Function at 0x4526c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4909
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4e706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x2c], ebx
mov edi, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], 0
mov dword [edi], 0
mov dword [ebp - 4], 1
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x452a1a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
push 0x20119
push 0
push str.SOFTWAREMalwarebytes
push 0x80000002
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x45298a
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 2
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x452a24
mov eax, dword [ecx]
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 3
mov ecx, 1
mov eax, dword [esi - 8]
sub ecx, dword [esi - 4]
sub eax, 0x104
or eax, ecx
jge 0x4527b1
push 0x104
lea ecx, [ebp - 0x1c]
call fcn.00403710
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 8], 0x104
lea ebx, [esi - 0x10]
jl 0x452a2e
xor eax, eax
mov dword [ebx + 4], 0x104
mov word [esi + 0x208], ax
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
mov dword [ebp - 0x20], 0x208
push eax
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebx + 8]
mov dword [ebp - 0x14], eax
push esi
call fcn.0048a27c
add esp, 8
test eax, eax
js 0x452a2e
cmp eax, dword [ebx + 8]
jg 0x452a2e
xor ecx, ecx
mov dword [ebx + 4], eax
mov word [esi + eax*2], cx
cmp dword [ebp - 0x14], ecx
jne 0x452919
mov byte [ebp - 4], 4
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x452a38
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
push dword [ebp - 0x2c]
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 5
push str.read__s_from_registry_as__s
push eax
call fcn.0040f6f0
mov edi, dword [ebp - 0x14]
mov edx, 0x2a9
push edi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetup_setuputils.cpp
call fcn.004417b0
mov ecx, dword [ebp - 0x18]
add esp, 0x14
or eax, 0xffffffff
mov edx, dword [ecx]
sub edx, 0x10
mov dword [ebp - 0x30], edx
cmp ebx, edx
je 0x4528cf
lea eax, [edx + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [eax]
shr eax, 0x1f
test al, al
jne 0x4528c3
mov eax, dword [ebx]
cmp eax, dword [edx]
jne 0x4528c3
mov ecx, ebx
call fcn.00403ce0
mov esi, eax
mov ecx, dword [ebp - 0x2c]
or eax, 0xffffffff
mov byte [ebp - 4], 6
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x4528b9
mov edx, dword [ebp - 0x30]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x18]
lea eax, [esi + 0x10]
mov dword [ecx], eax
jmp 0x4528cc
push dword [ebx + 4]
push esi
call fcn.0040c6c0
or eax, 0xffffffff
add edi, 0xfffffff0
mov byte [ebp - 4], 7
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4528e8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x18]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xb
or eax, 0xffffffff
lock xadd dword [ebx + 0xc], eax
dec eax
test eax, eax
jg 0x4529fc
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4529fc
mov byte [ebp - 4], 8
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x452a42
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x18]
push dword [ebp - 0x14]
push dword [ebp - 0x2c]
push str.failed_to_read__s_from_registry__0x_08X_
push eax
call fcn.0040f6f0
mov esi, dword [ebp - 0x18]
mov edx, 0x2b1
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetup_setuputils.cpp
call fcn.004417b0
add esp, 0x14
add esi, 0xfffffff0
mov byte [ebp - 4], 0xa
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4528eb
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x4528eb
cmp esi, 2
je 0x4529fc
mov dword [ebp - 4], 0xc
call fcn.00403ab0
mov ecx, eax
test ecx, ecx
je 0x452a4c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
push esi
push ebx
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0xd
push str.failed_to_find__s_in_registry__0x_08X_
push eax
call fcn.0040f6f0
mov esi, dword [ebp - 0x14]
mov edx, 0x2ba
push esi
mov ecx, str.c:jenkinsworkspacembam_windows_a_mb5_mbsetup_srcmbsetup_setuputils.cpp
call fcn.004417b0
add esp, 0x14
add esi, 0xfffffff0
mov dword [ebp - 4], 0xe
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4529fc
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0046ebaf
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00403c20
push 0x80004005
call fcn.00403c20
push 0x80070057
call fcn.00403c20
push 0x80004005
call fcn.00403c20
push 0x80004005
call fcn.00403c20
push 0x80004005
call fcn.00403c20
int3