Function at 0x496b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe2c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Shell32.dll
mov dword [ebp - 0xe0c], 5
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x496b86
push str.SHQueryUserNotificationState
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d2d0c], eax
test eax, eax
je 0x496bc0
lea ecx, [ebp - 0xe0c]
push ecx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0xe0c]
cmp eax, 5
jge 0x496bc5
push eax
push str.User_Busy_Mode___d
lea edx, [ebp - 0x308]
push 0x100
push edx
call fcn.00402830
push str.VerifyAutomaticUpdates__Wait_to_notify_user
lea esi, [ebp - 0x308]
call fcn.0047fb10
add esp, 0x14
jmp 0x4970ac
mov eax, 5
cmp dword [0x4d2afc], 0
mov dword [ebp - 0xe10], 1
je 0x496c04
mov ecx, dword [0x4c6444]
mov edx, dword [0x4c6448]
mov dword [ebp - 0xe1c], ecx
mov dword [ebp - 0xe20], edx
mov dword [0x4c6444], 0x20119
mov dword [0x4c6448], 0x20106
push eax
push str.User_Activity:__d
lea eax, [ebp - 0x808]
push 0x100
push eax
call fcn.00402830
push str.VerifyAutomaticUpdates
lea esi, [ebp - 0x808]
call fcn.0047fb10
mov edx, dword [0x4c6444]
add esp, 0x14
lea ecx, [ebp - 0xe0c]
push ecx
push edx
push 0
push str.SoftwareBillP_StudiosWinPatrol
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 4
test eax, eax
je 0x496c67
xor eax, eax
jmp 0x496cb2
lea eax, [ebp - 0xe18]
push eax
mov eax, dword [ebp - 0xe0c]
lea ecx, [ebp - 0xe14]
push ecx
lea edx, [ebp - 0xe28]
push edx
push 0
push str.AUOptions
push eax
mov dword [ebp - 0xe18], ebx
call edi
test eax, eax
je 0x496ca3
mov ecx, dword [ebp - 0xe0c]
push ecx
call esi
xor eax, eax
jmp 0x496cb2
mov edx, dword [ebp - 0xe0c]
push edx
call esi
mov eax, dword [ebp - 0xe14]
mov dword [ebp - 0xe24], eax
cmp eax, 1
jb 0x496ff0
cmp eax, ebx
ja 0x496ff0
mov ecx, dword [0x4c6444]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0xe14]
push eax
push ecx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push 0x80000002
call ebx
test eax, eax
je 0x496cf3
xor eax, eax
jmp 0x496d06
push str.AUOptions
lea esi, [ebp - 0xe14]
call fcn.0048e640
add esp, 4
mov ecx, dword [ebp - 0xe24]
mov dword [ebp - 0xe10], eax
cmp eax, ecx
je 0x496f6f
push 0x200
add ecx, 0x41a
lea edx, [ebp - 0xc08]
call fcn.00499890
mov ecx, dword [ebp - 0xe10]
add esp, 4
push 0x200
add ecx, 0x41a
lea edx, [ebp - 0xe08]
call fcn.00499890
add esp, 4
push 0x200
lea edx, [ebp - 0xa08]
mov ecx, 0x41f
call fcn.00499890
add esp, 4
push 0x100
lea edx, [ebp - 0x408]
mov ecx, 0x41a
call fcn.00499890
add esp, 4
lea edx, [ebp - 0xe08]
push edx
lea eax, [ebp - 0xc08]
push eax
lea ecx, [ebp - 0xa08]
push ecx
lea edx, [ebp - 0x808]
push 0x400
push edx
call fcn.00402830
add esp, 0x14
lea eax, [ebp - 0x808]
push eax
mov edx, 0x7ffffffe
mov eax, 0x800
mov ecx, 0x4cc9b8
call fcn.00401000
push 0x4cd200
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x208]
call fcn.00401000
mov edx, 0x200
lea eax, [ebp - 0x208]
jmp 0x496df0
cmp byte [eax], 0
je 0x496dfb
inc eax
dec edx
jne 0x496df0
jmp 0x496e23
test edx, edx
je 0x496e23
mov ecx, 0x200
sub ecx, edx
mov eax, 0x200
sub eax, ecx
