Function at 0x4eba88
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x5184d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x440], ecx
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0x43c], ecx
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x448], ecx
mov ecx, dword [ebp + 8]
and ecx, 2
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp + 0x18]
push ebx
mov dword [ebp - 0x430], ecx
neg ecx
push esi
sbb ebx, ebx
mov dword [ebp - 0x454], eax
mov ecx, dword [ebp - 0x44c]
and ebx, 0xd0026
mov esi, edx
add ebx, 0x20019
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x438], esi
mov dword [ebp - 0x450], edx
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x41c], edi
test ecx, ecx
je 0x4ebb15
and dword [ecx], 0
xor ecx, ecx
test edi, edi
je 0x4ebb1d
mov dword [edi], ecx
test edx, edx
jne 0x4ebb37
mov esi, 0x80004003
push esi
push 0xa2b01b5
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4ec0f7
mov dword [edx], ecx
test eax, eax
je 0x4ebb3f
mov byte [eax], cl
lea edx, [ebp - 0x434]
mov ecx, esi
call fcn.004eb953
mov esi, eax
test esi, esi
je 0x4ebb5a
push esi
push 0xa3601b5
jmp 0x4ebb2c
mov edi, dword [ebp - 0x434]
mov eax, dword [edi + 8]
test al, 0x20
je 0x4ebb7d
mov ebx, dword [ebp - 0x430]
neg ebx
sbb ebx, ebx
and ebx, 0xd0026
add ebx, 0x20119
mov ecx, eax
test al, 8
je 0x4ebb99
test byte [ebp + 8], 4
je 0x4ebb99
mov eax, dword [ebp - 0x454]
test eax, eax
je 0x4ebb99
mov byte [eax], 1
mov ecx, dword [edi + 8]
test byte [ebp + 8], 0x10
mov eax, dword [edi + 0xc]
mov dword [ebp - 0x430], eax
je 0x4ebbb7
cmp dword [edi + 0x10], 0
je 0x4ebbb7
mov eax, dword [edi + 0x10]
mov dword [ebp - 0x430], eax
xor edx, edx
mov byte [ebp - 0x415], dl
test cl, 7
je 0x4ebc4f
lea eax, [ebp - 0x424]
push eax
push ebx
push edx
push 0x41f748
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x4ebc42
push esi
push 0xa5501b5
call dword [sym.imp.certcli.dll_Ordinal_357]
cmp esi, 2
jne 0x4ebc3a
test byte [ebp + 8], 8
je 0x4ebc3a
xor ecx, ecx
lea eax, [ebp - 0x424]
push ecx
push eax
push ecx
push 0xf003f
push ecx
push ecx
push ecx
push 0x41f748
push dword [ebp - 0x440]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x4ebc42
push esi
push 0xa6201b5
call dword [sym.imp.certcli.dll_Ordinal_357]
jmp 0x4ec0f1
push esi
push 0xa6401b5
jmp 0x4ebc2f
mov al, byte [ebp + 8]
and al, 1
xor edx, edx
mov byte [ebp - 0x415], al
mov ecx, dword [edi + 8]
push 0x5c
pop esi
test cl, 1
je 0x4ebc87
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x438]
lea edi, [edx + eax*2]
mov eax, dword [ebp - 0x424]
and dword [ebp - 0x424], 0
mov dword [ebp - 0x420], eax
xor eax, eax
mov word [ebp - 0x20c], ax
jmp 0x4ebebb
test cl, 7
je 0x4ebe48
xor eax, eax
mov dword [ebp - 0x428], 0x208
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x42c]
push eax
push edx
push 0x41469c
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x4ebce6
push esi
push 0xa8501b5
push 0x41469c
call dword [sym.imp.certcli.dll_Ordinal_359]
jmp 0x4ec0f1
cmp dword [ebp - 0x42c], 1
je 0x4ebd07
cmp dword [ebp - 0x42c], 7
je 0x4ebd07
mov eax, 0x8007000d
push eax
mov esi, eax
push 0xa8a01b5
jmp 0x4ebcd6
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 0x438]
mov esi, dword [ebp - 0x430]
lea edi, [ecx + eax*2]
test esi, esi
je 0x4ebd49
push 0x4050fc
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0043eadb
push esi
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0043eadb
mov ecx, dword [ebp - 0x438]
cmp dword [ebp - 0x41c], 0
je 0x4ebe20
lea eax, [ebp - 0x43c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x4ebd8f
push esi
push 0xaa401b5
lea eax, [ebp - 0x20c]
push eax
jmp 0x4ebcdb
mov eax, dword [ebp - 0x434]
test byte [eax + 8], 4
je 0x4ebebb
lea eax, [ebp - 0x428]
mov dword [ebp - 0x428], 0x208
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x42c]
push eax
push 0
push 0x41469c
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x4ebde2
push esi
push 0xab001b5
jmp 0x4ebcd6
cmp dword [ebp - 0x42c], 1
je 0x4ebe03
cmp dword [ebp - 0x42c], 7
je 0x4ebe03
mov eax, 0x8007000d
push eax
mov esi, eax
push 0xab501b5
jmp 0x4ebd83
push 0x4050fc
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0043eadb
lea eax, [ebp - 0x414]
jmp 0x4ebe35
