Function at 0x4a4fe6
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x4cfeab
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x517930]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x517930]
xor eax, esp
push eax
lea eax, [esp + 0x1b0]
mov dword fs:[0], eax
mov byte [esp + 0x17], dl
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea eax, [esp + 0x18]
mov dword [esp + 0x1b8], ebx
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4a5407
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
mov dword [esp + 0x2c], 0x104
push eax
lea eax, [esp + 0xb8]
mov edi, ebx
push eax
push ebx
push dword [esp + 0x34]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
call ebx
test eax, eax
jne 0x4a53dc
mov ebp, 0x51110c
cmp byte [esp + 0x1c4], 0
je 0x4a5156
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x30]
call fcn.004a0551
push str.opera.exe
lea ecx, [esp + 0x60]
mov dword [esp + 0x1bc], 1
call fcn.004a0551
push ebp
lea ecx, [esp + 0x48]
mov byte [esp + 0x1bc], 2
call fcn.004a5a71
push ebp
lea ecx, [esp + 0x78]
mov byte [esp + 0x1bc], 3
call fcn.004a5a71
lea eax, [esp + 0x2c]
mov byte [esp + 0x1b8], 4
push eax
lea eax, [esp + 0x60]
push eax
lea edx, [esp + 0x4c]
lea ecx, [esp + 0x7c]
call fcn.004a5431
pop ecx
pop ecx
xor ebp, ebp
lea ecx, [esp + 0x74]
push ebp
push 1
call fcn.004a5d50
push ebp
push 1
lea ecx, [esp + 0x4c]
call fcn.004a5d50
push ebp
push 1
lea ecx, [esp + 0x64]
call fcn.004a07fa
push ebp
push 1
lea ecx, [esp + 0x34]
mov byte [esp + 0x1c0], 0
call fcn.004a07fa
mov ebp, 0x51110c
cmp byte [esp + 0x17], 0
je 0x4a520a
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x78]
call fcn.004a0551
push str.firefox.exe
lea ecx, [esp + 0x48]
mov dword [esp + 0x1bc], 5
call fcn.004a0551
push ebp
lea ecx, [esp + 0x60]
mov byte [esp + 0x1bc], 6
call fcn.004a5a71
push ebp
lea ecx, [esp + 0x30]
mov byte [esp + 0x1bc], 7
call fcn.004a5a71
lea eax, [esp + 0x74]
mov byte [esp + 0x1b8], 8
push eax
lea eax, [esp + 0x48]
push eax
lea edx, [esp + 0x64]
lea ecx, [esp + 0x34]
call fcn.004a5431
pop ecx
pop ecx
xor ebp, ebp
lea ecx, [esp + 0x2c]
push ebp
push 1
call fcn.004a5d50
push ebp
push 1
lea ecx, [esp + 0x64]
call fcn.004a5d50
push ebp
push 1
lea ecx, [esp + 0x4c]
call fcn.004a07fa
push ebp
push 1
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1c0], 0
call fcn.004a07fa
cmp byte [esp + 0x1c0], 0
je 0x4a52c6
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x78]
call fcn.004a0551
push str.thunderbird.exe
lea ecx, [esp + 0x48]
mov dword [esp + 0x1bc], 9
call fcn.004a0551
mov ebp, 0x51110c
mov byte [esp + 0x1b8], 0xa
push ebp
lea ecx, [esp + 0x60]
call fcn.004a5a71
push ebp
lea ecx, [esp + 0x30]
mov byte [esp + 0x1bc], 0xb
call fcn.004a5a71
lea eax, [esp + 0x74]
mov byte [esp + 0x1b8], 0xc
push eax
lea eax, [esp + 0x48]
push eax
lea edx, [esp + 0x64]
lea ecx, [esp + 0x34]
call fcn.004a5431
pop ecx
pop ecx
xor ebp, ebp
lea ecx, [esp + 0x2c]
push ebp
push 1
call fcn.004a5d50
push ebp
push 1
lea ecx, [esp + 0x64]
call fcn.004a5d50
push ebp
push 1
lea ecx, [esp + 0x4c]
call fcn.004a07fa
push ebp
push 1
lea ecx, [esp + 0x7c]
mov byte [esp + 0x1c0], 0
call fcn.004a07fa
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x90]
call fcn.004a0551
mov ebp, str.S_1_5_18
mov dword [esp + 0x1b8], 0xd
push ebp
call fcn.004a03cf
pop ecx
push eax
push ebp
push dword [esp + 0xa4]
xor ebp, ebp
lea ecx, [esp + 0x98]
push ebp
call fcn.004a0792
test eax, eax
je 0x4a5394
push str.S_1_5_19
call fcn.004a03cf
pop ecx
push eax
push str.S_1_5_19
push dword [esp + 0xa4]
lea ecx, [esp + 0x98]
push ebp
call fcn.004a0792
test eax, eax
je 0x4a5394
push str.S_1_5_20
call fcn.004a03cf
pop ecx
push eax
push str.S_1_5_20
push dword [esp + 0xa4]
lea ecx, [esp + 0x98]
push ebp
call fcn.004a0792
test eax, eax
je 0x4a5394
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x30]
call fcn.004a0551
lea eax, [esp + 0x2c]
mov byte [esp + 0x1b8], 0xe
push eax
mov ecx, esi
call fcn.004a5adc
push ebp
push 1
lea ecx, [esp + 0x34]
call fcn.004a07fa
push 0
push 1
lea ecx, [esp + 0x94]
mov dword [esp + 0x24], 0x104
inc edi
mov byte [esp + 0x1c0], 0
call fcn.004a07fa
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0xb8]
push eax
push edi
push dword [esp + 0x34]
call ebx
mov ebp, 0x51110c
test eax, eax
je 0x4a509a
mov eax, dword [esi + 4]
sub eax, dword [esi]
mov byte [esp + 0x24], 0
push dword [esp + 0x24]
cdq
push 0x18
pop ecx
idiv ecx
mov edx, dword [esi + 4]
mov ecx, dword [esi]
push eax
call fcn.004a62c3
pop ecx
pop ecx
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x1b0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.004b5580
add esp, 0x1a8
ret