Function at 0x4efb14
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x8b751e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcb8
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xcc4], edi
mov dword [ebp - 0xcc0], esi
mov dword [ebp - 0xcbc], ebx
lea eax, [ebp - 0xca8]
push eax
push 0xf003f
push 0
push 0xa0eac4
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4f02f5
xor eax, eax
mov dword [ebp - 0xcb8], eax
xor edx, edx
mov dword [ebp - 0xcb0], edx
mov esi, dword [ebp - 0xcb0]
mov dword [ebp - 0xca4], 0x400
xor edx, edx
lea ebx, [ebp - 0xc98]
lea ecx, [ebp - 0xca4]
lea eax, [ebp - 0xca0]
push eax
push edx
push edx
push edx
push ecx
push ebx
push esi
push dword [ebp - 0xca8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add dword [ebp - 0xcb0], 1
test eax, eax
jne 0x4f02cf
lea edx, [ebp - 0xc98]
lea eax, [ebp - 0x898]
push eax
push 0xf003f
push 0
push edx
push dword [ebp - 0xca8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [ebp - 0xcac], eax
mov esi, dword [ebp - 0xcac]
mov dword [ebp - 0xca4], 0x400
xor edx, edx
lea ebx, [ebp - 0x894]
lea ecx, [ebp - 0xca4]
lea eax, [ebp - 0xca0]
push eax
push edx
push edx
push edx
push ecx
push ebx
push esi
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
add dword [ebp - 0xcac], 1
test eax, eax
jne 0x4f02c1
lea edx, [ebp - 0x894]
lea eax, [ebp - 0x494]
push eax
push 0xf003f
push 0
push edx
push dword [ebp - 0x898]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x490], 0x400
lea ecx, [ebp - 0x8c]
lea edx, [ebp - 0x48c]
lea eax, [ebp - 0x490]
push eax
push edx
push ecx
push 0
push 0xa0ead0
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x88], 0xa0ea90
mov dword [ebp - 0x84], 0
lea edi, [ebp - 0x48c]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4efcb5
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4efca9
add eax, 1
push eax
call fcn.00898760
pop ecx
mov dword [ebp - 0x84], eax
lea edi, [ebp - 0x48c]
mov esi, eax
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4efccd
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
test edi, edi
je 0x4f0390
mov ecx, dword [ebp - 0x84]
test ecx, ecx
je 0x4f0389
mov al, byte [edi]
cmp al, byte [ecx]
jne 0x4efd34
mov esi, ecx
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4efd26
or dl, dl
je 0x4efd22
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4efd26
add edi, 2
add esi, 2
or dl, dl
jne 0x4efd06
xor eax, eax
jmp 0x4efd2b
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
sete dl
jmp 0x4efd36
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x88], 0xa0ea90
test ecx, ecx
je 0x4efd59
push ecx
call fcn.00888fb0
pop ecx
mov dword [ebp - 0x84], 0
test ebx, ebx
jne 0x4efbec
mov dword [ebp - 0x490], 0x400
lea ecx, [ebp - 0x8c]
lea edx, [ebp - 0x48c]
lea eax, [ebp - 0x490]
push eax
push edx
push ecx
push 0
push 0xa0eae0
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x78], 0xa0ea90
mov dword [ebp - 0x74], 0
lea edi, [ebp - 0x48c]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4efdc7
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4efdbb
add eax, 1
push eax
call fcn.00898760
pop ecx
mov dword [ebp - 0x74], eax
lea edi, [ebp - 0x48c]
mov esi, eax
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4efddc
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 4]
test edi, edi
je 0x4f0384
mov ecx, dword [ebp - 0x74]
test ecx, ecx
je 0x4f037d
mov al, byte [edi]
cmp al, byte [ecx]
jne 0x4efe40
