Function at 0x484050
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x78
mov eax, 0x50e5c4
call fcn.005060cc
mov dword [ebp - 0x78], ecx
push 0xe
pop ecx
mov esi, str.softwaremicrosoftwindows_ntcurrentversionperflib009
mov dword [0xd59fcc], 1
lea edi, [ebp - 0x58]
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x6c], ebx
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x58]
movsb byte es:[edi], byte [esi]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4840a1
push 2
pop eax
jmp 0x48429b
mov eax, dword [ebp - 0x6c]
lea edi, [ebp - 0x1c]
mov esi, str.Counters
mov dword [ebp - 0x80], ebx
push 3
mov dword [ebp - 0x7c], ebx
lea ecx, [ebp - 0x68]
pop ebx
movsd dword es:[edi], dword [esi]
push ecx
lea ecx, [ebp - 0x74]
mov dword [ebp - 0x84], eax
mov dword [0xd59fcc], ebx
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor edi, edi
push edi
push ecx
push edi
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x68], edi
push ecx
push eax
mov dword [ebp - 0x74], edi
call esi
mov dword [ebp - 4], edi
test eax, eax
jne 0x48428e
mov dword [0xd59fcc], 4
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
lea eax, [ebp - 0x64]
mov byte [ebp - 4], bl
push eax
push dword [ebp - 0x68]
mov ecx, eax
call fcn.004159bf
lea eax, [ebp - 0x68]
mov dword [0xd59fcc], 6
push eax
push dword [ebp - 0x64]
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x6c]
call esi
test eax, eax
je 0x48415c
mov ecx, dword [ebp - 0x64]
test ecx, ecx
je 0x484154
mov edx, dword [ebp - 0x5c]
push ecx
push 1
sub edx, ecx
call fcn.0040b8be
pop ecx
pop ecx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
push 5
pop ebx
jmp 0x48428e
mov esi, dword [ebp - 0x64]
push 5
pop ebx
mov dword [ebp - 0x70], ebx
cmp byte [esi], 0
je 0x48425d
mov eax, dword [ebp - 0x78]
mov dword [0xd59fcc], 8
push dword [eax + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4841d4
mov dword [0xd59fcc], 0xa
lea edi, [esi - 2]
jmp 0x484199
dec edi
movsx eax, byte [edi]
push eax
call fcn.004f83c3
pop ecx
test eax, eax
jne 0x484198
mov dword [0xd59fcc], 0xb
add edi, 1
jne 0x4841ba
xor eax, eax
jmp 0x4841c1
push edi
call fcn.004f5d90
pop ecx
mov ecx, dword [ebp - 0x78]
push eax
push edi
lea ecx, [ecx + 0x18]
call fcn.0040942f
dec ebx
mov dword [ebp - 0x70], ebx
jmp 0x484241
mov dword [0xd59fcc], 0xd
mov edi, 0xd395a8
push dword [edi - 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x484236
mov dword [0xd59fcc], 0xe
lea ebx, [esi - 2]
jmp 0x484201
dec ebx
movsx eax, byte [ebx]
push eax
call fcn.004f83c3
pop ecx
test eax, eax
jne 0x484200
lea eax, [ebx + 1]
mov dword [0xd59fcc], 0xf
push eax
call fcn.004f8f23
mov ebx, dword [ebp - 0x70]
dec ebx
mov dword [edi], eax
pop ecx
mov dword [0xd59fcc], 0x10
mov dword [ebp - 0x70], ebx
add edi, 0x10
cmp edi, 0xd395e8
jl 0x4841e3
push esi
mov dword [0xd59fcc], 0x11
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc esi
add esi, eax
test ebx, ebx
jne 0x484165
mov ecx, dword [ebp - 0x64]
mov dword [0xd59fcc], 0x13
test ecx, ecx
je 0x48428a
mov edx, dword [ebp - 0x5c]
push ecx
push 1
sub edx, ecx
call fcn.0040b8be
xor edi, edi
pop ecx
pop ecx
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edi
jmp 0x48428c
xor edi, edi
mov ebx, edi
lea ecx, [ebp - 0x84]
call fcn.00408049
mov eax, ebx
call fcn.00506076
ret 8