Function at 0x495994
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov ebx, dword [0x4f31c0]
lea esi, [ebp - 0xc]
mov edi, 0x4f1a90
xor eax, eax
push ebp
push 0x496001
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x18
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_ReleaseDC
cmp dword [ebp - 0x14], 0
jge 0x495a2d
mov cl, 0xc0
mov dl, 0xc0
mov al, 0xa7
call fcn.00407e74
mov dword [0x4f1a88], eax
lea eax, [ebp - 0x124]
push eax
call sub.user32.dll_GetDesktopWindow
push eax
call sub.user32.dll_GetWindowRect
test eax, eax
je 0x495a6b
mov eax, dword [ebp - 0x11c]
sub eax, dword [0x4f1a74]
sub eax, 0x19
mov dword [0x4f1a6c], eax
mov eax, dword [ebp - 0x118]
sub eax, dword [0x4f1a78]
sub eax, 0x32
mov dword [0x4f1a70], eax
push esi
push 0x20019
push 0
push 0x496014
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x495a8c
mov byte [ebp - 1], 1
jmp 0x495a90
xor eax, eax
mov dword [esi], eax
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x49602c
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x495af0
lea edx, [ebp - 0x228]
lea eax, [ebp - 0x114]
call fcn.0040a5b4
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x224]
mov ecx, 0xff
call fcn.00404b18
lea edx, [ebp - 0x224]
mov eax, 0x4f1958
mov cl, 0x64
call fcn.00403078
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x496038
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x495b50
lea edx, [ebp - 0x22c]
lea eax, [ebp - 0x114]
call fcn.0040a5b4
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x224]
mov ecx, 0xff
call fcn.00404b18
lea edx, [ebp - 0x224]
mov eax, 0x4f19c0
mov cl, 0x64
call fcn.00403078
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push 0
push 0x496044
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x495b9a
lea edx, [ebp - 0x230]
lea eax, [ebp - 0x114]
call fcn.0040a5b4
mov edx, dword [ebp - 0x230]
mov eax, 0x4f1a8c
call fcn.004048d0
jmp 0x495ba4
mov eax, 0x4f1a8c
call fcn.0040487c
mov ecx, 0x4f1a28
mov edx, 0x496050
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a2c
mov edx, 0x49605c
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a30
mov edx, 0x49606c
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a34
mov edx, 0x496078
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a38
mov edx, 0x496084
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a3c
mov edx, 0x496090
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a40
mov edx, 0x496098
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a44
mov edx, 0x4960a4
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a48
mov edx, 0x4960b0
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a4c
mov edx, 0x4960bc
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a50
mov edx, 0x4960c4
mov eax, dword [esi]
call fcn.00494904
push 8
mov ecx, 0x4f1a54
mov edx, 0x4960d0
mov eax, dword [esi]
call fcn.00494948
push 8
mov ecx, 0x4f1a5c
mov edx, 0x4960d8
mov eax, dword [esi]
call fcn.00494948
mov ecx, 0x4f1a6c
mov edx, 0x4960e0
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a70
mov edx, 0x4960e8
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a74
mov edx, 0x4960f0
mov eax, dword [esi]
call fcn.00494904
mov ecx, 0x4f1a78
mov edx, 0x4960fc
mov eax, dword [esi]
call fcn.00494904
push 8
mov ecx, 0x4f1a64
mov edx, 0x496108
mov eax, dword [esi]
call fcn.00494948
test al, al
jne 0x495cec
call fcn.0040bc08
fstp qword [0x4f1a64]
wait
push 0x10
mov ecx, 0x4f1a7c
mov edx, 0x496114
mov eax, dword [esi]
call fcn.00494948
push 0x21a
mov ecx, edi
mov edx, 0x49611c
mov eax, dword [esi]
call fcn.00494948
test al, al
jne 0x495da3
lea edx, [ebp - 0x238]
xor eax, eax
call fcn.00402b50
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x234]
call fcn.0040a17c
lea eax, [ebp - 0x234]
