Function at 0x4f2d40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x550a58
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x5c2b80]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
xor eax, eax
push 0x40e
push eax
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push eax
mov dword [ebp - 0x464], ebx
mov dword [ebp - 0x44c], 0
mov dword [ebp - 0x448], 0
mov dword [ebp - 0x444], 0
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x454], 0
mov dword [ebp - 0x438], 0x208
call fcn.0052ebd0
add esp, 0xc
mov dword [ebp - 0x430], 0
call fcn.00456bd0
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x4f2df9
push 0x80004005
call fcn.00456ea0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x430], eax
mov dword [ebp - 4], 1
mov ecx, 0x599e30
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x428]
call fcn.00457210
mov byte [ebp - 4], 2
lea edx, [ebp - 0x44c]
mov ecx, dword [ebp + 0xc]
push edx
or ecx, 0x20019
push ecx
push 0
push dword [eax]
mov dword [ebp + 0xc], ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov byte [ebp - 4], 1
or ecx, 0xffffffff
mov esi, dword [ebp - 0x428]
add esi, 0xfffffff0
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4f2e6f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test ebx, ebx
je 0x4f2ed1
mov ecx, 0x599ea0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x428]
call fcn.00457210
mov byte [ebp - 4], 4
push ebx
push dword [eax]
lea eax, [ebp - 0x430]
push eax
call fcn.00457480
add esp, 0xc
mov byte [ebp - 4], 1
or ebx, 0xffffffff
mov edx, dword [ebp - 0x428]
mov ecx, ebx
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f2ec5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 0x44d], 0
jmp 0x4f3697
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x438]
mov byte [ebp - 0x44d], 0
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push dword [ebp - 0x44c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, 0x103
je 0x4f3631
test eax, eax
jne 0x4f35e3
mov eax, dword [edi + 4]
cmp eax, dword [edi + 8]
je 0x4f2f48
mov edx, dword [edi + 8]
lea eax, [ebp - 0x420]
mov ecx, dword [edi + 4]
mov byte [ebp - 0x45c], 0
push dword [ebp - 0x45c]
push eax
call fcn.004f37b0
add esp, 8
cmp eax, dword [edi + 8]
jne 0x4f362a
mov eax, dword [edi + 0x20]
xor esi, esi
sub eax, dword [edi + 0x1c]
or ebx, 0xffffffff
sar eax, 2
test eax, eax
je 0x4f2fe7
mov edi, edi
lea eax, [ebp - 0x420]
mov dword [ebp - 0x42c], 0
push eax
lea ecx, [ebp - 0x42c]
call fcn.00457210
mov byte [ebp - 4], 6
mov eax, dword [edi + 0x1c]
mov ecx, dword [eax + esi*4]
test ecx, ecx
je 0x4f2fb2
mov eax, dword [ebp - 0x42c]
cmp dword [eax - 0xc], 0
jl 0x4f2fb2
push ecx
push eax
call fcn.0052b75b
add esp, 8
test eax, eax
je 0x4f2fb2
sub eax, dword [ebp - 0x42c]
sar eax, 1
jns 0x4f3636
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f2fd5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x20]
inc esi
sub eax, dword [edi + 0x1c]
sar eax, 2
cmp esi, eax
jb 0x4f2f60
cmp byte [ebp - 0x44d], 0
jne 0x4f3660
mov ecx, 0x599e30
mov dword [ebp - 0x424], 0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x424]
call fcn.00457210
mov byte [ebp - 4], 9
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x480]
call fcn.00457210
mov byte [ebp - 4], 0xa
mov edx, 0x5923e4
push eax
lea ecx, [ebp - 0x478]
call fcn.00479e80
add esp, 4
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x424]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.0045c160
mov byte [ebp - 4], 0xa
mov ecx, ebx
mov edx, dword [ebp - 0x478]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f307a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 9
mov ecx, ebx
mov edx, dword [ebp - 0x480]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f309d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x448]
push eax
push dword [ebp + 0xc]
push 0
push dword [ebp - 0x424]
push dword [ebp - 0x464]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x4f313c
mov ecx, 0x599ee0
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x474]
call fcn.00457210
mov byte [ebp - 4], 0xe
push esi
push dword [eax]
lea eax, [ebp - 0x430]
push eax
call fcn.00457480
add esp, 0xc
mov byte [ebp - 4], 9
mov ecx, ebx
mov edx, dword [ebp - 0x474]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f3110
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp - 0x424]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f3609
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4f3609
mov eax, dword [edi + 0x10]
cmp eax, dword [edi + 0x14]
je 0x4f32db
mov dword [ebp - 0x444], 0x208
call fcn.00456bd0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4f2def
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x43c], esi
mov byte [ebp - 4], 0x12
mov ecx, 0x599f20
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x46c]
call fcn.00457210
mov ebx, eax
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x444]
shr edx, 1
js 0x4f36df
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4f31c7
push edx
lea ecx, [ebp - 0x43c]
call fcn.00456e30
mov esi, dword [ebp - 0x43c]
lea eax, [ebp - 0x444]
push eax
push esi
lea eax, [ebp - 0x440]
push eax
push 0
push dword [ebx]
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov byte [ebp - 4], 0x12
or ecx, 0xffffffff
mov edx, dword [ebp - 0x46c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f320f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4f3239
push dword [esi - 8]
push esi
call fcn.0052b6eb
add esp, 8
test eax, eax
js 0x4f36df
cmp eax, dword [esi - 8]
jg 0x4f36df
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x4f32bb
mov edx, dword [edi + 0x14]
lea eax, [ebp - 0x43c]
mov ecx, dword [edi + 0x10]
mov byte [ebp - 0x47c], 0
push dword [ebp - 0x47c]
push eax
call fcn.004f3820
add esp, 8
