Function at 0x4f18f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x568283
mov eax, dword fs:[0]
push eax
sub esp, 0x84c
mov eax, dword [0x5c5244]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x858], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x854], 0
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4f1f18
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x854], 1
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4f1f22
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x838], eax
push 0x56c9a8
lea ecx, [ebp - 0x838]
mov dword [ebp - 4], 1
call fcn.0042d870
test al, al
jne 0x4f19ac
push 0
push 0x56c9a8
lea ecx, [ebp - 0x838]
call fcn.00429710
push dword [ebp + 0xc]
mov dword [ebp - 4], 2
call fcn.004f24c0
mov edx, dword [0x5cf698]
add esp, 4
mov esi, eax
mov eax, edx
mov ecx, dword [edx + 4]
cmp byte [ecx + 0xd], 0
jne 0x4f19ee
cmp dword [ecx + 0x10], esi
jge 0x4f19db
mov ecx, dword [ecx + 8]
jmp 0x4f19df
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x4f19d1
cmp eax, edx
je 0x4f19ee
cmp esi, dword [eax + 0x10]
jge 0x4f19f0
mov eax, edx
cmp edx, eax
je 0x4f1a20
mov edx, dword [eax + 0x14]
test edx, edx
jne 0x4f19ff
xor ecx, ecx
jmp 0x4f1a13
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1a04
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x838]
call fcn.00429710
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4f1f2c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x840], eax
push 0x5895c8
lea ecx, [ebp - 0x840]
mov byte [ebp - 4], 3
call fcn.0042d870
test al, al
jne 0x4f1a67
push 3
push 0x5895c8
lea ecx, [ebp - 0x840]
call fcn.00429710
dec esi
mov byte [ebp - 4], 4
cmp esi, 0xb
ja case.0x4f1a7c.5
movzx eax, byte [esi + 0x4f1f64]
jmp dword [eax*4 + 0x4f1f54]
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4f1f36
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
push 0x20219
push dword [ebp - 0x838]
lea ecx, [ebp - 0x84c]
mov byte [ebp - 4], 6
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042e900
mov edi, dword [ebp - 0x840]
test eax, eax
jne 0x4f1cd7
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x420]
push eax
push edi
call fcn.00498ca0
test eax, eax
jne 0x4f1b50
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1b32
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00429710
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x84c]
push eax
lea eax, [ebp - 0x628]
push eax
push str.SUBPID
call fcn.00498ca0
test eax, eax
jne 0x4f1bc8
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1ba0
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x850]
call fcn.00429710
mov esi, dword [ebp - 0x850]
cmp dword [esi - 0xc], 0
jne 0x4f1be0
push ebx
lea ecx, [ebp - 0x850]
call fcn.00427b10
mov esi, dword [ebp - 0x850]
mov eax, dword [ebx]
mov byte [ebp - 4], 7
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4f1bf8
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4f1c0e
call fcn.00430a50
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x4f1f40
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x854], 3
mov dword [ebp - 0x83c], eax
mov eax, dword [ebx]
push 2
push 0x5895e0
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x83c]
push eax
call fcn.0046c800
add esp, 0x14
mov eax, dword [ebp - 0x83c]
mov byte [ebp - 4], 8
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x4f1c5e
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x4f1c74
call fcn.00430a50
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x4f1f4a
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x854], 7
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x83c]
push esi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x834]
push eax
call fcn.0046c800
add esp, 0x14
lea eax, [ebp - 0x834]
mov ecx, ebx
push eax
call fcn.00427b10
lea ecx, [ebp - 0x834]
call fcn.00427700
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x854], 1
call fcn.00427700
mov eax, dword [ebp - 0x84c]
test eax, eax
je 0x4f1ce8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4f1d04
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x838]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4f1d26
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4f1d42
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004da3bd
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x830]
mov dword [ebp - 0x83c], 1
push 0
push eax
mov dword [ebp - 0x834], 0x104
call fcn.004f39e0
mov edi, dword [ebp - 0x840]
lea eax, [ebp - 0x834]
mov esi, dword [ebp - 0x838]
add esp, 0xc
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x83c]
push eax
push edi
push esi
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4f1d0a
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1dd0
sub ecx, edx
lea eax, [ebp - 0x830]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00429710
jmp 0x4f1d0a
push 8
push str.VendorID
lea ecx, [ebp - 0x840]
call fcn.00429710
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
mov esi, dword [ebp - 0x838]
lea ecx, [ebp - 0x84c]
push 0x20219
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 9
call fcn.0042e900
mov edi, dword [ebp - 0x840]
test eax, eax
mov eax, dword [ebp - 0x84c]
jne 0x4f1f04
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.004f39e0
add esp, 0xc
mov dword [ebp - 0x834], 0x208
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x83c]
push eax
push 0
push edi
push dword [ebp - 0x84c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f1efe
mov eax, dword [ebp - 0x83c]
cmp eax, 1
je 0x4f1eaf
cmp eax, 2
jne 0x4f1efe
mov eax, dword [ebp - 0x834]
test eax, eax
je 0x4f1ecc
test al, 1
jne 0x4f1efe
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x4f1ed5
jmp 0x4f1efe
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f1ee0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.00429710
mov eax, dword [ebp - 0x84c]
test eax, eax
je 0x4f1d0a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4f1d0a
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
push 0x80004005
call fcn.004225f0
sbb eax, 0x1d60004f
dec edi
add byte [ebx + 0x5004f1a], al
push ds
dec edi
add byte [eax], al
add byte [ecx], al
add al, byte [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add dword [ebx], eax
add byte [ebp - 117], dl
in al, dx
push 0xffffffffffffffff
push 0x5682d1
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5c5244]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
call fcn.00430a50
mov ecx, eax
test ecx, ecx
je 0x4f206e
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edi, dword [ebp + 8]
add eax, 0x10
mov dword [edi], eax
push 0x56c9a8
mov ecx, edi
mov dword [ebp - 4], 1
call fcn.0042d870
test al, al
jne 0x4f1fe4
push 0
push 0x56c9a8
mov ecx, edi
call fcn.00429710
push dword [ebp + 0xc]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 1
call fcn.004f24c0
mov esi, dword [0x5cf6a0]
add esp, 4
mov ecx, esi
mov edx, dword [esi + 4]
cmp byte [edx + 0xd], 0
jne 0x4f202d
nop
cmp dword [edx + 0x10], eax
jge 0x4f201a
mov edx, dword [edx + 8]
jmp 0x4f201e
mov ecx, edx
mov edx, dword [edx]
cmp byte [edx + 0xd], 0
je 0x4f2010
cmp ecx, esi
je 0x4f202d
cmp eax, dword [ecx + 0x10]
jge 0x4f202f
mov ecx, esi
cmp esi, ecx
je 0x4f205b
mov edx, dword [ecx + 0x14]
test edx, edx
jne 0x4f203e
xor ecx, ecx
jmp 0x4f2052
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4f2043
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, edi
call fcn.00429710
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004225f0
int3