx
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x108]
mov eax, 0x104
jne 0x494fc2
push str.No_path_available
call fcn.00401000
push str.No_path_available
jmp 0x494fc9
push esi
call fcn.00401000
push esi
call ebx
mov eax, dword [ebp - 0xd0c]
mov ecx, dword [eax*4 + 0x4cd390]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0xd0c]
mov edx, dword [esi*4 + 0x4cd390]
push edx
call edi
test eax, eax
je 0x495044
lea esi, [eax + 0x290]
push esi
call ebx
test eax, eax
mov edx, 0x7ffffffe
lea ecx, [ebp - 0x308]
mov eax, 0x100
jne 0x495021
push str.No_Description_Available
call fcn.00401000
push str.No_Description_Available
jmp 0x495028
push esi
call fcn.00401000
push esi
call ebx
mov eax, dword [ebp - 0xd0c]
mov ecx, dword [eax*4 + 0x4cd390]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [ebp - 0xd0c]
mov edx, dword [esi*4 + 0x4cd390]
push edx
mov dword [ebp - 0xd20], 0
call edi
test eax, eax
je 0x495076
mov ecx, dword [esi*4 + 0x4cd390]
mov eax, dword [eax + 0x288]
push ecx
mov dword [ebp - 0xd20], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, 0x80000001
xor esi, esi
lea ecx, [ecx]
mov edx, dword [esi*4 + 0x4c4368]
push edx
lea eax, [ebp - 0x408]
push eax
call fcn.00483b10
test eax, eax
je 0x4950a0
inc esi
cmp esi, 4
jl 0x495080
jmp 0x4950a7
mov edi, dword [esi*4 + 0x4c437c]
mov edx, dword [0x4c6444]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [ebp - 0xd10]
push ecx
push edx
push 0
lea eax, [ebp - 0x208]
push eax
push edi
mov byte [ebp - 0xd08], 0
call esi
test eax, eax
jne 0x4954ac
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0xd30]
push ecx
lea edx, [ebp - 0xd08]
push edx
mov edx, dword [ebp - 0xd10]
lea eax, [ebp - 0xd38]
push eax
push 0
lea ecx, [ebp - 0x108]
push ecx
push edx
mov dword [ebp - 0xd30], 0x400
call ebx
test eax, eax
je 0x495123
mov eax, dword [ebp - 0xd10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4954ac
mov edx, dword [ebp - 0xd10]
mov ecx, dword [ebp - 0xd38]
push edx
mov dword [ebp - 0xd1c], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xd1c]
test eax, eax
je 0x4954ac
cmp eax, 4
jne 0x4951ed
mov ecx, dword [0x4c6444]
lea eax, [ebp - 0xd18]
push eax
push ecx
push 0
lea edx, [ebp - 0x208]
push edx
push edi
call esi
test eax, eax
jne 0x495210
lea eax, [ebp - 0xd34]
push eax
lea ecx, [ebp - 0xd2c]
push ecx
mov ecx, dword [ebp - 0xd18]
lea edx, [ebp - 0xd3c]
push edx
push 0
lea eax, [ebp - 0x108]
push eax
push ecx
mov dword [ebp - 0xd34], 4
call ebx
test eax, eax
je 0x4951b9
mov edx, dword [ebp - 0xd18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x495210
mov eax, dword [ebp - 0xd18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xd2c]
cmp eax, 0xffffffff
je 0x495210
push eax
push 0x4b7c94
lea ecx, [ebp - 0x508]
push 0x100
push ecx
call fcn.00402830
add esp, 0x10
jmp 0x495210
push 0x100
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x508]
mov edx, edi
call fcn.0048e050
add esp, 0xc
lea ecx, [ebp - 0x508]
push ecx
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x208]