push 0x4bad64
lea ecx, [ebp + ecx - 0x208]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x200
lea eax, [ebp - 0x208]
mov edi, edi
cmp byte [eax], 0
je 0x496e3b
inc eax
dec edx
jne 0x496e30
jmp 0x496e65
test edx, edx
je 0x496e65
mov ecx, 0x200
sub ecx, edx
lea edx, [ebp - 0x408]
mov eax, 0x200
push edx
sub eax, ecx
lea ecx, [ebp + ecx - 0x208]
mov edx, 0x7fffffff
call fcn.00401000
lea eax, [ebp - 0x208]
push eax
mov edx, 0x7ffffffe
mov eax, 0x200
mov ecx, 0x4cbbe0
call fcn.00401000
cmp dword [0x4d2b24], 0
mov eax, 1
mov dword [0x4cd270], eax
je 0x496eca
mov ecx, dword [0x4c78c4]
mov edx, dword [0x4cbe20]
push 0
push 0x47ccc0
push ecx
push 0xb8
push edx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [0x4d2aa4], 0
mov edi, eax
jge 0x496ed8
mov dword [0x4d2aa4], 0
jmp 0x496ed8
xor ecx, ecx
cmp dword [0x4c6464], eax
setne cl
lea edi, [ecx + 6]
cmp dword [0x4c6428], 1
jne 0x496eea
push edi
call fcn.004972a0
add esp, 4
cmp edi, 6
jne 0x496fa2
mov eax, dword [0x4c6444]
lea edx, [ebp - 0xe14]
push edx
push eax
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push 0x80000002
call ebx
test eax, eax
je 0x496f16
xor eax, eax
jmp 0x496f29
push str.AUOptions
lea esi, [ebp - 0xe14]
call fcn.0048e640
add esp, 4
mov dword [ebp - 0xe10], eax
test eax, eax
je 0x496f51
lea ecx, [ebp - 0xe10]
push ecx
push str.AUOptions
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.0048e590
add esp, 8
lea ecx, [ebp - 0xe10]
push ecx
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
push str.AUOptions
call fcn.0048e590
add esp, 8
cmp dword [0x4d2afc], 0
je 0x496f8f
mov edx, dword [ebp - 0xe1c]
mov eax, dword [ebp - 0xe20]
mov dword [0x4c6444], edx
mov dword [0x4c6448], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xe10]
push edx
push str.AUOptions
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.0048e590
add esp, 8
cmp edi, 7
jne 0x496f51
call fcn.0049a060
test eax, eax
je 0x496fda
mov ecx, str._AUOption
call fcn.00482e00
jmp 0x496f6f
lea eax, [ebp - 0xe24]
push eax
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
mov ebx, 0x80000002
jmp 0x496f62
mov edx, dword [0x4c6444]
lea ecx, [ebp - 0xe0c]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionWindowsUpdateAuto_Update
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x497018
xor eax, eax
jmp 0x497063
lea eax, [ebp - 0xe14]
push eax
mov eax, dword [ebp - 0xe0c]
lea ecx, [ebp - 0xe18]
push ecx
lea edx, [ebp - 0xe28]
push edx
push 0
push str.AUOptions
push eax
mov dword [ebp - 0xe14], ebx
call edi
test eax, eax
je 0x497054
mov ecx, dword [ebp - 0xe0c]
push ecx
call esi
xor eax, eax
jmp 0x497063
mov edx, dword [ebp - 0xe0c]
push edx
call esi
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xe10], eax
test eax, eax
je 0x49708b
lea eax, [ebp - 0xe10]
push eax
push str.AUOptions
mov esi, str.SoftwareBillP_StudiosWinPatrol
mov ebx, 0x80000001
call fcn.0048e590
add esp, 8
cmp dword [0x4d2afc], 0
je 0x4970ac
mov ecx, dword [ebp - 0xe1c]
mov edx, dword [ebp - 0xe20]
mov dword [0x4c6444], ecx
mov dword [0x4c6448], edx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret