Function at 0x4a88d5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x98
mov eax, 0x6944d8
call fcn.0056e23b
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov esi, dword [ebp + 0xc]
and dword [ebp - 0x84], 0
mov dword [ebp - 0x8c], eax
call fcn.004173bc
and dword [ebp - 4], 0
mov ecx, 0x6cecbc
test esi, esi
mov eax, 0x6cec44
cmove eax, ecx
lea ecx, [ebp - 0x64]
push eax
call fcn.0041d41a
mov byte [ebp - 4], 1
lea eax, [ebp - 0x60]
cmp dword [ebp - 0x4c], 8
cmovae eax, dword [ebp - 0x60]
push eax
lea eax, [ebp - 0x2c]
push 0x6cece8
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x20019
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00567b83
mov ebx, eax
add esp, 0x14
test ebx, ebx
je 0x4a8b64
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x80]
push eax
xor ecx, ecx
lea eax, [ebp - 0x88]
push ecx
push eax
push ecx
push ecx
push ebx
mov dword [ebp - 0x80], ecx
call edi
cmp dword [ebp - 0x88], 1
jne 0x4a8b5d
mov eax, dword [ebp - 0x80]
test eax, eax
je 0x4a8b5d
add eax, 2
push eax
call fcn.0056e306
mov esi, eax
pop ecx
test esi, esi
je 0x4a8b5d
lea eax, [ebp - 0x80]
push eax
push esi
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push ebx
call edi
test eax, eax
jne 0x4a8b53
mov eax, dword [ebp - 0x80]
lea ecx, [ebp - 0x2c]
push esi
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x80]
mov byte [esi + eax + 1], 0
call fcn.004179fb
lea ecx, [ebp - 0x2c]
call fcn.0041df2f
lea ecx, [ebp - 0xa4]
call fcn.0052a520
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 3
mov edi, 0x6cece4
push edi
call fcn.00647fd1
pop ecx
push eax
push 0
push edi
lea ecx, [ebp - 0x28]
call fcn.00427f5c
mov edi, eax
cmp edi, 0xffffffff
je 0x4a8a86
push edi
push 0
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407b80
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x4a8a34
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x48]
call fcn.004179fb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
push 0
push 1
call fcn.00401d60
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x7c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407b80
mov byte [ebp - 4], 5
cmp dword [eax + 0x14], 8
jb 0x4a8a68
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0xa4]
call fcn.0052a90d
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x7c]
push 0
push 1
call fcn.00401d60
jmp 0x4a8a9a
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004179fb
lea ecx, [ebp - 0x48]
call fcn.0041df2f
push 0x6cedb4
lea ecx, [ebp - 0x48]
call fcn.0042dea6
cmp dword [0x79626c], 8
mov ecx, 0x796258
mov eax, 0x796274
cmovae ecx, dword [0x796258]
cmp dword [0x796288], 8
push ecx
cmovae eax, dword [0x796274]
push eax
lea eax, [ebp - 0x2c]
push 0x6cedb8
push eax
call fcn.0041ccda
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0064806f
add esp, 0x18
test eax, eax
jne 0x4a8b38
mov edi, dword [ebp - 0x8c]
test edi, edi
je 0x4a8b2e
push edi
call fcn.00647fd1
pop ecx
test eax, eax
je 0x4a8b2e
push edi
lea ecx, [ebp - 0xa4]
call fcn.0052a7a7
test eax, eax
je 0x4a8b38
mov dword [ebp - 0x84], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.0041786a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xa4]
call fcn.0052a54e
push 1
push esi
call fcn.0056df27
pop ecx
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
call fcn.0041786a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov eax, dword [ebp - 0x84]
call fcn.0056e1e5
ret