Function at 0x48f9e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x130
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x188], rbx
mov rax, qword [0x00535d58]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, r8
mov qword [rsp + 0x38], r8
mov r14, rdx
mov qword [rsp + 0x70], rdx
mov r15, rcx
mov qword [rsp + 0x68], rcx
test r8, r8
jne 0x48fa3d
xor eax, eax
jmp 0x490263
call fcn.0049d8dc
mov rdx, rax
xor r13d, r13d
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x48fa60
mov ecx, 0x80004005
call fcn.004034c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rdx, [0x004f7838]
or rbp, 0xffffffffffffffff
test rdx, 0xffffffffffff0000
jne 0x48faac
movzx edi, dx
mov ecx, edi
call fcn.0049f018
test rax, rax
je 0x48facd
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.0040a480
mov rbx, qword [rsp + 0x30]
jmp 0x48facd
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x30]
call fcn.00409ff0
mov rbx, qword [rsp + 0x30]
call fcn.0049d8dc
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x48faed
mov ecx, 0x80004005
call fcn.004034c0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x58], r13
mov word [rsp + 0xa0], 0
xor edx, edx
lea r8d, [rdx + 0x7e]
lea rcx, [rsp + 0xa2]
call fcn.004cb030
mov qword [rsi], r13
xor eax, eax
lea rdx, [0x004f7838]
mov rdi, rdx
mov rsi, qword [r14 + 0x10]
mov ecx, 1
repe cmpsw word [rsi], word [rdi]
je 0x48fb43
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne al
test al, al
je 0x48fdb7
lea rcx, [rsp + 0x90]
lea rsi, [0x004f76f8]
mov rax, qword [rsi]
mov qword [rcx], rax
mov rax, qword [rsi + 8]
mov qword [rcx + 8], rax
mov rax, qword [r14 + 0x10]
cmp dword [rax - 8], 1
jle 0x48fb83
mov edx, dword [rax - 0x10]
lea rcx, [r14 + 0x10]
call fcn.00403540
lea rdx, [rsp + 0x90]
mov rcx, qword [r14 + 0x10]
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov r11, qword [r14 + 0x10]
test r11, r11
jne 0x48fba3
mov ecx, r13d
jmp 0x48fbbd
xor eax, eax
mov rcx, rbp
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x48fd93
cmp ecx, dword [r11 - 0xc]
jg 0x48fd93
mov dword [r11 - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [r14 + 0x10]
mov word [rax + rcx*2], 0
lea rax, [rsp + 0x90]
mov rcx, qword [rax]
cmp rcx, qword [rsi]
jne 0x48fbf7
mov rcx, qword [rax + 8]
cmp rcx, qword [rsi + 8]
jne 0x48fbf7
mov eax, r13d
jmp 0x48fbfc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x48fdb0
cmp dword [r14 + 0x18], 0
jne 0x48fda7
xor eax, eax
mov rcx, rbp
lea rdi, str.SYSTEMCurrentControlSetControlMediaCategories_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str.SYSTEMCurrentControlSetControlMediaCategories_
lea rcx, [rsp + 0x40]
call fcn.00409ff0
lea rdx, [r14 + 0x10]
lea rcx, [rsp + 0x40]
call fcn.004094d0
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdi, qword [rsp + 0x40]
mov rdx, rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x48fd52
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x48], 0x80
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
lea rdx, str.Name
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48fd02
mov eax, dword [rsp + 0x4c]
cmp eax, 1
je 0x48fccc
cmp eax, 2
jne 0x48fd02
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x48fcec
test al, 1
jne 0x48fd02
shr rax, 1
cmp word [rsp + rax*2 + 0x9e], 0
je 0x48fd9e
jmp 0x48fd02
mov word [rsp + 0xa0], 0
lea rdx, [0x004f7838]
jmp 0x48fdb7
test rsi, rsi
je 0x48fd11
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x48fd2d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x48fd4b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x490263
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x48fd6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x48fd8c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x490263
mov ecx, 0x80070057
call fcn.004034c0
int3
lea rdx, [0x004f7838]
jmp 0x48fdb7
lea rdx, [0x004f7838]
jmp 0x48fdb7
lea rdx, [0x004f7838]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 0x1650]
test rcx, rcx
je 0x4901ea
mov r15, qword [rcx + 0x10]
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
test r15, r15
je 0x48fdc2
cmp qword [r15 + 0x60], 2
jle 0x48fdc2
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x48fe54
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x48fedb
cmp dword [rdx + 0x10], eax
jge 0x48fe26
cmp dword [rbx - 0xc], eax
jl 0x4900a4
mov dword [rbx - 0x10], r13d
mov word [rbx], ax
jmp 0x48fedb
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x48fe3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x48fedb
