Function at 0x4a5a3a04
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x4a
push 0
push 0
dec ecx
jne 0x4a5a3a0d
xchg dword [ebp - 4], ecx
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x4a5a3d8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x22c]
push eax
mov cl, 0x5c
mov edx, 1
mov eax, esi
call fcn.4a51151c
mov eax, dword [ebp - 0x22c]
mov edx, 0x4a5a3da8
call fcn.4a50f4ec
test al, al
je 0x4a5a3c16
lea eax, [ebp - 0x10]
push eax
push 9
push 0
lea eax, [ebp - 0x234]
push eax
mov cl, 0x5c
mov edx, 2
mov eax, esi
call fcn.4a51151c
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
mov edx, 0x4a5a3dc4
call fcn.4a5084e8
mov eax, dword [ebp - 0x230]
call fcn.4a5082f8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a5a3cea
xor ebx, ebx
mov dword [ebp - 0x1c], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x226]
push eax
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x4a5a3c08
lea eax, [ebp - 0x14]
push eax
push 1
push 0
lea eax, [ebp - 0x226]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a5a3c02
mov dword [ebp - 0x1c], 0x104
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x226]
push eax
push 0
push 0
push 0x4a5a3e14
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4a5a3bf9
lea eax, [ebp - 0x23c]
push eax
mov cl, 0x5c
mov edx, 3
mov eax, esi
call fcn.4a51151c
push dword [ebp - 0x23c]
push 0x4a5a3e30
lea eax, [ebp - 0x240]
push eax
mov cl, 0x5c
mov edx, 4
mov eax, esi
call fcn.4a51151c
push dword [ebp - 0x240]
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.4a508570
mov eax, dword [ebp - 0x238]
push eax
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x226]
mov ecx, 0x105
call fcn.4a5083a4
mov eax, dword [ebp - 0x244]
pop edx
call fcn.4a50f4ec
test al, al
je 0x4a5a3bf9
lea eax, [ebp - 0x18]
push eax
push 1
push 0
push 0x4a5a3e34
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a5a3bf9
mov dword [ebp - 0x1c], 0x1000
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0x4a5a3e58
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
inc ebx
jmp 0x4a5a3abf
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x4a5a3cea
lea eax, [ebp - 0x248]
push eax
mov cl, 0x23
mov edx, 1
mov eax, esi
call fcn.4a51151c
mov eax, dword [ebp - 0x248]
mov edx, 0x4a5a3e70
call fcn.4a50f4ec
test al, al
je 0x4a5a3cea
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0x4a5a3dc4
lea eax, [ebp - 0x250]
push eax
mov cl, 0x23
mov edx, 2
mov eax, esi
call fcn.4a51151c
push dword [ebp - 0x250]
push 0x4a5a3e30
lea eax, [ebp - 0x254]
push eax
mov cl, 0x23
mov edx, 3
mov eax, esi
call fcn.4a51151c
push dword [ebp - 0x254]
push 0x4a5a3e94
lea eax, [ebp - 0x24c]
mov edx, 5
call fcn.4a508570
mov eax, dword [ebp - 0x24c]
call fcn.4a5082f8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4a5a3cea
mov dword [ebp - 0x1c], 0x1000
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0x4a5a3e58
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [ebp - 9], 0
je 0x4a5a3d6c
mov eax, dword [ebp - 0x1c]
and eax, 0x7f
sub dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x80
jbe 0x4a5a3d64
xor edx, edx
mov ebx, dword [ebp - 0x1c]
sub ebx, 0x80
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, ebx
jl 0x4a5a3d27
inc eax
mov ecx, dword [ebp - 4]
cmp byte [ecx + ebx], 0
je 0x4a5a3d23
mov dl, 1
jmp 0x4a5a3d27
inc ebx
dec eax
jne 0x4a5a3d16
test dl, dl
je 0x4a5a3d50
xor edx, edx
mov ebx, dword [ebp - 0x1c]
sub ebx, 0x80
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, ebx
jl 0x4a5a3d50
inc eax
mov ecx, dword [ebp - 4]
cmp byte [ecx + ebx], 0xff
je 0x4a5a3d4c
mov dl, 1
jmp 0x4a5a3d50
inc ebx
dec eax
jne 0x4a5a3d3f
test dl, dl
jne 0x4a5a3d64
sub dword [ebp - 0x1c], 0x80
cmp dword [ebp - 0x1c], 0x80
ja 0x4a5a3d02
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
mov dword [eax], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a5a3d91
lea eax, [ebp - 0x254]
mov edx, 0xb
call fcn.4a507678
ret