Function at 0x4aaa10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4aac09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 4]
call fcn.004ab978
mov ecx, 0x20019
mov dl, 1
mov eax, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_]
call sub.rtl250.bpl__System_Win_Registry_TRegistry__bctr_qqrui
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x4aabdf
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call sub.rtl250.bpl__System_Win_Registry_TRegistry_SetRootKey_qqrp6HKEY__
xor ecx, ecx
mov edx, 0x4aac24
mov eax, dword [ebp - 8]
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_OpenKey_qqrx20System_UnicodeStringo
test al, al
jne 0x4aaa88
call sub.rtl250.bpl__System__TryFinallyExit_qqrv
jmp 0x4aabe6
mov edx, 0x4aac94
mov eax, dword [ebp - 8]
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_ValueExists_qqrx20System_UnicodeString
test al, al
jne 0x4aaaa3
call sub.rtl250.bpl__System__TryFinallyExit_qqrv
jmp 0x4aabe6
mov edx, 0x4aac94
mov eax, dword [ebp - 8]
call sub.AxComponentsRTL.bpl__Axrtl_System_Win_Registry_TRegistry_GetDataSize_qqrx20System_UnicodeString
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.rtl250.bpl__System_GetMemory_qi
pop ecx
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x4aabc2
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040270c
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0x4aaccc
mov eax, dword [ebp - 8]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x4aab09
call sub.rtl250.bpl__System__TryFinallyExit_qqrv
call sub.rtl250.bpl__System__TryFinallyExit_qqrv
jmp 0x4aabe6
mov ebx, dword [ebp - 0xc]
mov esi, ebx
add esi, dword [ebp - 0x10]
jmp 0x4aaba2
lea eax, [ebp - 0x14]
mov edx, ebx
call sub.rtl250.bpl__System__UStrFromPWChar_qqrr20System_UnicodeStringpb
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call sub.rtl250.bpl__System_Sysutils_Trim_qqrx20System_UnicodeString
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
inc eax
add eax, eax
add ebx, eax
mov eax, dword [ebp - 4]
call sub.rtl250.bpl__System__UStrLen_qqrx20System_UnicodeString
test eax, eax
jle 0x4aaba2
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
mov eax, dword [sym.imp.AxComponentsRTL.bpl__Axrtl_System_Strutils_StrUtils_]
call sub.AxComponentsRTL.bpl__Axrtl_System_Strutils_StrUtils_LowerCase_qqrx20System_UnicodeString
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrLAsg_qqrr20System_UnicodeStringx20System_UnicodeString
mov ecx, 1
mov edx, dword [ebp - 4]
mov eax, 0x4aad10
call sub.rtl250.bpl__System_Pos_qqrx20System_UnicodeStringt1i
dec eax
jne 0x4aab86
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call sub.rtl250.bpl__System__UStrDelete_qqrr20System_UnicodeStringii
mov eax, dword [edi + 4]
mov edx, dword [ebp - 4]
call fcn.004abb1c
test al, al
jne 0x4aaba2
mov eax, dword [edi + 4]
mov cl, 1
mov edx, dword [ebp - 4]
call fcn.004ab890
cmp esi, ebx
jg 0x4aab16
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aabc9
mov eax, dword [ebp - 0xc]
push eax
call sub.rtl250.bpl__System_FreeMemory_qpv
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aac10
lea eax, [ebp - 0x18]
mov edx, 2
call sub.rtl250.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 4]
call sub.rtl250.bpl__System__UStrClr_qqrpv
ret