mov esi, dword [rbx - 0x10]
mov r12, rdx
sub r12, rbx
sar r12, 1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x48fe89
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.004034e0
mov rbx, qword [rsp + 0x30]
lea rdx, [0x004f7838]
cmp r12, rsi
ja 0x48fea9
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rbx + r12*2]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.004c8350
jmp 0x48fec1
movsxd rax, edi
lea rsi, [rax + rax]
mov r9, rsi
mov r8, rdx
mov rdx, rsi
mov rcx, rbx
call fcn.004c80e0
test edi, edi
js 0x4901df
cmp edi, dword [rbx - 0xc]
jg 0x4901df
mov dword [rbx - 0x10], edi
mov word [rsi + rbx], 0
lea rcx, [r15 + 0x48]
mov edx, 2
call fcn.0049ea88
test rax, rax
je 0x4901d9
mov r12, qword [rax + 0x10]
movsxd r14, dword [r12 - 0x10]
mov rsi, r12
sub rsi, rbx
sar rsi, 1
mov r13d, dword [rbx - 0x10]
lea edi, [r13 + r14]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x48ff2f
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.004034e0
mov rbx, qword [rsp + 0x30]
cmp rsi, r13
ja 0x48ff38
lea r12, [rbx + rsi*2]
mov rdx, r14
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, r12
call fcn.004c80e0
test edi, edi
js 0x4901ce
cmp edi, dword [rbx - 0xc]
jg 0x4901ce
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], 0
mov dx, 0x5c
mov rcx, rbx
call fcn.004c8920
test rax, rax
mov rcx, qword [rsp + 0x50]
mov r13d, 0
lea rdx, [0x004f7838]
je 0x48fdc2
sub rax, rbx
sar rax, 1
test eax, eax
lea rdx, [0x004f7838]
js 0x48fdc2
movsxd rdi, dword [rbx - 0x10]
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x48ffcc
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.004034e0
mov rbx, qword [rsp + 0x30]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.004c8690
test edi, edi
js 0x4901c3
cmp edi, dword [rbx - 0xc]
jg 0x4901c3
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r13w
mov dx, 0x5c
mov rcx, rbx
call fcn.004c8920
test rax, rax
jne 0x490008
mov eax, ebp
jmp 0x49000e
sub rax, rbx
sar rax, 1
lea r8d, [rax + 1]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x30]
call fcn.00409920
mov r14, qword [rsp + 0x70]
mov rdx, qword [r14 + 8]
mov ecx, r13d
test rdx, rdx
setne cl
test ecx, ecx
je 0x4901b8
mov rax, qword [rax]
sub rdx, rax
movzx ecx, word [rax]
cmp cx, word [rax + rdx]
jne 0x49005b
add rax, 2
test cx, cx
jne 0x490044
mov eax, r13d
jmp 0x490060
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
setne dil
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x490089
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x4900af
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x004f7838]
jmp 0x48fdc2
mov ecx, 0x80070057
call fcn.004034c0
int3
cmp qword [r15 + 0xc0], r13
jne 0x49010f
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x4900c9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x4900ea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x490108
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x490263
cmp dword [r14 + 0x18], r13d
je 0x49012d
mov rax, qword [r15 + 0xb0]
mov rcx, qword [rax + 0x10]
mov rax, qword [rsp + 0x38]
mov qword [rax], rcx
jmp 0x490202
mov rdi, qword [r15 + 0xb0]
test rdi, rdi
je 0x4901fd
nop
mov rsi, rdi
test rdi, rdi
je 0x4901b2
mov rdi, qword [rdi]
mov rsi, qword [rsi + 0x10]
test rsi, rsi
je 0x49019a
lea rdx, [rsp + 0x78]
mov rcx, rsi
call fcn.00463850
lea rdx, [rsp + 0xa0]
mov rcx, qword [rax]
call fcn.004c9810
test eax, eax
sete bl
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x490196
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
jne 0x4901a1
test rdi, rdi
je 0x4901ab
jmp 0x490140
mov rax, qword [rsp + 0x38]
mov qword [rax], rsi
jmp 0x490202
mov rax, qword [rsp + 0x38]
jmp 0x490202
call fcn.0049c5dc
int3
mov ecx, 0x80004005
call fcn.004034c0
int3
mov ecx, 0x80070057
call fcn.004034c0
int3
mov ecx, 0x80070057
call fcn.004034c0
int3
call fcn.0049c5dc
int3
mov ecx, 0x80070057
call fcn.004034c0
int3
mov rax, qword [rsp + 0x68]
mov dword [rax + 0x14], 1
mov rax, qword [rsp + 0x38]
jmp 0x490202
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
mov r13d, 0
setne r13b
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x490221
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x490242
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x490260
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r13d
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.004c7bc0
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret