Function at 0x49540d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xe8c
mov eax, 0x4ab4e3
call fcn.004a5429
mov dword [ebp - 0xe64], ecx
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xe80], 0x104
lea eax, [ebp - 0xe98]
mov dword [ebp - 0xe7c], esi
mov dword [ebp - 0xe78], esi
mov ebx, esi
mov dword [ebp - 0xe74], esi
push eax
lea eax, [ebp - 0xe68]
mov dword [ebp - 0xe5c], esi
push eax
lea eax, [ebp - 0xe6c]
mov dword [ebp - 0xe70], esi
push eax
lea eax, [ebp - 0xe70]
mov dword [ebp - 0xe6c], esi
push eax
lea eax, [ebp - 0xe5c]
mov dword [ebp - 0xe68], esi
push eax
lea eax, [ebp - 0xe74]
mov dword [ebp - 0xe60], 0x400
push eax
lea eax, [ebp - 0xe78]
push eax
lea eax, [ebp - 0xe7c]
push eax
push esi
lea eax, [ebp - 0xe80]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0xe5c]
mov dword [ebp - 0xe5c], eax
je 0x495708
push 7
pop edx
xor ecx, ecx
mov dword [ebp - 0xe58], 4
mov dword [ebp - 0xe20], edx
mov dword [ebp - 0xe24], esi
mov word [ebp - 0xe34], cx
mov dword [ebp - 4], esi
mov dword [ebp - 0xe04], edx
mov dword [ebp - 0xe08], esi
mov word [ebp - 0xe18], cx
inc ebx
mov dword [ebp - 0xe88], ebx
mov byte [ebp - 4], bl
test eax, eax
je 0x495661
mov ebx, dword [ebp - 0xe64]
xor eax, eax
mov dword [ebp - 0xe60], 0x400
push eax
push eax
push eax
push eax
mov word [ebp - 0xe00], ax
lea eax, [ebp - 0xe60]
push eax
lea eax, [ebp - 0xe00]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x49564e
lea eax, [ebp - 0xe00]
push eax
lea ecx, [ebp - 0xe1c]
call fcn.0043e521
cmp dword [ebp - 0xe04], 8
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xe58], 4
jae 0x495598
lea eax, [ebp - 0xe18]
lea ecx, [ebp - 0xe58]
push ecx
lea ecx, [ebp - 0xe84]
push ecx
push 0
push 0x10
push eax
push 0x4153dc
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x4955d6
lea eax, [ebp - 0xe1c]
push eax
lea ecx, [ebx + 0x54]
call fcn.00496139
mov ecx, eax
mov eax, dword [ebp - 0xe84]
mov dword [ecx], eax
jmp 0x49564e
cmp dword [ebp - 0xe04], 8
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xe58], 0x3e8
jae 0x4955f5
lea eax, [ebp - 0xe18]
lea ecx, [ebp - 0xe58]
push ecx
lea ecx, [ebp - 0x600]
push ecx
push 0
push 0xffff
push eax
push 0x4153dc
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x49564e
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0xe38]
call fcn.0043e521
lea eax, [ebp - 0xe1c]
push eax
lea ecx, [ebx + 0x48]
call fcn.004961e1
push 0xffffffffffffffff
push 0
lea ecx, [ebp - 0xe38]
push ecx
mov ecx, eax
call fcn.0043e997
inc esi
cmp esi, dword [ebp - 0xe5c]
jb 0x495532
mov ebx, dword [ebp - 0xe88]
push 0x430c18
lea ecx, [ebp - 0xe54]
call fcn.00444d2a
mov edi, dword [ebp - 0xe64]
lea eax, [ebp - 0xe54]
push eax
mov byte [ebp - 4], 2
lea ecx, [edi + 0x54]
call fcn.00496139
push 0
push ebx
lea ecx, [ebp - 0xe54]
mov eax, dword [eax]
mov dword [ebp - 0xe90], eax
mov byte [ebp - 4], bl
call fcn.0043e8d8
push 0x430c38
lea ecx, [ebp - 0xe54]
call fcn.00444d2a
lea eax, [ebp - 0xe54]
mov byte [ebp - 4], 3
push eax
lea ecx, [edi + 0x54]
call fcn.00496139
xor esi, esi
lea ecx, [ebp - 0xe54]
push esi
push ebx
mov eax, dword [eax]
mov dword [ebp - 0xe8c], eax
call fcn.0043e8d8
lea eax, [edi + 0x38]
push eax
lea eax, [ebp - 0xe90]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push esi
push ebx
lea ecx, [ebp - 0xe1c]
call fcn.0043e8d8
push esi
push ebx
lea ecx, [ebp - 0xe38]
call fcn.0043e8d8
mov eax, ebx
call fcn.004a53d8
ret 4