Function at 0x485400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x58fa2c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebx + 0x24c]
push eax
call esi
lea eax, [ebx + 0x264]
push eax
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0x2d0], eax
test edi, edi
mov eax, 0x524f74
cmovne eax, edi
push 0x10
push eax
lea eax, [ebx + 0x288]
push eax
call fcn.00488a00
call fcn.00485a30
lea esi, [ebx + 0x2cc]
push esi
call fcn.0048b530
add esp, 0x10
test eax, eax
jne 0x485476
mov dword [esi], 0xffffffff
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4854e8
push 0x104
lea esi, [ebx + 0x148]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x2e
push esi
call fcn.004c90e0
add esp, 8
test eax, eax
je 0x4854c9
mov byte [eax], 0
lea ecx, [esi - 1]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x4854a5
mov eax, dword [str..log]
mov dword [ecx], eax
mov al, byte [0x5206a8]
push esi
mov byte [ecx + 4], al
call fcn.004c9375
add esp, 4
jmp 0x4854fd
movq xmm0, qword [str.default.log]
movq qword [esi], xmm0
mov eax, dword [0x524fc0]
push esi
mov dword [esi + 8], eax
call fcn.004c9375
add esp, 4
jmp 0x4854fd
lea edx, [ebx + 0x148]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x4854f0
lea eax, [ebp - 0xb0]
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp eax, 0xffffffff
je 0x485548
mov esi, dword [ebp - 0xb0]
mov eax, 0x88888889
imul esi
add edx, esi
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov eax, ecx
shl eax, 4
sub eax, ecx
shl eax, 2
sub esi, eax
push esi
push ecx
push str._03d_02d
push str.____
call fcn.004482a0
add esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [ebx + 0x284], eax
lea eax, [ebp - 0xb8]
push eax
push 0x20119
push 0
push str.SoftwareSSTest
push reloc.WS2_32.dll_bind
mov dword [ebx + 4], 0
mov dword [ebx + 0x30], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0x18], 0
mov dword [ebx + 0xc], 0
mov dword [ebx + 0x10], 0
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x34], 1
mov dword [ebx + 0x280], 0
mov dword [ebp - 0xb8], 0
mov dword [ebx + 0x27c], 0x500000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x485639
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xbc]
push eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xbc], 4
push eax
push 0
push 0
push str.logsize
push dword [ebp - 0xb8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x48562d
mov eax, dword [ebp - 0xb4]
cmp eax, 0x578
jb 0x485614
mov eax, 0x578
jmp 0x48561e
mov ecx, 1
cmp eax, ecx
cmovb eax, ecx
mov dword [ebp - 0xb4], eax
shl eax, 0x14
mov dword [ebx + 0x27c], eax
push dword [ebp - 0xb8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebx + 0x44]
mov dword [ebx + 0x38], 1
push 0
push eax
mov dword [ebx + 0x3c], 0
mov dword [ebx + 0x40], 0
call fcn.004b8570
push 0x32
lea eax, [ebx + 0x298]
push 0
push eax
call fcn.004b8570
mov ecx, dword [ebp - 4]
add esp, 0x18
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.004a4566
mov esp, ebp
pop ebp
ret 0xc