Function at 0x4d8310
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x7ce4e4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0
push eax
push 0x787f5c
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4d83ce
mov dword [ebp - 0x130], eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x138], 4
push eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x134], 4
push eax
push 0
push str.CheckCrash
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4d83c2
cmp dword [ebp - 0x130], eax
je 0x4d83c2
push 4
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x13c], 1
push eax
push 4
push 0
push 0x7960a0
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x12c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x7f9d68], 0
jne 0x4d86a3
push 0x4d8950
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push 0x4d9c20
mov dword [0x7f9d68], eax
call fcn.005c450f
push 0x4d9c20
call fcn.005c0382
add esp, 8
xor eax, eax
mov word [0x7f9340], ax
push 0x103
push 0x7f9340
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x7f9340
call fcn.005c02be
add esp, 8
test eax, eax
je 0x4d8433
xor ecx, ecx
mov word [eax], cx
add eax, 2
push eax
push 0x7f9b60
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0
push 0
push 0
push 0
push str.Data
push 0x7f9340
lea ecx, [ebp - 0x128]
call fcn.0049a8e0
lea ecx, [ebp - 0x128]
call fcn.0049b090
test al, al
je 0x4d8495
cmp byte [ebp - 0xc], 0
lea eax, [ebp - 0x11c]
cmove eax, dword [ebp - 0x120]
add eax, 4
push eax
push 0x104
push 0x7f9340
call fcn.005d0460
add esp, 0xc
cmp byte [ebp - 0xc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4d84be
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x11c]
cmp eax, ecx
je 0x4d84be
push eax
call fcn.005cff1c
add esp, 4
push 0x7f9340
push 0x104
push 0x7f9958
call fcn.005d0460
push 0x785c68
push 0x104
push 0x7f9958
call fcn.005cfead
push 0x7f9b60
push 0x104
push 0x7f9958
call fcn.005cfead
push 0x7f9958
push 0x104
push 0x7f9750
call fcn.005d0460
push 0x7f9750
push 0x104
push 0x7f8f28
call fcn.005d0460
push 0x7f9958
push 0x104
push 0x7f9130
call fcn.005d0460
add esp, 0x44
mov ecx, 0x7f9750
call fcn.004d8260
mov ecx, 0x7f8f28
call fcn.004d8260
push 0x2e
push 0x7f9958
call fcn.005c02be
add esp, 0xc
test eax, eax
je 0x4d8575
push 0x796110
add eax, 2
push 4
push eax
call fcn.005d0460
add esp, 0xc
jmp 0x4d85a0
push 0x788204
push 0x104
push 0x7f9958
call fcn.005cfead
push 0x796110
push 0x104
push 0x7f9958
call fcn.005cfead
add esp, 0x18
push 0x2e
push 0x7f9130
call fcn.005c02be
add esp, 8
test eax, eax
je 0x4d85c8
push 0x796108
add eax, 2
push 4
push eax
call fcn.005d0460
add esp, 0xc
jmp 0x4d85f3
push 0x788204
push 0x104
push 0x7f9130
call fcn.005cfead
push 0x796108
push 0x104
push 0x7f9130
call fcn.005cfead
add esp, 0x18
push 0x2e
push 0x7f9750
call fcn.005c02be
add esp, 8
test eax, eax
je 0x4d861b
push 0x796110
add eax, 2
push 4
push eax
call fcn.005d0460
add esp, 0xc
jmp 0x4d8646
push 0x788204
push 0x104
push 0x7f9750
call fcn.005cfead
push 0x796110
push 0x104
push 0x7f9750
call fcn.005cfead
add esp, 0x18
push 0x2e
push 0x7f8f28
call fcn.005c02be
add esp, 8
test eax, eax
je 0x4d866e
push 0x796108
add eax, 2
push 4
push eax
call fcn.005d0460
add esp, 0xc
jmp 0x4d8699
push 0x788204
push 0x104
push 0x7f8f28
call fcn.005cfead
push 0x796108
push 0x104
push 0x7f8f28
call fcn.005cfead
add esp, 0x18
mov dword [0x7f8f18], 0
mov ecx, dword [ebp - 4]
mov eax, 0x7faad8
xor ecx, ebp
call fcn.005be209
mov esp, ebp
pop ebp
ret