Function at 0x483f9e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x78
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov dword [ebp - 0x78], ecx
xor edx, edx
mov dword [ebp - 0x70], eax
push ebx
push esi
push edi
mov dword [eax], edx
mov ebx, edx
mov dword [eax + 4], edx
mov edi, edx
lea eax, [ebp - 0x58]
mov dword [ebp - 0x58], edx
push eax
push 0x40b590
push ecx
mov dword [ebp - 0x74], edx
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x51], dl
mov dword [ebp - 0x6c], edx
mov byte [ebp - 0x52], dl
call dword [sym.imp.certcli.dll_CAGetCAProperty]
mov esi, eax
test esi, esi
je 0x484022
push esi
mov ecx, 0x876
call fcn.004cf8b9
push eax
call fcn.004c5942
push 0x406520
call fcn.004c5942
add esp, 0xc
push esi
push 0x116013a
push 0x40b590
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4841fa
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x484139
mov ecx, dword [eax]
test ecx, ecx
je 0x484139
xor ebx, ebx
lea eax, [ebp - 0x60]
push ebx
push eax
push ebx
lea eax, [ebp - 0x74]
mov edx, 0x406c34
push eax
push ebx
call fcn.004eeb33
mov esi, eax
test esi, esi
jne 0x484117
push 4
pop esi
lea eax, [ebp - 0x64]
mov dword [ebp - 0x64], esi
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
mov ebx, dword [ebp - 0x60]
push 0x41dc14
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x48409d
cmp dword [ebp - 0x5c], esi
jne 0x48409d
push dword [ebp - 0x6c]
lea eax, [ebp - 0x1c]
push 0x408abc
push 0xc
push eax
call fcn.0043ec15
add esp, 0x10
mov al, 1
jmp 0x4840af
push 0
push eax
xor edx, edx
mov ecx, 0x41dc3c
call fcn.004cfab1
mov al, byte [ebp - 0x51]
push 0x34
pop esi
mov byte [ebp - 0x51], al
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x50]
mov dword [ebp - 0x64], esi
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0x41dc5c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4840f6
cmp dword [ebp - 0x5c], 1
jne 0x4840f6
mov edi, dword [ebp - 0x64]
shr edi, 1
cmp edi, 0x1a
jb 0x4840e9
push 0x19
pop edi
lea eax, [edi + edi]
cmp eax, esi
jae 0x484231
jmp 0x484107
push 0
push eax
xor edx, edx
mov ecx, 0x41dc3c
call fcn.004cfab1
xor eax, eax
xor ecx, ecx
mov word [ebp + eax - 0x50], cx
mov al, byte [ebp - 0x51]
test edi, edi
je 0x484139
jmp 0x48414e
push ebx
push esi
xor edx, edx
mov ecx, 0x41dc80
call fcn.004cfab1
mov eax, dword [ebp - 0x58]
push esi
push 0x156013a
push dword [eax]
call dword [sym.imp.certcli.dll_Ordinal_359]
mov ebx, dword [ebp - 0x60]
push ecx
push 0x40c108
push ecx
push 0x1a
pop edx
lea ecx, [ebp - 0x50]
call fcn.0043eb27
mov al, byte [ebp - 0x51]
test al, al
jne 0x484164
push ecx
push 0x405e58
push ecx
push 0xc
pop edx
lea ecx, [ebp - 0x1c]
call fcn.0043eb27
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x50]
call fcn.004ca87f
test eax, eax
je 0x484190
push eax
push 0x166013a
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.certcli.dll_Ordinal_359]
mov esi, dword [ebp - 0x70]
jmp 0x4841ab
mov esi, dword [ebp - 0x70]
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push dword [ebp - 0x60]
mov edx, dword [ebp - 0x5c]
mov ecx, esi
call fcn.004c6337
mov byte [ebp - 0x52], 1
mov edi, 0x406520
push edi
call fcn.004c5942
pop ecx
lea eax, [ebp - 0x50]
mov ecx, 0x871
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004cf8b9
push eax
call fcn.004c5942
add esp, 0xc
cmp byte [ebp - 0x52], 0
je 0x4841f1
push 0x41da38
call fcn.004c5942
pop ecx
push esi
push 0
xor edx, edx
xor cl, cl
call fcn.0045fcfa
jmp 0x4841f8
push edi
call fcn.004c5942
pop ecx
xor esi, esi
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x58], 0
je 0x484215
push dword [ebp - 0x58]
push dword [ebp - 0x78]
call dword [sym.imp.certcli.dll_CAFreeCAProperty]
test ebx, ebx
je 0x484220
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret
call fcn.0050393c
int3