mov esi, ecx
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4efe32
or dl, dl
je 0x4efe2e
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4efe32
add edi, 2
add esi, 2
or dl, dl
jne 0x4efe12
xor eax, eax
jmp 0x4efe37
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
sete dl
jmp 0x4efe42
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x78], 0xa0ea90
test ecx, ecx
je 0x4efe62
push ecx
call fcn.00888fb0
pop ecx
mov dword [ebp - 0x74], 0
test ebx, ebx
jne 0x4efbec
mov dword [ebp - 0x490], 0x400
lea ecx, [ebp - 0x8c]
lea edx, [ebp - 0x48c]
lea eax, [ebp - 0x490]
push eax
push edx
push ecx
push 0
push 0xa0eaec
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x68], 0xa0ea90
mov dword [ebp - 0x64], 0
lea edi, [ebp - 0x48c]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4efecd
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4efec1
add eax, 1
push eax
call fcn.00898760
pop ecx
mov dword [ebp - 0x64], eax
lea edi, [ebp - 0x48c]
mov esi, eax
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4efee2
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 4]
test edi, edi
je 0x4f0378
mov ecx, dword [ebp - 0x64]
test ecx, ecx
je 0x4f0371
mov al, byte [edi]
cmp al, byte [ecx]
jne 0x4eff46
mov esi, ecx
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4eff38
or dl, dl
je 0x4eff34
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4eff38
add edi, 2
add esi, 2
or dl, dl
jne 0x4eff18
xor eax, eax
jmp 0x4eff3d
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
sete dl
jmp 0x4eff48
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x68], 0xa0ea90
test ecx, ecx
je 0x4eff68
push ecx
call fcn.00888fb0
pop ecx
mov dword [ebp - 0x64], 0
test ebx, ebx
jne 0x4efbec
mov dword [ebp - 0x490], 0x400
lea ecx, [ebp - 0x8c]
lea edx, [ebp - 0x48c]
lea eax, [ebp - 0x490]
push eax
push edx
push ecx
push 0
push 0xa0eafc
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x14]
push 0x9f3198
lea eax, [ebp - 0x58]
push eax
call fcn.0089882d
add esp, 0xc
mov dword [ebp - 0x18], 0xa0ea90
mov dword [ebp - 0x14], 0
lea edi, [ebp - 0x58]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4effe4
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4effd8
add eax, 1
push eax
call fcn.00898760
pop ecx
mov dword [ebp - 0x14], eax
lea edi, [ebp - 0x58]
mov esi, eax
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4efff6
mov dword [ebp - 4], 3
mov dword [ebp - 0x60], 0xa0ea90
mov dword [ebp - 0x5c], 0
lea edi, [ebp - 0x48c]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4f0035
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4f0029
add eax, 1
push eax
call fcn.00898760
pop ecx
mov dword [ebp - 0x5c], eax
lea edi, [ebp - 0x48c]
mov esi, eax
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4f004a
mov dword [ebp - 4], 4
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x4f036c
mov ecx, dword [ebp - 0x5c]
test ecx, ecx
je 0x4f0365
mov al, byte [ebx]
cmp al, byte [ecx]
jne 0x4f00ad
mov edi, ebx
mov esi, ecx
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4f009f
or dl, dl
je 0x4f009b
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4f009f
add edi, 2
add esi, 2
or dl, dl
jne 0x4f007f
xor eax, eax
jmp 0x4f00a4
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
sete dl
jmp 0x4f00af
xor edx, edx
xor eax, eax
test edx, edx
sete al
mov dword [ebp - 0xcb4], eax
mov dword [ebp - 4], 3
mov dword [ebp - 0x60], 0xa0ea90
test ecx, ecx
je 0x4f00d8
