Function at 0x497893
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x470
mov eax, 0x4d6c12
call fcn.004bed19
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x45c], edx
test eax, eax
jne 0x4978d0
xor eax, eax
jmp 0x497dcb
push ecx
lea ecx, [ebp - 0x430]
call fcn.0040228a
and dword [ebp - 4], 0
lea edi, [ebp - 0x430]
call fcn.00415c5a
push str.wow6432node
xor ecx, ecx
mov esi, edi
call fcn.004072a5
test eax, eax
jle 0x49790d
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.004027b0
jmp 0x4978c9
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.004027b0
push dword [ebp - 0x470]
xor esi, esi
lea eax, [ebp - 0x430]
push 0x5593b8
push eax
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x440], 0x400000
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x448], esi
call fcn.0040f56d
add esp, 0xc
push 0x5593b0
push eax
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], 1
call fcn.0040210c
add esp, 0xc
lea edi, [ebx + 8]
mov byte [ebp - 4], 2
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.004a4959
mov ecx, dword [ebp - 0x438]
add ecx, 0xfffffff0
call fcn.004027b0
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.004027b0
push esi
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x47c]
push eax
push esi
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x460], eax
mov eax, 0x4000
cmp dword [ebp - 0x444], eax
ja 0x497a0c
mov eax, dword [ebp - 0x444]
lea ecx, [eax + 2]
mov eax, 0x400000
mov dword [ebp - 0x444], ecx
cmp dword [ebp - 0x448], eax
ja 0x497a28
mov eax, dword [ebp - 0x448]
add eax, 2
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x44c], ecx
mov byte [eax], 0
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x440]
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x450]
push eax
push esi
lea eax, [ebp - 0x44c]
push eax
push dword [ebx]
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x438], 1
jmp 0x497bda
cmp eax, esi
jne 0x497be5
call fcn.00499991
push eax
lea ecx, [ebp - 0x430]
call fcn.004727f7
push 3
pop ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x44c], esi
jne 0x497ab8
mov eax, dword [ebx]
push 0x40
pop edx
mov word [eax], dx
mov eax, dword [ebx]
xor edx, edx
mov word [eax + 2], dx
mov eax, dword [ebp - 0x450]
dec eax
je 0x497b26
sub eax, ecx
je 0x497af5
lea eax, [ebp - 0x430]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
call fcn.004024df
push dword [ebp - 0x450]
push dword [ebp - 0x440]
push dword [ebx + 4]
call fcn.0049820f
add esp, 0x14
jmp 0x497b5e
mov eax, dword [ebx + 4]
movzx eax, byte [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
mov dword [ebp - 0x464], eax
call fcn.004024df
push dword [ebp - 0x464]
lea ecx, [ebp - 0x430]
call fcn.00497f89
pop ecx
pop ecx
jmp 0x497b5e
lea eax, [ebp - 0x430]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
call fcn.004024df
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x46c], esp
push dword [ebx + 4]
call fcn.004024df
mov byte [ebp - 4], 3
call fcn.0049810d
add esp, 0xc
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x430]
push ecx
push eax
mov ecx, edi
call fcn.004a4959
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.004027b0
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 4]
mov byte [eax], 0
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x440]
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x450]
push eax
push esi
lea eax, [ebp - 0x44c]
push eax
push dword [ebx]
push dword [ebp - 0x438]
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x438]
cmp eax, 0x103
jne 0x497a81
lea eax, [ebp - 0x454]
push eax
mov eax, dword [ebp - 0x45c]
mov eax, dword [eax]
or eax, 0x20019
push eax
push esi
push esi
push dword [ebp - 0x434]
mov dword [ebp - 0x454], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x497dc8
cmp dword [ebp - 0x460], esi
jne 0x4978c9
push 0x412
lea eax, [ebp - 0x42c]
push esi
push eax
call fcn.004be850
add esp, 0xc
mov dword [ebp - 0x434], esi
cmp dword [ebp - 0x468], esi
jbe 0x497dbc
push 0x208
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x434]
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
jne 0x497da4
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 4], 5
push dword [ebp - 0x454]
mov eax, dword [eax]
lea edi, [ebp - 0x43c]
call fcn.00416053
test eax, eax
jne 0x497d8c
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x460]
call fcn.004024df
push 0x52756c
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.0040f54b
test eax, eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x460]
setne bl
add ecx, 0xfffffff0
call fcn.004027b0
test bl, bl
je 0x497d81
cmp dword [ebp - 0x43c], esi
je 0x497d81
push 0x5c
lea ebx, [ebp - 0x458]
call fcn.0043952d
push eax
push dword [ebp - 0x470]
lea eax, [ebp - 0x46c]
push eax
mov byte [ebp - 4], 7
call fcn.004020b5
add esp, 0xc
lea ecx, [ebp - 0x42c]
push ecx
push eax
lea eax, [ebp - 0x464]
push eax
mov byte [ebp - 4], 8
call fcn.0040210c
add esp, 0xc
push dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x474]
push eax
mov byte [ebp - 4], 9
push dword [ebp - 0x43c]
call fcn.00497893
mov ecx, dword [ebp - 0x464]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [ebp - 0x46c]
add ecx, 0xfffffff0
call fcn.004027b0
mov ecx, dword [ebp - 0x458]
add ecx, 0xfffffff0
call fcn.004027b0
xor esi, esi
lea ecx, [ebp - 0x43c]
call fcn.0041608f
or dword [ebp - 4], 0xffffffff
xor eax, eax
lea ecx, [ebp - 0x43c]
mov word [ebp - 0x42c], ax
call fcn.0041608f
inc dword [ebp - 0x434]
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x468]
jb 0x497c49
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
call fcn.004bed9c
ret 0xc