push 0x5c
pop edx
push edx
push ecx
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
je 0x4ebebb
push eax
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0043eadb
jmp 0x4ebebb
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x438]
lea edi, [edx + eax*2]
movzx eax, word [edi]
mov edx, eax
cmp si, ax
jne 0x4ebe64
add edi, 2
movzx edx, word [edi]
xor eax, eax
cmp ax, dx
je 0x4ebe97
test cl, 0x10
je 0x4ebe97
lea edx, [ebp - 0x448]
mov ecx, edi
call fcn.004eb83f
test eax, eax
je 0x4ebe91
push eax
push eax
push 0xad801b5
push edi
call dword [sym.imp.certcli.dll_Ordinal_360]
jmp 0x4ebe97
mov edi, dword [ebp - 0x448]
xor eax, eax
mov word [ebp - 0x20c], ax
mov eax, dword [ebp - 0x430]
test eax, eax
je 0x4ebebb
push eax
mov edx, 0x104
lea ecx, [ebp - 0x20c]
call fcn.0043eb7d
cmp dword [ebp - 0x420], 0
jne 0x4ebf67
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x434], eax
test eax, eax
jne 0x4ebee4
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x434], eax
lea ecx, [ebp - 0x420]
push ecx
push ebx
xor ebx, ebx
lea ecx, [ebp - 0x20c]
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x4ebf67
push esi
push 0xaf001b5
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.certcli.dll_Ordinal_359]
cmp esi, 2
jne 0x4ebf5c
test byte [ebp + 8], 8
je 0x4ebf5c
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x4ebf67
push esi
push 0xb0001b5
jmp 0x4ebd83
push esi
push 0xb0201b5
jmp 0x4ebd83
push 0x5c
pop eax
cmp ax, word [edi]
jne 0x4ebf72
add edi, 2
mov ebx, dword [ebp - 0x41c]
test ebx, ebx
je 0x4ebff0
xor eax, eax
cmp ax, word [edi]
je 0x4ebff0
xor ecx, ecx
lea eax, [ebp - 0x444]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x414]
mov esi, ecx
push eax
push ecx
jmp 0x4ebfce
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x414]
push eax
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec eax
sub eax, 1
je 0x4ebfea
inc esi
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push dword [ebp - 0x420]
mov dword [ebp - 0x444], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x4ebf9c
jmp 0x4ebff0
lea edi, [ebp - 0x414]
lea ecx, [ebp - 0x20c]
xor esi, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x4ebffb
sub ecx, edx
sar ecx, 1
cmp byte [ebp - 0x415], 0
lea ecx, [ecx*2 + 2]
mov dword [ebp - 0x428], ecx
je 0x4ec029
add ecx, 0x70
mov dword [ebp - 0x428], ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, dword [ebp - 0x450]
mov dword [esi], eax
test eax, eax
jne 0x4ec055
mov esi, 0x8007000e
push esi
push 0xb2801b5
call dword [sym.imp.certcli.dll_Ordinal_357]
mov edi, ebx
jmp 0x4ec0f7
xor ecx, ecx
mov word [eax], cx
cmp byte [ebp - 0x415], cl
je 0x4ec076
mov edx, dword [ebp - 0x428]
mov ecx, dword [esi]
push 0x42f2f8
shr edx, 1
call fcn.0043eb7d
mov edx, dword [ebp - 0x428]
lea eax, [ebp - 0x20c]
mov ecx, dword [esi]
push eax
shr edx, 1
call fcn.0043eadb
xor eax, eax
cmp ax, word [ebp - 0x20c]
jne 0x4ec0b7
mov eax, dword [ebp - 0x428]
cmp eax, 2
jbe 0x4ec0b7
mov ecx, dword [esi]
shr eax, 1
push 0x5c
pop edx
cmp dx, word [ecx + eax*2 - 4]
jne 0x4ec0b7
xor edx, edx
mov word [ecx + eax*2 - 4], dx
test ebx, ebx
je 0x4ec0d5
mov edx, ebx
mov ecx, edi
call fcn.004c723f
mov esi, eax
test esi, esi
je 0x4ec0d5
push esi
push 0xb3901b5
jmp 0x4ec048
mov ecx, dword [ebp - 0x44c]
xor ebx, ebx
test ecx, ecx
je 0x4ec0ef
mov eax, dword [ebp - 0x420]
mov dword [ecx], eax
mov dword [ebp - 0x420], ebx
mov esi, ebx
mov edi, dword [ebp - 0x41c]
cmp dword [ebp - 0x424], 0
je 0x4ec10c
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x43c], 0
je 0x4ec121
push dword [ebp - 0x43c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x420], 0
je 0x4ec136
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x448]
test eax, eax
je 0x4ec147
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
je 0x4ec17b
mov ebx, dword [ebp - 0x450]
test ebx, ebx
je 0x4ec166
cmp dword [ebx], 0
je 0x4ec166
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [ebx], eax
test edi, edi
je 0x4ec17b
cmp dword [edi], 0
je 0x4ec17b
push dword [edi]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov dword [edi], eax
mov ecx, esi
call fcn.004c738c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005036b0
leave
ret 0x14