Function at 0x4dbd80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x54b0c8
mov eax, dword fs:[0]
push eax
sub esp, 0xdc
mov eax, dword [0x595c60]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
push 0x20
xor eax, eax
mov dword [ebp - 0x30], 7
push str.SOFTWAREMcAfeeAVSolutionDSDS
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x34], 0
mov word [ebp - 0x44], ax
call fcn.0047c530
mov dword [ebp - 4], 0
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x4dbde9
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x48]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4dbfcf
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x50], 4
push eax
push 0
push 0
push str.dwGTILogLevel
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4dbe79
mov ecx, dword [ebp - 0x4c]
lea eax, [ecx - 1]
cmp eax, 0x10
ja 0x4dbe3e
mov dword [esi + 0x64], ecx
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], 8
jb 0x4dbe5d
mov eax, dword [ebp - 0x44]
test eax, eax
je 0x4dbe5d
push eax
call fcn.005074d4
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00506c7d
mov esp, ebp
pop ebp
ret
mov eax, dword [0x59e598]
test al, 1
jne 0x4dbea4
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 1
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4dbeb9
cmp byte [eax + 0x19], 6
jb 0x4dbeb9
mov al, 1
jmp 0x4dbebb
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4dbed5
cmp byte [0x59e5a9], 0
jne 0x4dbed5
test al, al
je 0x4dbe3e
sub esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe8]
call fcn.0047b550
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 3
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xe8]
call fcn.0047eed0
mov edx, str.._telemetry.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x16d
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_read_TS_log_level
mov ecx, eax
call fcn.0047f130
mov byte [ebp - 4], 3
cmp dword [ebp - 0x18], 0x10
jb 0x4dbf5a
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dbf5a
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 5
cmp dword [esi + 0x14], 0x10
jb 0x4dbf77
mov esi, dword [esi]
call fcn.004a0950
push esi
push 6
mov ecx, eax
call fcn.004a0b40
cmp dword [ebp - 0x18], 0x10
jb 0x4dbf9c
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dbf9c
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.0047b620
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4dbe3e
mov eax, dword [0x59e598]
test al, 1
jne 0x4dbffa
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 7
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0
mov eax, dword [0x596f88]
test byte [eax + 0x1c], 2
je 0x4dc00f
cmp byte [eax + 0x19], 6
jb 0x4dc00f
mov al, 1
jmp 0x4dc011
xor al, al
cmp byte [0x59e5a8], 0
jne 0x4dc02b
cmp byte [0x59e5a9], 0
jne 0x4dc02b
test al, al
je 0x4dbe47
sub esp, 8
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xe8]
call fcn.0047b550
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 9
call fcn.004a0cb0
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xe8]
call fcn.0047eed0
mov edx, str.._telemetry.cpp
mov ecx, eax
call fcn.0047f130
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
push 0x173
mov ecx, eax
call fcn.0047b1b0
mov edx, 0x56a378
mov ecx, eax
call fcn.0047f130
mov edx, str.Failed_to_open_reg_key
mov ecx, eax
call fcn.0047f130
lea edx, [ebp - 0x44]
mov ecx, eax
call fcn.004a0d80
mov byte [ebp - 4], 9
cmp dword [ebp - 0x18], 0x10
jb 0x4dc0ba
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dc0ba
push eax
call fcn.005074d4
add esp, 4
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xe8]
call fcn.0047b6a0
mov esi, eax
mov byte [ebp - 4], 0xb
cmp dword [esi + 0x14], 0x10
jb 0x4dc0d7
mov esi, dword [esi]
mov eax, dword [0x59e598]
test al, 1
jne 0x4dc102
or eax, 1
mov dword [0x59e598], eax
mov byte [ebp - 4], 0xc
call fcn.004a08c0
push 0x54e860
call fcn.0050765d
add esp, 4
mov byte [ebp - 4], 0xb
push esi
push 6
mov ecx, 0x59e5a8
call fcn.004a0b40
cmp dword [ebp - 0x18], 0x10
jb 0x4dc125
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4dc125
push eax
call fcn.005074d4
add esp, 4
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 8
call fcn.0047b620
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x56a6f8
push eax
call fcn.0052889f
add esp, 4
jmp 0x4dbe47