Function at 0x480aa0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x532151
mov eax, dword fs:[0]
push eax
sub esp, 0x5f4
mov eax, dword [0x5c6150]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x5fc], edi
push 0x50
lea eax, [ebp - 0x60]
push 0
push eax
call fcn.004d9fe0
movzx eax, byte [esi + 0xf]
add esp, 0xc
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xb]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, word [esi + 6]
push eax
movzx eax, word [esi + 4]
push eax
push dword [esi]
lea eax, [ebp - 0x60]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push 0x27
push eax
call fcn.00412070
add esp, 0x38
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
lea ecx, [ebp - 0x38c]
call fcn.0044fd40
push 0xd
lea ecx, [ebp - 0x384]
mov dword [ebp - 0x394], 0
mov dword [ebp - 0x390], accept
mov dword [ebp - 0x388], 0xc
call fcn.00450b00
cmp byte [ebp - 0x270], 0
lea eax, [ebp - 0x380]
push 0x1a
cmove eax, dword [ebp - 0x384]
add eax, 4
push 0x59d040
push eax
call fcn.004d9a60
add esp, 0xc
mov dword [ebp - 4], 0
mov byte [ebp - 0x5f0], 0
mov dword [ebp - 0x5f4], 0
push str.CLSID
lea ecx, [ebp - 0x5e8]
call fcn.0044fe90
push 0x597154
lea eax, [ebp - 0x5e8]
mov byte [ebp - 4], 2
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x5e8]
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x5e8]
push str.LocalServer32
push 0x5971f4
push eax
call fcn.00450580
add esp, 0xc
lea eax, [ebp - 0x5dc]
cmp byte [ebp - 0x4cc], 0
lea ecx, [ebp - 0x398]
push 1
cmove eax, dword [ebp - 0x5e0]
push 0
push 0
add eax, 4
push eax
lea eax, [ebp - 0x5f4]
push eax
call fcn.0044f620
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test al, al
je 0x480dbb
push 0x208
lea eax, [ebp - 0x268]
push 0
push eax
call fcn.004d9fe0
add esp, 0xc
mov dword [ebp - 0x5ec], 0
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x5f8], 0x208
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x5ec]
push eax
push 0
push 0
push dword [ebp - 0x394]
call ebx
test eax, eax
je 0x480cd2
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
push eax
cmove edi, dword [ebp - 0x384]
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
push 0x59d0a8
jmp 0x480d03
cmp dword [ebp - 0x5ec], 1
je 0x480e32
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
lea ecx, [ebp - 0x5f4]
cmove edi, dword [ebp - 0x384]
call fcn.00450c80
push 0x59d0b8
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
mov dword [ebp - 0x5ec], 0
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x5f8], 0x208
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x5ec]
push eax
push 0
push 0
push dword [ebp - 0x394]
call ebx
test eax, eax
je 0x480dfa
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
push eax
cmove edi, dword [ebp - 0x384]
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
push 0x59d0a8
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
cmp byte [ebp - 0x4cc], 0
lea eax, [ebp - 0x5dc]
push 0
cmove eax, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x398]
push 0
push 0
add eax, 4
push eax
lea eax, [ebp - 0x5f4]
push eax
call fcn.0044f620
test al, al
jne 0x480e78
xor bl, bl
jmp 0x481092
cmp dword [ebp - 0x5ec], 2
je 0x480e2c
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
lea ecx, [ebp - 0x5f4]
cmove edi, dword [ebp - 0x384]
call fcn.00450c80
push 0x59d0b8
jmp 0x480d99
mov edi, dword [ebp - 0x5fc]
lea ecx, [ebp - 0x268]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480e40
sub ecx, edx
sar ecx, 1
je 0x480dbb
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x4c0]
call fcn.00451610
mov ecx, edi
jmp 0x481047
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x5ec], 0
push eax
lea eax, [ebp - 0x268]
mov dword [ebp - 0x5f8], 0x208
push eax
lea eax, [ebp - 0x5ec]
push eax
push 0
push 0
push dword [ebp - 0x394]
call ebx
test eax, eax
je 0x480eea
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
push eax
cmove edi, dword [ebp - 0x384]
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
push 0x59d0a8
jmp 0x480f1b
cmp dword [ebp - 0x5ec], 1
je 0x481005
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
lea ecx, [ebp - 0x5f4]
cmove edi, dword [ebp - 0x384]
call fcn.00450c80
push 0x59d0b8
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
mov dword [ebp - 0x5ec], 0
lea eax, [ebp - 0x5f8]
mov dword [ebp - 0x5f8], 0x208
push eax
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x5ec]
push eax
push 0
push 0
push dword [ebp - 0x394]
call ebx
test eax, eax
je 0x480faf
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
push eax
cmove edi, dword [ebp - 0x384]
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
mov ecx, eax
call fcn.00450ff0
lea ecx, [ebp - 0x5f4]
call fcn.00450c80
push 0x59d0a8
jmp 0x480fdc
cmp dword [ebp - 0x5ec], 2
je 0x481005
cmp byte [ebp - 0x270], 0
lea edi, [ebp - 0x380]
lea ecx, [ebp - 0x5f4]
cmove edi, dword [ebp - 0x384]
call fcn.00450c80
push 0x59d0b8
mov esi, eax
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
lea ecx, [edi + 4]
push ecx
push 0x5971f4
push esi
call fcn.00450580
add esp, 0xc
xor bl, bl
jmp 0x481092
lea ecx, [ebp - 0x268]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x481010
sub ecx, edx
sar ecx, 1
jne 0x481025
xor bl, bl
jmp 0x481092
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x268]
push eax
lea ecx, [ebp - 0x4c0]
call fcn.00451610
mov ecx, dword [ebp - 0x5fc]
cmp byte [ebp - 0x3a4], 0
lea eax, [ebp - 0x4b4]
cmove eax, dword [ebp - 0x4b8]
add eax, 4
push eax
call fcn.0044ff70
cmp byte [ebp - 0x3a4], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x481090
mov eax, dword [ebp - 0x4b8]
lea ecx, [ebp - 0x4b4]
cmp eax, ecx
je 0x481090
push eax
call fcn.004e1b56
add esp, 4
mov bl, 1
cmp byte [ebp - 0x4cc], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x4810be
mov eax, dword [ebp - 0x5e0]
lea ecx, [ebp - 0x5dc]
cmp eax, ecx
je 0x4810be
push eax
call fcn.004e1b56
add esp, 4
lea ecx, [ebp - 0x5f4]
call fcn.00450c20
mov eax, dword [ebp - 0x394]
mov dword [ebp - method.t_reg.virtual_0], vtable.t_reg.0
test eax, eax
je 0x4810e4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x270], 0
mov dword [ebp - 0x394], 0
mov dword [ebp - method.t_str.virtual_0], vtable.t_str.0
jne 0x48111a
mov eax, dword [ebp - 0x384]
lea ecx, [ebp - 0x380]
cmp eax, ecx
je 0x48111a
push eax
call fcn.004e1b56
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004d6cfd
mov esp, ebp
pop ebp
ret