Function at 0x4a5a23
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x64
mov eax, 0x694138
call fcn.0056e23b
xor ebx, ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
call fcn.004173bc
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x2c]
push 0x6cdddc
push 0x6cde60
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x20019
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00567b83
mov edi, eax
add esp, 0x14
inc ebx
test edi, edi
je 0x4a5bf9
xor ecx, ecx
lea eax, [ebp - 0x64]
push eax
push ecx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x64], ecx
push eax
push ecx
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x68], ebx
jne 0x4a5bf2
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x4a5bf2
add eax, 2
push eax
call fcn.0056e306
mov esi, eax
pop ecx
test esi, esi
je 0x4a5bf2
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a5be9
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x2c]
push esi
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x64]
mov byte [esi + eax + 1], 0
call fcn.004179fb
lea ecx, [ebp - 0x2c]
call fcn.0041df2f
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], bl
push 0x6cde5c
call fcn.00647fd1
pop ecx
push eax
push 0
push 0x6cde5c
lea ecx, [ebp - 0x28]
call fcn.00427f5c
cmp eax, 0xffffffff
je 0x4a5b53
push eax
push 0
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407b80
mov byte [ebp - 4], 2
cmp dword [eax + 0x14], 8
jb 0x4a5b3a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x48]
call fcn.004179fb
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x60]
push 0
push ebx
call fcn.00401d60
jmp 0x4a5b67
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004179fb
lea ecx, [ebp - 0x48]
call fcn.0041df2f
push 0x6cded8
lea ecx, [ebp - 0x48]
call fcn.0042dea6
cmp dword [0x79626c], 8
mov ecx, 0x796258
mov eax, 0x796274
cmovae ecx, dword [0x796258]
cmp dword [0x796288], 8
push ecx
cmovae eax, dword [0x796274]
push eax
lea eax, [ebp - 0x2c]
push 0x6cdedc
push eax
call fcn.0041ccda
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0064806f
mov ecx, dword [ebp - 0x6c]
add esp, 0x18
test eax, eax
cmove ecx, ebx
mov dword [ebp - 0x6c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
push ebx
push esi
call fcn.0056df27
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x6cdee8
lea eax, [ebp - 0x2c]
push 0x6cdf20
push eax
call fcn.0041ccda
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x20019
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00567b83
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4a5d86
xor ecx, ecx
lea eax, [ebp - 0x64]
push eax
push ecx
lea eax, [ebp - 0x68]
mov dword [ebp - 0x64], ecx
push eax
push ecx
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x68], ebx
jne 0x4a5d7f
mov eax, dword [ebp - 0x64]
test eax, eax
je 0x4a5d7f
add eax, 2
push eax
call fcn.0056e306
mov esi, eax
pop ecx
test esi, esi
je 0x4a5d7f
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a5d76
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x2c]
push esi
mov byte [esi + eax], 0
mov eax, dword [ebp - 0x64]
mov byte [esi + eax + 1], 0
call fcn.004179fb
lea ecx, [ebp - 0x2c]
call fcn.0041df2f
lea ecx, [ebp - 0x48]
call fcn.004173bc
mov byte [ebp - 4], 3
push 0x6cdf1c
call fcn.00647fd1
pop ecx
push eax
push 0
push 0x6cdf1c
lea ecx, [ebp - 0x28]
call fcn.00427f5c
cmp eax, 0xffffffff
je 0x4a5d0b
push eax
push 0
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x28]
call fcn.00407b80
mov byte [ebp - 4], 4
cmp dword [eax + 0x14], 8
jb 0x4a5cf1
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x48]
call fcn.004179fb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x60]
push 0
push ebx
call fcn.00401d60
jmp 0x4a5d1f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.004179fb
lea ecx, [ebp - 0x48]
call fcn.0041df2f
push 0x6cdfa8
lea ecx, [ebp - 0x48]
call fcn.0042dea6
lea eax, [ebp - 0x2c]
push 0
push eax
call fcn.0042810e
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x44]
lea eax, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x44]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.0064806f
mov ecx, dword [ebp - 0x70]
add esp, 0x10
test eax, eax
cmove ecx, ebx
mov dword [ebp - 0x70], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.0041786a
push ebx
push esi
call fcn.0056df27
pop ecx
pop ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6c], 0
je 0x4a5d92
cmp dword [ebp - 0x70], 0
jne 0x4a5d94
xor ebx, ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0041786a
mov eax, ebx
call fcn.0056e1e5
ret