Function at 0x491850
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x425c
call fcn.0051d7f0
mov eax, dword [0x594ccc]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x422c], edx
mov edx, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x4234], edx
lea edx, [ebp - 0x4218]
push edx
push 0x20019
xor esi, esi
push esi
push ecx
push eax
mov dword [ebp - 0x4218], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x491c30
push 4
call fcn.0051d4d3
add esp, 4
cmp eax, esi
je 0x4918c6
lea ecx, [ebp - 0x4254]
mov dword [eax], ecx
mov dword [ebp - 0x4254], eax
jmp 0x4918cc
mov dword [ebp - 0x4254], esi
lea ecx, [ebp - 0x4254]
call fcn.004431a0
mov dword [ebp - 0x423c], eax
mov byte [eax + 0x15], 1
mov eax, dword [ebp - 0x423c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [eax + 4], eax
mov eax, dword [ebp - 0x423c]
mov dword [eax], eax
mov eax, dword [ebp - 0x423c]
mov dword [eax + 8], eax
lea edx, [ebp - 0x4214]
push edx
lea eax, [ebp - 0x420c]
push eax
lea ecx, [ebp - 0x4230]
push ecx
mov ecx, dword [ebp - 0x4218]
push esi
lea edx, [ebp - 0x4224]
push edx
lea eax, [ebp - 0x20c]
push eax
push esi
push ecx
mov dword [ebp - 0x4238], esi
mov dword [ebp - 0x4224], 0x104
mov dword [ebp - 0x4214], 0x3ffe
call edi
test eax, eax
jne 0x491b18
mov eax, dword [ebp - 0x4230]
cmp eax, 1
jne 0x491a64
mov edx, dword [ebp - 0x4214]
lea ecx, [ebp - 0x20c]
shr edx, 1
xor eax, eax
push 0x104
push ecx
mov word [ebp + edx*2 - 0x420c], ax
call fcn.0051e26d
add esp, 4
mov ecx, esp
push 0x565764
call fcn.00464b60
push ecx
lea edx, [ebp - 0x20c]
mov ecx, esp
push edx
call fcn.00464b60
call fcn.0044e840
add esp, 8
test eax, eax
jne 0x491acc
push ecx
mov ecx, esp
push 0x565760
call fcn.00464b60
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.00464b60
call fcn.0044e840
add esp, 8
test eax, eax
jne 0x491acc
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x4210]
call fcn.00464b60
lea ecx, [ebp - 0x4210]
call fcn.0044f1c0
mov ecx, dword [ebp - 0x422c]
lea edx, [ebp - 0x420c]
push edx
lea eax, [ebp - 0x4210]
push eax
call fcn.0047fe10
mov ecx, eax
call fcn.00459660
push ecx
lea edx, [ebp - 0x4210]
mov ecx, esp
push edx
call fcn.00442720
call fcn.00448a10
add esp, 4
mov dword [ebp - 0x4228], eax
cmp eax, 0xffffffff
je 0x491a5c
lea eax, [ebp - 0x420c]
push eax
lea ecx, [ebp - 0x4228]
push ecx
mov ecx, dword [ebp - 0x4234]
call fcn.0047ff40
mov ecx, eax
call fcn.00459660
lea ecx, [ebp - 0x4210]
jmp 0x491ac7
cmp eax, 2
jne 0x491acc
mov edx, dword [ebp - 0x4214]
lea ecx, [ebp - 0x20c]
shr edx, 1
xor eax, eax
push 0x104
push ecx
mov word [ebp + edx*2 - 0x420c], ax
call fcn.0051e26d
add esp, 8
lea edx, [ebp - 0x20c]
push edx
lea ecx, [ebp - 0x421c]
call fcn.00464b60
lea eax, [ebp - 0x420c]
push eax
lea ecx, [ebp - 0x421c]
push ecx
lea ecx, [ebp - 0x4254]
call fcn.0047fe10
mov ecx, eax
call fcn.00459660
lea ecx, [ebp - 0x421c]
call fcn.00442750
lea edx, [ebp - 0x4214]
push edx
lea eax, [ebp - 0x420c]
push eax
lea ecx, [ebp - 0x4230]
push ecx
mov ecx, dword [ebp - 0x4218]
push 0
lea edx, [ebp - 0x4224]
push edx
lea eax, [ebp - 0x20c]
push eax
inc esi
push esi
push ecx
mov dword [ebp - 0x4224], 0x104
mov dword [ebp - 0x4214], 0x3ffe
call edi
test eax, eax
je 0x491951
mov edx, dword [ebp - 0x4218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x423c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x4254]
mov dword [ebp - 0x4220], ecx
mov dword [ebp - 0x421c], eax
nop
mov edx, dword [ebp - 0x423c]
mov eax, dword [ebp - 0x4254]
lea ecx, [ebp - 0x425c]
push ecx
lea ecx, [ebp - 0x4220]
mov dword [ebp - 0x4258], edx
mov dword [ebp - 0x425c], eax
call fcn.00423d90
test al, al
je 0x491c25
lea ecx, [ebp - 0x4210]
call fcn.00442700
mov esi, dword [ebp - 0x422c]
push esi
lea edx, [ebp - 0x4210]
push edx
lea ecx, [ebp - 0x4220]
call fcn.00443f00
add eax, 4
push eax
call fcn.00461670
add esp, 0xc
lea eax, [ebp - 0x4210]
push eax
lea ecx, [ebp - 0x4220]
call fcn.00443f00
push eax
mov ecx, esi
call fcn.0047fe10
mov ecx, eax
call fcn.00454c40
lea ecx, [ebp - 0x4220]
call fcn.00443f00
push ecx
mov ecx, esp
push eax
call fcn.00442720
call fcn.00448a10
add esp, 4
mov dword [ebp - 0x4228], eax
cmp eax, 0xffffffff
je 0x491c0a
lea ecx, [ebp - 0x4210]
push ecx
mov ecx, dword [ebp - 0x4234]
lea edx, [ebp - 0x4228]
push edx
call fcn.0047ff40
mov ecx, eax
call fcn.00454c40
lea ecx, [ebp - 0x4210]
call fcn.00442750
lea ecx, [ebp - 0x4220]
call fcn.00426340
jmp 0x491b40
lea ecx, [ebp - 0x4254]
call fcn.0048b9e0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0051d23b
mov esp, ebp
pop ebp
ret