mov edx, 0x496130
call fcn.00404b44
mov eax, dword [ebp - 0x234]
call fcn.00404d3c
mov edx, eax
lea eax, [edi + 0x12]
call fcn.0040a3a4
lea edx, [ebp - 0x240]
xor eax, eax
call fcn.00402b50
mov eax, dword [ebp - 0x240]
lea edx, [ebp - 0x23c]
call fcn.0040a17c
lea eax, [ebp - 0x23c]
mov edx, 0x496144
call fcn.00404b44
mov eax, dword [ebp - 0x23c]
call fcn.00404d3c
mov edx, eax
lea eax, [edi + 0x116]
call fcn.0040a3a4
mov eax, dword [esi]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [0x4f1a28], 1
cmc
sbb eax, eax
mov byte [ebx], al
cmp dword [0x4f1a2c], 1
cmc
sbb eax, eax
mov byte [ebx + 1], al
cmp dword [0x4f1a30], 1
cmc
sbb eax, eax
mov byte [ebx + 2], al
cmp dword [0x4f1a34], 1
cmc
sbb eax, eax
mov byte [ebx + 3], al
cmp dword [0x4f1a38], 1
cmc
sbb eax, eax
mov byte [ebx + 4], al
cmp dword [0x4f1a3c], 1
cmc
sbb eax, eax
mov byte [ebx + 5], al
mov eax, dword [0x4f1a40]
mov dword [ebx + 7], eax
mov eax, dword [0x4f1a44]
mov dword [ebx + 0xb], eax
mov dword [ebx + 0x13], 0
mov dword [ebx + 0x17], 0
mov eax, dword [0x4f1a48]
dec eax
je 0x495e23
dec eax
je 0x495e2a
jmp 0x495e34
xor eax, eax
mov dword [ebx + 0xf], eax
jmp 0x495e47
mov eax, dword [0x4f1a4c]
mov dword [ebx + 0xf], eax
jmp 0x495e47
mov dword [ebx + 0xf], 0xffffffff
mov eax, dword [0x4f1a50]
cdq
mov dword [ebx + 0x13], eax
mov dword [ebx + 0x17], edx
mov eax, dword [0x4f1a6c]
mov dword [ebx + 0x1b], eax
mov eax, dword [0x4f1a70]
mov dword [ebx + 0x1f], eax
mov eax, dword [0x4f1a6c]
add eax, dword [0x4f1a74]
dec eax
mov dword [ebx + 0x23], eax
mov eax, dword [0x4f1a70]
add eax, dword [0x4f1a78]
dec eax
mov dword [ebx + 0x27], eax
mov eax, dword [0x4f1a7c]
mov dword [ebx + 0x2b], eax
mov eax, dword [0x4f1a80]
mov dword [ebx + 0x2f], eax
mov eax, dword [0x4f1a84]
mov dword [ebx + 0x33], eax
mov eax, dword [0x4f1a88]
mov dword [ebx + 0x37], eax
lea eax, [ebx + 0x3f]
mov edx, 0x4f1958
mov cl, 0x40
call fcn.00403078
lea eax, [ebx + 0x80]
mov edx, 0x4f19c0
mov cl, 0x20
call fcn.00403078
mov byte [ebx + 6], 0xff
cmp byte [ebx + 0x80], 0
setne al
neg al
sbb eax, eax
mov byte [ebx + 0xb9], al
mov eax, dword [0x4f3454]
mov edx, dword [0x4f1a64]
mov dword [eax + 0x18], edx
mov edx, dword [0x4f1a68]
mov dword [eax + 0x1c], edx
fld qword [0x4f1a54]
call fcn.00402c14
mov ecx, dword [0x4f3454]
mov dword [ecx], eax
mov dword [ecx + 4], edx
fld qword [0x4f1a5c]
call fcn.00402c14
mov ecx, dword [0x4f3454]
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], edx
mov eax, dword [0x4f30c0]
mov dl, byte [edi]
mov byte [eax], dl
mov eax, dword [edi + 1]
cdq
mov ecx, dword [0x4f30c0]
mov dword [ecx + 1], eax
mov dword [ecx + 5], edx
mov eax, dword [edi + 5]
cdq
mov ecx, dword [0x4f30c0]
mov dword [ecx + 9], eax
mov dword [ecx + 0xd], edx
cmp byte [edi + 9], 1
sete al
neg al
sbb eax, eax
mov edx, dword [0x4f30c0]
mov byte [edx + 0x11], al
mov eax, dword [0x4f30c0]
mov dl, byte [edi + 0xa]
mov byte [eax + 0x12], dl
mov eax, dword [0x4f30c0]
mov byte [eax + 0x13], 0
cmp byte [edi + 0xb], 0
je 0x495f72
mov eax, dword [0x4f30c0]
mov byte [eax + 0x13], 1
cmp byte [edi + 0xc], 0
je 0x495f81
mov eax, dword [0x4f30c0]
mov byte [eax + 0x13], 2
cmp byte [edi + 0xd], 0
je 0x495f99
mov eax, dword [edi + 0xe]
cdq
mov ecx, dword [0x4f30c0]
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], edx
jmp 0x495fac
mov eax, dword [0x4f30c0]
mov dword [eax + 0x14], 0
mov dword [eax + 0x18], 0
mov eax, dword [0x4f3318]
mov edx, dword [0x4f1a8c]
call fcn.004048d0
mov eax, dword [0x4f358c]
lea edx, [edi + 0x12]
mov ecx, 0x104
call fcn.00404aec
mov eax, dword [0x4f2e44]
lea edx, [edi + 0x116]
mov ecx, 0x104
call fcn.00404aec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x496008
lea eax, [ebp - 0x240]
mov edx, 7
call fcn.004048a0
ret