Function at 0x496ad9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x512951
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x958
mov dword [ebp - 0x81c], 0
mov dword [ebp - 0x818], 0
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString_3
mov dword [ebp - 4], 0
push 0x5b78a4
push 0x561744
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5b8d50
push 0x54
push 0x56177c
lea ecx, [ebp - 0x814]
push ecx
push 0x80000003
call fcn.00402bb9
add esp, 0x14
lea edx, [ebp - 0x81c]
push edx
push 0x20119
push 0
lea eax, [ebp - 0x814]
push eax
push 0x80000003
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x496b92
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString
jmp 0x49700f
mov dword [ebp - 0x818], 0
jmp 0x496bad
mov ecx, dword [ebp - 0x818]
add ecx, 1
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x414], 0x400
mov byte [ebp - 0x40c], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x818]
push ecx
mov edx, dword [ebp - 0x81c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x496d8c
push 0x5b8d54
lea eax, [ebp - 0x40c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x496c0a
jmp 0x496b9e
lea ecx, [ebp - 0x40c]
push ecx
push 0x5617a4
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x5617bc
push 0x5b6504
push 0x80000000
lea edx, [ebp - 0x920]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x938], eax
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x93c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x93c]
push ecx
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x920]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x410]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x91c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x91c]
push eax
call fcn.00401fca
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x924], esp
lea edx, [ebp - 0x91c]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x940], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x944], eax
cmp dword [ebp - 0x944], 0
jne 0x496cda
jmp 0x496b9e
push ecx
mov ecx, esp
mov dword [ebp - 0x928], esp
lea eax, [ebp - 0x91c]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x948], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x94c], eax
mov ecx, dword [ebp - 0x94c]
push ecx
lea edx, [ebp - 0x91c]
push edx
call fcn.004f9b07
add esp, 8
test eax, eax
jne 0x496d8a
lea eax, [ebp - 0x91c]
push eax
mov ecx, 0x5b5bf0
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x814]
push eax
push 0x80000003
call fcn.00402ed5
add esp, 0xc
lea ecx, [ebp - 0x91c]
push ecx
lea edx, [ebp - 0x40c]
push edx
push str.Key_Eliminada__URLSearchHook__HKUS____s_______s_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x496d8e
jmp 0x496d93
jmp 0x496b9e
mov eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x5617f4
lea ecx, [ebp - 0x814]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea edx, [ebp - 0x81c]
push edx
push 0x20119
push 0
lea eax, [ebp - 0x814]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x496def
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString
jmp 0x49700f
mov dword [ebp - 0x818], 0
jmp 0x496e0a
mov ecx, dword [ebp - 0x818]
add ecx, 1
mov dword [ebp - 0x818], ecx
mov dword [ebp - 0x414], 0x400
mov byte [ebp - 0x40c], 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x40c]
push eax
mov ecx, dword [ebp - 0x818]
push ecx
mov edx, dword [ebp - 0x81c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x496fe9
push 0x5b8d58
lea eax, [ebp - 0x40c]
push eax
call sub.MSVCRT.dll_strcmp
add esp, 8
test eax, eax
jne 0x496e67
jmp 0x496dfb
lea ecx, [ebp - 0x40c]
push ecx
push 0x561828
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
push 0x561840
push 0x5b6504
push 0x80000000
lea edx, [ebp - 0x92c]
push edx
call fcn.00402f37
add esp, 0x10
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov dword [ebp - 0x954], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x954]
push ecx
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x92c]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x410]
call fcn.0050f0b0
push eax
lea edx, [ebp - 0x91c]
push edx
call sub.MSVCRT.dll_strcpy
add esp, 8
lea eax, [ebp - 0x91c]
push eax
call fcn.00401fca
add esp, 4
push ecx
mov ecx, esp
mov dword [ebp - 0x930], esp
lea edx, [ebp - 0x91c]
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x958], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x95c], eax
cmp dword [ebp - 0x95c], 0
jne 0x496f37
jmp 0x496dfb
push ecx
mov ecx, esp
mov dword [ebp - 0x934], esp
lea eax, [ebp - 0x91c]
push eax
call sub.MFC42.DLL_CString::CString_2
mov dword [ebp - 0x960], eax
call fcn.004ae7b8
add esp, 4
mov dword [ebp - 0x964], eax
mov ecx, dword [ebp - 0x964]
push ecx
lea edx, [ebp - 0x91c]
push edx
call fcn.004f9b07
add esp, 8
test eax, eax
jne 0x496fe7
lea eax, [ebp - 0x91c]
push eax
mov ecx, 0x5b5bf0
call fcn.0050f680
lea ecx, [ebp - 0x40c]
push ecx
mov ecx, 0x5b5ba8
call fcn.0050f680
lea edx, [ebp - 0x40c]
push edx
lea eax, [ebp - 0x814]
push eax
push 0x80000002
call fcn.00402ed5
add esp, 0xc
lea ecx, [ebp - 0x91c]
push ecx
lea edx, [ebp - 0x40c]
push edx
push str.Key_Eliminada__URLSearchHook__HKLM____s_______s_n
push 0x5b6504
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push 0x5b6504
mov ecx, 0x5b5b78
call fcn.0050f680
jmp 0x496feb
jmp 0x496ff0
jmp 0x496dfb
mov eax, dword [ebp - 0x81c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret