Function at 0x1004a1a
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x1008f78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push 0x50
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x56]
push esi
push eax
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x478], esi
mov word [ebp - 0x58], si
call sub.MSVCR80.dll_memset
mov eax, dword [ebp - 0x46c]
mov word [eax], si
add esp, 0xc
lea eax, [ebp - 0x488]
push eax
call dword [0x100118c]
push edi
push dword [ebp + 0x14]
call fcn.01002f00
pop ecx
pop ecx
lea eax, [ebp - 0x470]
push eax
push 0x20019
push esi
lea eax, [edi + 0x618]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp ebx, esi
je 0x1004ab8
mov dword [ebx], esi
cmp eax, esi
jne 0x1004b00
cmp ebx, esi
je 0x1004ac6
mov dword [ebx], 1
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48c]
push eax
push esi
push 0x10013d0
push dword [ebp - 0x470]
mov dword [ebp - 0x478], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
mov word [ebp - 8], si
je 0x1004b8f
lea eax, [ebp - 0x464]
push 0x105
push eax
call fcn.010049ef
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x468], eax
jne 0x1004c6e
cmp dword [ebp + 0x1c], esi
mov ebx, dword [ebp + 0x10]
je 0x1004b3f
push ebx
push 0x10013e8
push ebx
push dword [ebp - 0x46c]
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
push 0x1001520
push ebx
push dword [ebp - 0x46c]
call fcn.01003a24
add edi, 0x820
push edi
push ebx
push dword [ebp - 0x46c]
call fcn.01003a65
add esp, 0xc
push 0x10017b0
push ebx
push dword [ebp - 0x46c]
call fcn.01003a24
lea eax, [ebp - 0x464]
push eax
push ebx
push dword [ebp - 0x46c]
call fcn.01003a24
jmp 0x1004c6e
push 0x1001794
mov edi, 0xff
push edi
lea eax, [ebp - 0x258]
push eax
call fcn.010039ea
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1004c6e
lea eax, [ebp - 0x58]
push eax
push edi
lea eax, [ebp - 0x258]
push eax
call fcn.01003a24
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1004c6e
push 0x1001790
push edi
lea eax, [ebp - 0x258]
push eax
call fcn.01003a24
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1004c6e
lea eax, [ebp - 0x474]
push eax
push 0x10020f4
lea eax, [ebp - 0x258]
push eax
call dword [0x1009608]
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1004c6e
mov eax, dword [ebp - 0x474]
mov ecx, dword [eax]
lea edx, [ebp - 0x488]
push edx
push 0x1001314
push eax
call dword [ecx + 0x3c]
cmp dword [ebp - 0x480], esi
mov dword [ebp - 0x468], eax
je 0x1004c6e
cmp dword [ebp + 0x1c], esi
je 0x1004c57
push dword [ebp + 0x10]
push 0x10013e8
push dword [ebp + 0x10]
push dword [ebp - 0x46c]
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
push dword [ebp - 0x480]
push dword [ebp + 0x10]
push dword [ebp - 0x46c]
call fcn.01003a65
add esp, 0xc
lea eax, [ebp - 0x488]
push eax
call dword [0x1001184]
cmp dword [ebp - 0x470], esi
je 0x1004c8f
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x474]
pop edi
cmp eax, esi
pop esi
pop ebx
je 0x1004ca2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x468]
xor ecx, ebp
call fcn.01005e45
leave
ret