push ecx
call fcn.00888fb0
pop ecx
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x5c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0xa0ea90
test ebx, ebx
je 0x4f00f8
push ebx
call fcn.00888fb0
pop ecx
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0x14], 0
test eax, eax
jne 0x4efbec
mov dword [ebp - 0x490], 0x400
lea ecx, [ebp - 0x8c]
lea edx, [ebp - 0x48c]
lea eax, [ebp - 0x490]
push eax
push edx
push ecx
push 0
push 0xa0eb0c
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0x18]
push 0x9f3198
lea eax, [ebp - 0x58]
push eax
call fcn.0089882d
add esp, 0xc
mov dword [ebp - 0x70], 0xa0ea90
mov dword [ebp - 0x6c], 0
lea edi, [ebp - 0x58]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4f017a
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4f016e
add eax, 1
push eax
call fcn.00898760
pop ecx
mov dword [ebp - 0x6c], eax
lea edi, [ebp - 0x58]
mov esi, eax
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4f018c
mov dword [ebp - 4], 5
mov dword [ebp - 0x80], 0xa0ea90
mov dword [ebp - 0x7c], 0
lea edi, [ebp - 0x48c]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x4f01cb
add ecx, 1
add eax, 1
mov dl, byte [ecx]
test dl, dl
jne 0x4f01bf
add eax, 1
push eax
call fcn.00898760
pop ecx
mov dword [ebp - 0x7c], eax
lea edi, [ebp - 0x48c]
mov esi, eax
mov dl, byte [edi]
add edi, 1
mov byte [esi], dl
add esi, 1
test dl, dl
jne 0x4f01e0
mov dword [ebp - 4], 6
mov ebx, dword [ebp - 0x6c]
test ebx, ebx
je 0x4f0360
mov ecx, dword [ebp - 0x7c]
test ecx, ecx
je 0x4f0359
mov al, byte [ebx]
cmp al, byte [ecx]
jne 0x4f0243
mov edi, ebx
mov esi, ecx
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x4f0235
or dl, dl
je 0x4f0231
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x4f0235
add edi, 2
add esi, 2
or dl, dl
jne 0x4f0215
xor eax, eax
jmp 0x4f023a
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
sete dl
jmp 0x4f0245
xor edx, edx
xor eax, eax
test edx, edx
sete al
mov dword [ebp - 0xcb4], eax
mov dword [ebp - 4], 5
mov dword [ebp - 0x80], 0xa0ea90
test ecx, ecx
je 0x4f026e
push ecx
call fcn.00888fb0
pop ecx
mov ebx, dword [ebp - 0x6c]
mov dword [ebp - 0x7c], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x70], 0xa0ea90
test ebx, ebx
je 0x4f028e
push ebx
call fcn.00888fb0
pop ecx
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0x6c], 0
test eax, eax
jne 0x4efbec
push 0xa0eb14
lea eax, [ebp - 0x894]
push eax
call fcn.00898de0
add esp, 8
test eax, eax
jne 0x4efbec
jmp 0x4f030b
mov eax, dword [ebp - 0xcb8]
test eax, eax
je 0x4efb7d
mov eax, dword [ebp - 0xcb8]
mov edi, dword [ebp - 0xcc4]
mov esi, dword [ebp - 0xcc0]
mov ebx, dword [ebp - 0xcbc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp - 0xcbc]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x490], 0x400
lea ecx, [ebp - 0x8c]
lea edx, [ebp - 0x48c]
lea eax, [ebp - 0x490]
push eax
push edx
push ecx
push 0
push 0xa0eb20
push dword [ebp - 0x494]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsx eax, byte [ebp - 0x48c]
push eax
call fcn.00898f5e
pop ecx
movsx edx, al
mov dword [ebp - 0xcb8], edx
jmp 0x4f02c1
xor edx, edx
jmp 0x4f0245
mov ecx, dword [ebp - 0x7c]
jmp 0x4f0359
xor edx, edx
jmp 0x4f00af
mov ecx, dword [ebp - 0x5c]
jmp 0x4f0365
xor edx, edx
jmp 0x4eff48
mov ecx, dword [ebp - 0x64]
jmp 0x4f0371
xor edx, edx
jmp 0x4efe42
mov ecx, dword [ebp - 0x74]
jmp 0x4f037d
xor edx, edx
jmp 0x4efd36
mov ecx, dword [ebp - 0x84]
jmp 0x4f0389