cmp eax, dword [edi + 0x14]
jne 0x4f36e9
mov eax, dword [edi + 0x44]
xor ebx, ebx
sub eax, dword [edi + 0x40]
sar eax, 2
test eax, eax
je 0x4f32bb
lea esp, [esp]
mov eax, dword [edi + 0x40]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x4f32a4
cmp dword [esi - 0xc], 0
jl 0x4f32a4
push eax
push esi
call fcn.0052b75b
add esp, 8
test eax, eax
je 0x4f32a4
sub eax, esi
sar eax, 1
jns 0x4f32b4
mov eax, dword [edi + 0x44]
inc ebx
sub eax, dword [edi + 0x40]
sar eax, 2
cmp ebx, eax
jb 0x4f3280
jmp 0x4f32bb
mov byte [ebp - 0x44d], 1
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f32db
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x28]
cmp eax, dword [edi + 0x2c]
je 0x4f3429
mov dword [ebp - 0x444], 0x208
call fcn.00456bd0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4f2def
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x434], esi
mov byte [ebp - 4], 0x19
mov ecx, 0x599f40
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x460]
call fcn.00457210
mov ebx, eax
mov byte [ebp - 4], 0x1a
mov edx, dword [ebp - 0x444]
shr edx, 1
js 0x4f36df
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4f3366
push edx
lea ecx, [ebp - 0x434]
call fcn.00456e30
mov esi, dword [ebp - 0x434]
lea eax, [ebp - 0x444]
push eax
push esi
lea eax, [ebp - 0x440]
push eax
push 0
push dword [ebx]
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov byte [ebp - 4], 0x19
or ecx, 0xffffffff
mov edx, dword [ebp - 0x460]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f33ae
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4f33d8
push dword [esi - 8]
push esi
call fcn.0052b6eb
add esp, 8
test eax, eax
js 0x4f36df
cmp eax, dword [esi - 8]
jg 0x4f36df
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x4f3409
mov edx, dword [edi + 0x2c]
lea eax, [ebp - 0x434]
mov ecx, dword [edi + 0x28]
mov byte [ebp - 0x468], 0
push dword [ebp - 0x468]
push eax
call fcn.004f3820
add esp, 8
cmp eax, dword [edi + 0x2c]
jne 0x4f373c
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f3429
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi + 0x34]
cmp eax, dword [edi + 0x38]
je 0x4f35a3
mov dword [ebp - 0x444], 0x208
call fcn.00456bd0
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x4f2def
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x428], esi
mov byte [ebp - 4], 0x20
mov ecx, 0x599f60
call fcn.004f06e0
push eax
lea ecx, [ebp - 0x470]
call fcn.00457210
mov ebx, eax
mov byte [ebp - 4], 0x21
mov edx, dword [ebp - 0x444]
shr edx, 1
js 0x4f36df
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edx
or eax, ecx
jge 0x4f34b4
push edx
lea ecx, [ebp - 0x428]
call fcn.00456e30
mov esi, dword [ebp - 0x428]
lea eax, [ebp - 0x444]
push eax
push esi
lea eax, [ebp - 0x440]
push eax
push 0
push dword [ebx]
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
sete bl
mov byte [ebp - 4], 0x20
or ecx, 0xffffffff
mov edx, dword [ebp - 0x470]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f34fc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test bl, bl
je 0x4f3526
push dword [esi - 8]
push esi
call fcn.0052b6eb
add esp, 8
test eax, eax
js 0x4f36df
cmp eax, dword [esi - 8]
jg 0x4f36df
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
cmp dword [esi - 0xc], 0
je 0x4f3583
mov eax, dword [edi + 0x38]
xor ebx, ebx
sub eax, dword [edi + 0x34]
sar eax, 2
test eax, eax
je 0x4f3576
jmp 0x4f3540
mov eax, dword [edi + 0x34]
mov eax, dword [eax + ebx*4]
test eax, eax
je 0x4f3568
cmp dword [esi - 0xc], 0
jl 0x4f3568
push eax
push esi
call fcn.0052b75b
add esp, 8
test eax, eax
je 0x4f3568
sub eax, esi
sar eax, 1
jns 0x4f3765
mov eax, dword [edi + 0x38]
inc ebx
sub eax, dword [edi + 0x34]
sar eax, 2
cmp ebx, eax
jb 0x4f3540
cmp byte [ebp - 0x44d], 0
jne 0x4f376c
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f35a3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x4f35c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
mov dword [ebp - 0x448], 0
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp - 0x424]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f35e3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
inc dword [ebp - 0x454]
lea eax, [ebp - 0x420]
push 0x410
push 0
push eax
mov dword [ebp - 0x438], 0x208
call fcn.0052ebd0
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x454]
jmp 0x4f2ef0
mov byte [ebp - 0x44d], 1
or ebx, 0xffffffff
jmp 0x4f3669
mov byte [ebp - 0x44d], 1
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp - 0x42c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f3660
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or ebx, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x4f3680
push eax
call esi
mov dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x44c]
test eax, eax
je 0x4f3697
push eax
call esi
mov dword [ebp - 0x44c], 0
mov dword [ebp - 4], 0xffffffff
mov esi, dword [ebp - 0x430]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x4f36bb
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, byte [ebp - 0x44d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052ab62
mov esp, ebp
pop ebp
ret 8
push 0x80070057
call fcn.00456ea0
mov byte [ebp - 0x44d], 1
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f3710
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov ecx, ebx
mov edx, dword [ebp - 0x424]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f3663
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4f3663
mov byte [ebp - 0x44d], 1
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f3763
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4f3710
mov byte [ebp - 0x44d], 1
mov byte [ebp - 4], 9
add esi, 0xfffffff0
or ebx, 0xffffffff
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x4f378c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4f3710