Function at 0x4f7de0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x1c
push ebx
mov ebx, dword [esp + 0x24]
push ebp
push esi
push edi
mov edi, dword [esp + 0x34]
mov esi, dword [ebx + 8]
mov ebp, dword [ebx]
test edi, edi
je GetPixel
lea esp, [esp]
mov eax, dword [esp + 0x38]
cmp eax, 0xb
jne 0x4f7e0f
movzx eax, byte [edi + 1]
jmp RegOpenKeyExW
movzx eax, al
mov byte [ebx + 0x96], al
mov eax, dword [edi + 0x24]
test eax, eax
je RegOpenKeyW
push eax
push str.____s
push ebp
call fcn.0054e0f0
mov edx, dword [esi + 0x74]
add esp, 0xc
mov dword [esp + 0x34], eax
cmp dword [esi + 0x78], edx
jg 0x4f7e59
push 0
push 1
push RegQueryValueExW
push 0xb3
push esi
call fcn.00515850
add esp, 0x14
mov edx, eax
jmp 0x4f7e90
mov ebx, dword [esp + 0x30]
lea eax, [edx + 1]
mov dword [esi + 0x74], eax
lea ecx, [edx + edx*4]
mov eax, dword [esi + 0x70]
mov dword [eax + ecx*4], 0xb3
mov dword [eax + ecx*4 + 4], 0x7fffffff
mov dword [eax + ecx*4 + 8], 1
mov dword [eax + ecx*4 + RegCreateKeyExWxc], 0
mov dword [eax + ecx*4 + 0x10], 0
mov eax, dword [esi]
cmp byte [eax + 0x57], 0
je 0x4f7ea9
push dword [esp + 0x34]
push 0xfffffffffffffff9
push eax
call fcn.00502620
add esp, 0xc
jmp 0x4f7ee2
test edx, edx
jns 0x4f7eb1
mov edx, dword [esi + 0x74]
dec edx
mov eax, dword [esi + 0x70]
lea ecx, [edx + edx*4]
cmp byte [eax + ecx*4 + 1], 0
lea ecx, [eax + ecx*4]
je 0x4f7ed3
push 0xfffffffffffffff9
push dword [esp + 0x38]
push ecx
push esi
call fcn.0057a650
add esp, 0x10
jmp 0x4f7ee2
mov eax, dword [esp + 0x34]
test eax, eax
je 0x4f7ee2
mov dword [ecx + 0x10], eax
mov byte [ecx + 1], 0xf9
movzx eax, byte [edi]
sub eax, 0x7f
je 0x4f7fe3
dec eax
je 0x4f7faf
dec eax
je 0x4f7f60
push 0
push dword [edi + 8]
push ebp
call fcn.0055a950
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], eax
push ecx
push eax
push ebx
mov byte [esp + 0x28], 4
mov dword [esp + 0x2c], 0
mov dword [esp + CloseServiceHandlex30], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x34], 0
mov dword [esp + ControlServicex38], 0
call fcn.00558140
mov eax, dword [esp + 0x4c]
add esp, 0x18
test eax, eax
je RegEnumValueW
push 1
push eax
push ebp
call fcn.004f5e50
add esp, 0xc
jmp CryptCreateHash
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4f7f79
push 0
push 0
push eax
push ebp
call fcn.004fe730
add esp, 0x10
mov ecx, eax
jmp 0x4f7f7b
xor ecx, ecx
movzx eax, byte [ebx + 0x96]
push 0
push 0
push 0
push eax
push ecx
push 0
push dword [edi + 0x18]
push ebp
call fcn.0053e850
add esp, 0xc
push eax
push edi
push ebx
call fcn.0055ce60
add esp, 8
push eax
push ebx
call fcn.0055d680
add esp, 0x20
jmp 0x4f8028
mov eax, dword [edi + 0x14]
test eax, eax
je 0x4f7fc6
push 0
push 0
push eax
push ebp
call fcn.004fe730
add esp, 0x10
jmp reloc.ADVAPI32.dll_CryptReleaseContext
xor eax, eax
push 0
push 0
push eax
push edi
push ebx
call fcn.0055ce60
add esp, 8
push eax
push ebx
call fcn.00537ed0
add esp, 0x14
jmp 0x4f8028
push dword [edi + 0x20]
push ebp
call fcn.00560350
add esp, 8
push eax
movzx eax, byte [ebx + 0x96]
push eax
push dword [edi + 0x1c]
push ebp
call fcn.0054a840
add esp, 8
push eax
push 0
push dword [edi + 8]
push ebp
call fcn.0055a950
add esp, 0xc
push eax
push edi
push ebx
call fcn.0055ce60
add esp, 8
push eax
push ebx
call fcn.0054b220
add esp, 0x18
mov ecx, dword [esi + 0x74]
cmp dword [esi + 0x78], ecx
jg OpenProcessToken
push 0
push 0
push 0
push 0x82
push esi
call fcn.00515850
add esp, 0x14
jmp RegEnumValueW
lea eax, [ecx + 1]
mov dword [esi + 0x74], eax
lea ecx, [ecx + ecx*4]
mov eax, dword [esi + 0x70]
mov dword [eax + ecx*4 + OpenServiceWx10], 0
mov dword [eax + ecx*4 + 0xc], 0
mov dword [eax + ecx*4 + 8], QueryServiceStatus
mov dword [eax + ecx*4 + 4], 0
mov dword [eax + ecx*4], 0x82
mov edi, dword [edi + 0x28]
test edi, edi
jne 0x4f7e00
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret