Function at 0x48560f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov eax, esi
mov dword [ebp - 0x814], ebx
mov dword [ebp - 0x80c], ebx
mov ecx, 0x88e
push edi
sub eax, 1
jne 0x485644
dec ecx
call fcn.004cf8b9
push eax
call fcn.004c5942
mov dword [esp], 0x406520
call fcn.004c5942
pop ecx
lea eax, [ebp - 0x814]
mov edi, 0x41df58
push eax
push 9
push ebx
and esi, 1
push edi
sub esi, 0x7fffffff
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x4856ca
push edi
push esi
xor edx, edx
mov ecx, 0x41de24
call fcn.004cfab1
mov ecx, 0x88f
call fcn.004cf8b9
push eax
call fcn.004c5942
mov dword [esp], 0x406520
call fcn.004c5942
pop ecx
push esi
push 0x62e013a
push edi
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp esi, 2
jne 0x485845
mov esi, ebx
jmp 0x485845
lea eax, [ebp - 0x820]
mov dword [ebp - 0x818], ebx
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x810]
mov dword [ebp - 0x810], 0x200
push eax
lea eax, [ebp - 0x408]
push eax
push ebx
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x48581d
lea eax, [ebp - 0x80c]
push eax
push 9
push ebx
lea eax, [ebp - 0x408]
push eax
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x48589d
lea eax, [ebp - 0x820]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x808]
push eax
push ecx
jmp 0x485798
push dword [ebp - 0x80c]
lea edx, [ebp - 0x808]
lea ecx, [ebp - 0x408]
call fcn.00484d19
mov edi, eax
test edi, edi
je 0x485776
push edi
push 0x679013a
call dword [sym.imp.certcli.dll_Ordinal_357]
test esi, esi
jne 0x48577c
mov esi, edi
lea eax, [ebp - 0x820]
inc ebx
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x808]
push eax
push ebx
push dword [ebp - 0x80c]
mov dword [ebp - 0x810], 0x200
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
je 0x48574d
cmp edi, 0x103
jne 0x485880
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x818]
lea eax, [ebp - 0x820]
push eax
xor ecx, ecx
mov dword [ebp - 0x810], 0x200
push ecx
push ecx
push ecx
lea eax, [ebp - 0x810]
mov dword [ebp - 0x80c], ecx
push eax
lea eax, [ebp - 0x408]
inc ebx
push eax
push ebx
push dword [ebp - 0x814]
mov dword [ebp - 0x818], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
push 0
pop ebx
test edi, edi
je 0x485709
cmp edi, 0x103
je 0x485845
push ebx
push edi
xor edx, edx
mov ecx, 0x41dfd8
call fcn.004cfab1
test esi, esi
jne 0x485839
mov esi, edi
push edi
push 0x64e013a
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp dword [ebp - 0x80c], 0
je 0x48585a
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x814], 0
je 0x48586f
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret
push 0
push edi
xor edx, edx
mov ecx, 0x41dfd8
call fcn.004cfab1
test esi, esi
jne 0x485895
mov esi, edi
push edi
push 0x676013a
jmp 0x48583f
push ebx
push edi
xor edx, edx
mov ecx, 0x41de24
call fcn.004cfab1
test esi, esi
jne 0x4858b1
mov esi, edi
push edi
push 0x65d013a
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x485845