Function at 0x484d19
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x418], ecx
xor edi, edi
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x410], edi
push ecx
push 9
push edi
mov ebx, edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x484d76
push edi
push esi
xor edx, edx
mov ecx, 0x41de24
call fcn.004cfab1
push esi
push 0x410013a
push ebx
jmp 0x48507d
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0x400
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push 0x41de40
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x484dcb
push edi
push esi
xor edx, edx
mov ecx, 0x41dc3c
call fcn.004cfab1
push esi
push 0x420013a
push 0x41de40
jmp 0x48507d
mov eax, dword [ebp - 0x40c]
and eax, 0xfffffffe
cmp eax, 0x402
jae 0x4850b6
xor ecx, ecx
mov word [ebp + eax - 0x408], cx
mov ecx, 0x897
call fcn.004cf8b9
push eax
call fcn.004c5942
push ebx
push dword [ebp - 0x418]
push 0x41de58
call fcn.004c5942
add esp, 0x10
mov ecx, 0x892
call fcn.004cf8b9
push eax
call fcn.004c5942
lea eax, [ebp - 0x408]
push eax
push 0x405900
call fcn.004c5942
add esp, 0xc
mov dword [ebp - 0x40c], 0x400
lea eax, [ebp - 0x40c]
mov ebx, 0x41de6c
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push ebx
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x484e82
push edi
push esi
xor edx, edx
mov ecx, 0x41dc3c
call fcn.004cfab1
push esi
push 0x434013a
jmp 0x484d70
mov eax, dword [ebp - 0x40c]
and eax, 0xfffffffe
cmp eax, 0x402
jae 0x4850b6
xor ecx, ecx
mov word [ebp + eax - 0x408], cx
lea eax, [ebp - 0x408]
push eax
mov ecx, 0x898
call fcn.004cf8b9
push eax
call fcn.004c5942
mov ebx, 0x406520
push ebx
call fcn.004c5942
add esp, 0xc
mov dword [ebp - 0x40c], 0x400
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push 0x41de7c
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x484f4c
mov eax, dword [ebp - 0x40c]
and eax, 0xfffffffe
cmp eax, 0x402
jae 0x4850b6
xor ecx, ecx
mov word [ebp + eax - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x405204
call fcn.004c5942
pop ecx
pop ecx
lea ecx, [ebp - 0x408]
call fcn.00484b75
mov esi, eax
test esi, esi
je 0x484f6f
push esi
push 0x44a013a
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x484f6f
cmp esi, 2
jne 0x485058
mov ecx, 0x884
call fcn.004cf8b9
push eax
call fcn.004c5942
push ebx
call fcn.004c5942
pop ecx
pop ecx
mov esi, edi
lea eax, [ebp - 0x40c]
mov dword [ebp - 0x40c], 0x400
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push 0x41de8c
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x484ffd
mov eax, dword [ebp - 0x40c]
and eax, 0xfffffffe
cmp eax, 0x402
jae 0x4850b6
xor ecx, ecx
mov word [ebp + eax - 0x408], cx
lea eax, [ebp - 0x408]
push eax
push 0x405204
call fcn.004c5942
pop ecx
pop ecx
lea ecx, [ebp - 0x408]
call fcn.00484af2
mov edi, eax
test edi, edi
je 0x48501f
push edi
push 0x468013a
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x48501f
cmp ebx, 2
jne 0x485027
mov ecx, 0x886
call fcn.004cf8b9
push eax
call fcn.004c5942
mov dword [esp], 0x406520
call fcn.004c5942
pop ecx
test esi, esi
jne 0x485083
mov esi, edi
jmp 0x485083
push ebx
mov ecx, 0x885
call fcn.004cf8b9
push eax
call fcn.004c5942
push 0x406520
call fcn.004c5942
add esp, 0xc
test esi, esi
jne 0x48504b
mov esi, ebx
push ebx
push 0x478013a
push 0x41de8c
jmp 0x48507d
push esi
mov ecx, 0x885
call fcn.004cf8b9
push eax
call fcn.004c5942
push ebx
call fcn.004c5942
add esp, 0xc
push esi
push 0x456013a
push 0x41de7c
call dword [sym.imp.certcli.dll_Ordinal_359]
push 0x406520
call fcn.004c5942
cmp dword [ebp - 0x410], 0
pop ecx
je 0x4850a3
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 4
call fcn.0050393c
int3