Function at 0x4d0928
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x284
mov eax, 0x533a55
call fcn.004f1db2
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28c], eax
xor eax, eax
mov ebx, eax
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x280], ebx
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
mov dword [ebp - 4], eax
mov edi, eax
call fcn.00437474
push eax
lea ecx, [ebp - 0x27c]
call fcn.0043a4ef
push edi
push str.Softwareliebao
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x268]
mov byte [ebp - 4], 1
call fcn.00497f06
test eax, eax
je 0x4d0ee2
push esi
push str.Install_Path_Dir
lea ecx, [ebp - 0x268]
call fcn.00498058
test eax, eax
jne 0x4d0a22
xor esi, esi
mov edi, dword [ebp - 0x264]
mov eax, dword [ebp - 0x28c]
test eax, eax
je 0x4d09c9
mov dword [eax], edi
push edi
push str.write_Exit0_errcode_d
push 0x5aca00
call fcn.004dddd9
add esp, 0xc
cmp dword [ebp - 0x268], 0
je 0x4d09f1
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x268], esi
lea ecx, [ecx - 0x10]
call fcn.00436fdb
cmp dword [ebp - 0x268], 0
je 0x4d0a1a
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
call fcn.004f1d61
ret
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.004cda0e
pop ecx
pop ecx
push esi
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 2
call fcn.00417260
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x230]
call fcn.004180c0
push 0x559c0c
mov esi, eax
call fcn.00416680
pop ecx
push eax
push 0x559c0c
mov ecx, esi
call fcn.00418190
lea ecx, [ebp - 0x230]
xor esi, esi
cmp ecx, eax
je 0x4d0a8b
push 0xffffffffffffffff
push esi
push eax
call fcn.00417a30
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x268]
cmovae eax, dword [ebp - 0x230]
push eax
push str.ProgramPath
call fcn.00498058
push esi
test eax, eax
jne 0x4d0adf
mov edi, dword [ebp - 0x264]
lea ecx, [ebp - 0x230]
push 1
call fcn.00417d20
push esi
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00417d20
jmp 0x4d09bd
lea eax, [ebp - 0x260]
push eax
call fcn.004cda0e
pop ecx
pop ecx
cmp dword [eax + 0x14], 8
jb 0x4d0af5
mov eax, dword [eax]
push eax
push 0x55d4ac
lea ecx, [ebp - 0x268]
call fcn.00498058
mov ebx, eax
lea ecx, [ebp - 0x260]
push esi
neg ebx
push 1
sbb bl, bl
call fcn.00417d20
inc bl
je 0x4d0b4f
mov edi, dword [ebp - 0x264]
lea ecx, [ebp - 0x230]
push esi
push 1
call fcn.00417d20
push esi
mov byte [ebp - 4], 1
push 1
lea ecx, [ebp - 0x248]
call fcn.00417d20
mov ebx, dword [ebp - 0x280]
jmp 0x4d09bd
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push esi
push eax
call fcn.004f28b0
add esp, 0xc
mov dword [ebp - 0x290], 0x208
lea eax, [ebp - 0x290]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x288], ebx
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x288]
push eax
push 0x53e308
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [ebp - 0x218], 0
jne 0x4d0be0
call fcn.004e41f0
mov ecx, eax
cmp dword [ecx + 0x14], 8
mov eax, dword [ecx + 0x10]
jb 0x4d0bc6
mov ecx, dword [ecx]
add eax, eax
push eax
push ecx
push ebx
push 0x53e308
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call fcn.00437474
push eax
lea ecx, [ebp - 0x274]
call fcn.0043a4ef
mov byte [ebp - 4], 4
call fcn.00437474
push eax
lea ecx, [ebp - 0x278]
call fcn.0043a4ef
lea eax, [ebp - 0x278]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x26c]
call fcn.004cdd3d
add esp, 0xc
lea ecx, [ebp - 0x268]
push dword [ebp - 0x274]
push 0x5390b0
call fcn.00498058
test eax, eax
jne 0x4d0c79
mov ecx, dword [ebp - 0x278]
mov edi, dword [ebp - 0x264]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push esi
push ebx
lea ecx, [ebp - 0x230]
call fcn.00417d20
push esi
mov byte [ebp - 4], bl
push ebx
jmp 0x4d0b39
mov ecx, dword [ebp - 0x270]
mov eax, dword [ecx]
cmp dword [eax - 0xc], 0
jne 0x4d0dc5
mov eax, dword [ebp - 0x278]
