Function at 0x494e08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a8
mov dword [ebp - 0x14], 0
cmp dword [0x4fd9a0], 0
jne 0x494fc0
cmp dword [0x4fda20], 0
je 0x494e3e
sub esp, 0xc
push str.rndw32slow_gatherer_nt:_init_toolkit_n
call fcn.0049d984
add esp, 0x10
sub esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlProductOptions
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x494ef7
mov dword [ebp - 0x18], 0x20
cmp dword [0x4fda20], 0
je 0x494e86
sub esp, 0xc
push str.rndw32slow_gatherer_nt:_check_product_options_n
call fcn.0049d984
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push str.ProductType
push dword [ebp - 0x24]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x494ee9
sub esp, 8
push str.WinNT
lea eax, [ebp - 0x48]
push eax
call fcn.004a052d
add esp, 0x10
test eax, eax
je 0x494ee9
mov dword [0x4d0910], 0
cmp dword [0x4fda20], 0
je 0x494ee9
sub esp, 0xc
push str.rndw32:_this_is_a_NT_server_n
call fcn.0049d984
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x24]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
sub esp, 0xc
push str.NETAPI32.DLL
call sub.KERNEL32.dll_LoadLibraryA
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x494fb6
cmp dword [0x4fda20], 0
je 0x494f2e
sub esp, 0xc
push str.rndw32slow_gatherer_nt:_netapi32_loaded_n
call fcn.0049d984
add esp, 0x10
sub esp, 8
push str.NetStatisticsGet
push dword [ebp - 0x14]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd9b0], eax
sub esp, 8
push str.NetApiBufferSize
push dword [ebp - 0x14]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd9c0], eax
sub esp, 8
push str.NetApiBufferFree
push dword [ebp - 0x14]
call sub.KERNEL32.dll_GetProcAddress
add esp, 8
mov dword [0x4fd9d0], eax
cmp dword [0x4fd9b0], 0
je 0x494f91
cmp dword [0x4fd9c0], 0
je 0x494f91
cmp dword [0x4fd9d0], 0
jne 0x494fb6
sub esp, 0xc
push dword [ebp - 0x14]
call sub.KERNEL32.dll_FreeLibrary
add esp, 0xc
mov dword [ebp - 0x14], 0
sub esp, 0xc
push str.rndw32:_No_NETAPI_found_n
call fcn.0049d984
add esp, 0x10
mov dword [0x4fd9a0], 1
cmp dword [ebp - 0x14], 0
je 0x49505b
sub esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
cmp dword [0x4d0910], 0
je 0x494fea
mov dword [ebp - 0x19c], str.LanmanWorkstation
jmp 0x494ff4
mov dword [ebp - 0x19c], str.LanmanServer
push dword [ebp - 0x19c]
push 0
mov eax, dword [0x4fd9b0]
call eax
add esp, 0xc
test eax, eax
jne 0x49505b
cmp dword [0x4fda20], 0
je 0x495023
sub esp, 0xc
push str.rndw32slow_gatherer_nt:_get_netstats_n
call fcn.0049d984
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x4c]
mov eax, dword [0x4fd9c0]
call eax
add esp, 8
sub esp, 4
push dword [ebp + 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x4c]
mov eax, dword [0x4fd9d0]
call eax
add esp, 0xc
mov dword [ebp - 0x20], 0
sub esp, 4
push dword [ebp - 0x20]
push str..PhysicalDrive_d
lea eax, [ebp - 0x198]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
sub esp, 4
push 0
push 0
push 3
push 0
push 3
push 0
lea eax, [ebp - 0x198]
push eax
call sub.KERNEL32.dll_CreateFileA
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x4950a8
jmp 0x49512d
push 0
lea eax, [ebp - 0x18]
push eax
push 0x100
lea eax, [ebp - 0x158]
push eax
push 0
push 0
push 0x70020
push dword [ebp - 0x10]
call sub.KERNEL32.dll_DeviceIoControl
test eax, eax
je 0x495105
cmp dword [0x4fda20], 0
je 0x4950eb
sub esp, 8
push dword [ebp - 0x20]
push str.rndw32slow_gatherer_nt:_iostats_drive__d_n
call fcn.0049d984
add esp, 0x10
sub esp, 4
push dword [ebp + 0xc]
push dword [ebp - 0x18]
lea eax, [ebp - 0x158]
push eax
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
jmp 0x495115
sub esp, 0xc
push str.NOTE:_you_should_run_diskperf__y_to_enable_the_disk_statistics_n
call fcn.0049d7de
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
lea eax, [ebp - 0x20]
inc dword [eax]
jmp 0x495062
sub esp, 0xc
push dword [0x4d0914]
call fcn.004a2e27
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [0x4d0914]
mov dword [ebp - 0x18], eax
cmp dword [0x4fda20], 0
je 0x495162
sub esp, 0xc
push str.rndw32slow_gatherer_nt:_get_perf_data_n
call fcn.0049d984
add esp, 0x10
sub esp, 8
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
push 0
push 0
push str.Global
push 0x80000004
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4951cc
sub esp, 4
push 8
push str.PERF
push dword [ebp - 0xc]
call sub.msvcrt.dll_memcmp
add esp, 0x10
test eax, eax
jne 0x4951ba
sub esp, 4
push dword [ebp + 0xc]
push dword [ebp - 0x18]
push dword [ebp - 0xc]
mov eax, dword [ebp + 8]
call eax
add esp, 0x10
jmp 0x49520b
sub esp, 0xc
push str.rndw32:_no_PERF_signature_n
call fcn.0049d984
add esp, 0x10
jmp 0x49520b
cmp dword [ebp - 0x1c], 0xea
jne 0x4951fb
add dword [0x4d0914], 0x4000
sub esp, 8
push dword [0x4d0914]
push dword [ebp - 0xc]
call fcn.004a2f05
add esp, 0x10
mov dword [ebp - 0xc], eax
jmp 0x495141
sub esp, 0xc
push str.rndw32:_get_performance_data_problem_n
call fcn.0049d984
add esp, 0x10
sub esp, 0xc
push dword [ebp - 0xc]
call fcn.004a2f78
add esp, 0x10
sub esp, 0xc
push 0x80000004
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
leave
ret