push eax
push str.Key:__s__Name:__s__NewValue:__s
lea ecx, [ebp - 0x908]
push 0x200
push ecx
call fcn.00402830
push str.Registry_Review
lea esi, [ebp - 0x908]
call fcn.0047fb10
add esp, 0x1c
lea edx, [ebp - 0x508]
push edx
lea eax, [ebp - 0x308]
push eax
call fcn.00483b10
test eax, eax
je 0x4954ac
cmp dword [ebp - 0xd20], 0
jne 0x495321
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x200
lea edx, [ebp - 0x708]
mov ecx, 0x57a
test eax, eax
je 0x49529c
mov ecx, 0x579
call fcn.00499890
add esp, 4
lea edx, [ebp - 0x508]
push edx
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x208]
push ecx
lea edx, [ebp - 0x708]
push edx
push str._s_n_n_s___s:__s
lea eax, [ebp - 0x908]
push 0x200
push eax
call fcn.00402830
add esp, 0x1c
push 0xc
mov dword [0x4d2b00], 1
call fcn.00499e00
movzx ecx, word [0x4d1e04]
add esp, 4
push ecx
push 0x40034
push 0x4cd200
lea edx, [ebp - 0x908]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxExA]
mov dword [0x4d2b00], 0
cmp eax, 7
jne 0x4953f1
cmp dword [ebp - 0xd1c], 4
jne 0x495396
lea eax, [ebp - 0x308]
push eax
call fcn.004a02f9
add esp, 4
lea ecx, [ebp - 0xd14]
push ecx
lea edx, [ebp - 0x108]
push edx
lea esi, [ebp - 0x208]
mov ebx, edi
mov dword [ebp - 0xd14], eax
call fcn.0048e590
add esp, 8
test eax, eax
jne 0x4954ac
cmp edi, 0x80000002
jne 0x4954ac
push 4
lea eax, [ebp - 0x308]
push eax
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 0x108]
mov ecx, esi
call fcn.00482a40
add esp, 0xc
jmp 0x4954ac
lea edx, [ebp - 0x108]
push edx
lea eax, [ebp - 0x208]
push eax
lea ecx, [ebp - 0x308]
mov edx, edi
call fcn.0048e390
add esp, 8
test eax, eax
jne 0x4954ac
cmp edi, 0x80000002
jne 0x4954ac
push 1
lea ecx, [ebp - 0x308]
push ecx
lea edx, [ebp - 0x408]
push edx
lea edx, [ebp - 0x108]
lea ecx, [ebp - 0x208]
call fcn.00482a40
add esp, 0xc
jmp 0x4954ac
cmp eax, 6
jne 0x4954ac
cmp dword [ebp - 0xd1c], 4
jne 0x495462
lea eax, [ebp - 0x508]
push eax
call fcn.004a02f9
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x208]
push edx
mov dword [ebp - 0xd14], eax
lea eax, [ebp - 0x408]
push eax
push str._s_s_s
lea ecx, [ebp - 0x708]
push 0x200
push ecx
call fcn.00402830
lea edx, [ebp - 0xd14]
push edx
lea eax, [ebp - 0x708]
push eax
mov esi, str.SoftwareBillP_StudiosWinPatrolRegOptions
mov ebx, 0x80000001
call fcn.0048e590
jmp 0x4954a9
lea ecx, [ebp - 0x108]
push ecx
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x408]
push eax
push str._s_s_s
lea ecx, [ebp - 0x708]
push 0x200
push ecx
call fcn.00402830
lea edx, [ebp - 0x708]
push edx
push str.SoftwareBillP_StudiosWinPatrolRegOptions
lea ecx, [ebp - 0x508]
mov edx, 0x80000001
call fcn.0048e390
add esp, 0x20
mov eax, dword [ebp - 0xd0c]
inc eax
mov dword [ebp - 0xd0c], eax
cmp eax, dword [ebp - 0xd24]
jl 0x494f10
cmp dword [0x4d2afc], 0
je 0x4954d9
mov eax, dword [ebp - 0xd28]
mov dword [0x4c6444], eax
mov edi, dword [0x4cd38c]
push str.VerifyRegOptions
mov esi, str.____END___
call fcn.0047fb10
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret