Function at 0x4d0e01
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x284
mov eax, 0x5340fc
call fcn.004f2332
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28c], eax
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], eax
mov edi, eax
call fcn.00437474
push eax
lea ecx, [ebp - 0x27c]
call fcn.0043a4ef
push edi
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.00498323
test eax, eax
je 0x4d13bb
push esi
push str.Install_Path_Dir
lea ecx, [ebp - 0x268]
call fcn.00498475
test eax, eax
jne 0x4d0efb
xor esi, esi
mov edi, dword [ebp - 0x264]
mov eax, dword [ebp - 0x28c]
test eax, eax
je 0x4d0ea2
mov dword [eax], edi
push edi
push str.write_Exit0_errcode_d
push 0x5aea00
call fcn.004de360
add esp, 0xc
cmp dword [ebp - 0x268], 0
je 0x4d0eca
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x268], esi
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x268], 0
je 0x4d0ef3
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
call fcn.004f22e1
ret
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.004cdee7
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00417260
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x230]
call fcn.004180c0
push 0x55af84
mov esi, eax
call fcn.00416680
pop ecx
push eax
push 0x55af84
mov ecx, esi
call fcn.00418190
lea ecx, [ebp - 0x230]
xor esi, esi
cmp ecx, eax
je 0x4d0f64
push 0xffffffffffffffff
push esi
push eax
call fcn.00417a30
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x268]
cmovae eax, dword [ebp - 0x230]
push eax
push str.ProgramPath
call fcn.00498475
push esi
test eax, eax
jne 0x4d0fb8
mov edi, dword [ebp - 0x264]
lea ecx, [ebp - 0x230]
push 1
call fcn.00417d20
push esi
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00417d20
jmp 0x4d0e96
lea eax, [ebp - 0x260]
push eax
call fcn.004cdee7
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x4d0fce
mov eax, dword [eax]
push eax
push 0x55e82c
lea ecx, [ebp - 0x268]
call fcn.00498475
mov ebx, eax
lea ecx, [ebp - 0x260]
push esi
neg ebx
push 1
sbb bl, bl
call fcn.00417d20
inc bl
je 0x4d1028
mov edi, dword [ebp - 0x264]
lea ecx, [ebp - 0x230]
push esi
push 1
call fcn.00417d20
push esi
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x248]
call fcn.00417d20
mov ebx, dword [ebp - 0x280]
jmp 0x4d0e96
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.004f2e30
add esp, 0xc
mov dword [ebp - 0x290], 0x208
lea eax, [ebp - 0x290]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x288], ebx
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x288]
push eax
push 0x53f6b8
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x4d10b9
call fcn.004e4770
mov ecx, eax
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4d109f
mov ecx, dword [ecx]
add eax, eax
push eax
push ecx
push ebx
push 0x53f6b8
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00437474
push eax
lea ecx, [ebp - 0x274]
call fcn.0043a4ef
mov byte [ebp - 4], 4
call fcn.00437474
push eax
lea ecx, [ebp - 0x278]
call fcn.0043a4ef
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x26c]
call fcn.004ce216
add esp, 0xc
lea ecx, [ebp - 0x268]
push dword [ebp - 0x274]
push 0x53a0b0
call fcn.00498475
test eax, eax
jne 0x4d1152
mov ecx, dword [ebp - 0x278]
mov edi, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push esi
push ebx
lea ecx, [ebp - 0x230]
call fcn.00417d20
push esi
mov byte [ebp - 4], bl
push ebx
jmp 0x4d1012
mov ecx, dword [ebp - 0x270]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x4d129e
mov eax, dword [ebp - 0x278]
cmp dword [eax - 0xc], 0
jne 0x4d1295
lea eax, [ebp - 0x26c]
push esi
push eax
call fcn.004cde4e
push 0x5f
push dword [ebp - 0x26c]
mov byte [ebp - 4], 6
call fcn.004f553b
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d1268
sub esi, dword [ebp - 0x26c]
sar esi, 1
cmp esi, 0xffffffff
je 0x4d1268
call fcn.00437474
push eax
lea ecx, [ebp - 0x270]
call fcn.0043a4ef
lea eax, [esi + 1]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00447979
push eax
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 8
call fcn.0043c2e8
mov ecx, dword [ebp - 0x284]
mov byte [ebp - 4], 7
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0
push 0x53ef5c
lea ecx, [ebp - 0x270]
call fcn.00468330
push eax
push 0
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x270]
call fcn.00447a0f
push eax
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 9
call fcn.0043c2e8
mov ecx, dword [ebp - 0x284]
mov byte [ebp - 4], 7
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x27c]
call fcn.0043c2e8
mov ecx, dword [ebp - 0x270]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
jmp 0x4d1281
mov esi, 0x55da5c
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x274]
call fcn.0043a84a
mov ecx, dword [ebp - 0x26c]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00436fdb
jmp 0x4d12aa
lea eax, [ebp - 0x278]
push eax
jmp 0x4d129f
push ecx
lea ecx, [ebp - 0x27c]
call fcn.0043c2e8
call fcn.00437474
push eax
lea ecx, [ebp - 0x26c]
call fcn.0043a4ef
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0xa
call fcn.0043a29e
lea eax, [ebp - 0x26c]
push eax
push 0x53c600
lea ecx, [ebp - 0x268]
call fcn.00498375
mov esi, dword [ebp - 0x26c]
cmp dword [esi - 0xc], 0
jne 0x4d1357
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x268]
push 0x53c600
call fcn.00498475
test eax, eax
jne 0x4d1357
mov edi, dword [ebp - 0x264]
lea ecx, [esi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x278]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor esi, esi
lea ecx, [ebp - 0x230]
push esi
push ebx
call fcn.00417d20
push esi
push ebx
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.00417d20
mov ebx, esi
jmp 0x4d0e96
cmp dword [ebp - 0x268], 0
je 0x4d136c
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x268], 0
lea ecx, [esi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x278]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor esi, esi
lea ecx, [ebp - 0x230]
push esi
push 1
call fcn.00417d20
push esi
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00417d20
jmp 0x4d13c3
mov edi, dword [ebp - 0x264]
xor esi, esi
push edi
push ebx
push str.PRODUCE_INSTALL_KEY_bRet_d_code_d
push 0x5aea00
call fcn.004de360
add esp, 0x10
lea ecx, [ebp - 0x268]
push esi
push str.SoftwareliebaoCoop
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00498323
test eax, eax
je 0x4d0e90
test ebx, ebx
je 0x4d0e90
push str.h_home
push 0x53f860
lea ecx, [ebp - 0x268]
call fcn.00498475
test eax, eax
je 0x4d0e96
push str.h_home
push str.OEMNAME
lea ecx, [ebp - 0x268]
call fcn.00498475
test eax, eax
je 0x4d0e96
push str.h_home
push str.PreOEM
lea ecx, [ebp - 0x268]
call fcn.00498475
test eax, eax
je 0x4d0e96
cmp dword [ebp - 0x268], 0
je 0x4d1469
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x268], esi
push edi
inc ebx
push ebx
push str.PRODUCE_INSTALL_COOP_bRet_d_code_d
push 0x5aea00
call fcn.004de360
add esp, 0x10
lea ecx, [ebp - 0x268]
push ebx
push str.SOFTWAREPoliciesChromium
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00498323
test eax, eax
je 0x4d0e96
push ebx
push str.MetricsReportingEnabled
lea ecx, [ebp - 0x268]
call fcn.004d0dcd
cmp dword [ebp - 0x268], 0
je 0x4d14ca
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x268], esi
jmp 0x4d0e96