cmp dword [eax - 0xc], 0
jne 0x4d0dbc
lea eax, [ebp - 0x26c]
push esi
push eax
call fcn.004cd975
push 0x5f
push dword [ebp - 0x26c]
mov byte [ebp - 4], 6
call fcn.004f4fbb
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4d0d8f
sub esi, dword [ebp - 0x26c]
sar esi, 1
cmp esi, 0xffffffff
je 0x4d0d8f
call fcn.00437474
push eax
lea ecx, [ebp - 0x270]
call fcn.0043a4ef
lea eax, [esi + 1]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x26c]
call fcn.00447979
push eax
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 8
call fcn.0043c2e8
mov ecx, dword [ebp - 0x284]
mov byte [ebp - 4], 7
lea ecx, [ecx - 0x10]
call fcn.00436fdb
push 0
push str..exe
lea ecx, [ebp - 0x270]
call fcn.00468330
push eax
push 0
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x270]
call fcn.00447a0f
push eax
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 9
call fcn.0043c2e8
mov ecx, dword [ebp - 0x284]
mov byte [ebp - 4], 7
lea ecx, [ecx - 0x10]
call fcn.00436fdb
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x27c]
call fcn.0043c2e8
mov ecx, dword [ebp - 0x270]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
jmp 0x4d0da8
mov esi, 0x55c6dc
push esi
call fcn.0043a8c3
pop ecx
push eax
push esi
lea ecx, [ebp - 0x274]
call fcn.0043a84a
mov ecx, dword [ebp - 0x26c]
mov byte [ebp - 4], 5
lea ecx, [ecx - 0x10]
call fcn.00436fdb
jmp 0x4d0dd1
lea eax, [ebp - 0x278]
push eax
jmp 0x4d0dc6
push ecx
lea ecx, [ebp - 0x27c]
call fcn.0043c2e8
call fcn.00437474
push eax
lea ecx, [ebp - 0x26c]
call fcn.0043a4ef
lea ecx, [ebp - 0x26c]
mov byte [ebp - 4], 0xa
call fcn.0043a29e
lea eax, [ebp - 0x26c]
push eax
push 0x53b258
lea ecx, [ebp - 0x268]
call fcn.00497f58
mov esi, dword [ebp - 0x26c]
cmp dword [esi - 0xc], 0
jne 0x4d0e7e
push dword [ebp - 0x27c]
lea ecx, [ebp - 0x268]
push 0x53b258
call fcn.00498058
test eax, eax
jne 0x4d0e7e
mov edi, dword [ebp - 0x264]
lea ecx, [esi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x278]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor esi, esi
lea ecx, [ebp - 0x230]
push esi
push ebx
call fcn.00417d20
push esi
push ebx
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.00417d20
mov ebx, esi
jmp 0x4d09bd
cmp dword [ebp - 0x268], 0
je 0x4d0e93
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x268], 0
lea ecx, [esi - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x278]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
mov ecx, dword [ebp - 0x274]
lea ecx, [ecx - 0x10]
call fcn.00436fdb
xor esi, esi
lea ecx, [ebp - 0x230]
push esi
push 1
call fcn.00417d20
push esi
push 1
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], 1
call fcn.00417d20
jmp 0x4d0eea
mov edi, dword [ebp - 0x264]
xor esi, esi
push edi
push ebx
push str.PRODUCE_INSTALL_KEY_bRet_d_code_d
push 0x5aca00
call fcn.004dddd9
add esp, 0x10
lea ecx, [ebp - 0x268]
push esi
push str.SoftwareliebaoCoop
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00497f06
test eax, eax
je 0x4d09b7
test ebx, ebx
je 0x4d09b7
push str.h_home
push 0x53e4b0
lea ecx, [ebp - 0x268]
call fcn.00498058
test eax, eax
je 0x4d09bd
push str.h_home
push str.OEMNAME
lea ecx, [ebp - 0x268]
call fcn.00498058
test eax, eax
je 0x4d09bd
push str.h_home
push str.PreOEM
lea ecx, [ebp - 0x268]
call fcn.00498058
test eax, eax
je 0x4d09bd
cmp dword [ebp - 0x268], 0
je 0x4d0f90
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x268], esi
push edi
inc ebx
push ebx
push str.PRODUCE_INSTALL_COOP_bRet_d_code_d
push 0x5aca00
call fcn.004dddd9
add esp, 0x10
lea ecx, [ebp - 0x268]
push ebx
push str.SOFTWAREPoliciesChromium
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00497f06
test eax, eax
je 0x4d09bd
push ebx
push str.MetricsReportingEnabled
lea ecx, [ebp - 0x268]
call fcn.004d08f4
cmp dword [ebp - 0x268], 0
je 0x4d0ff1
push dword [ebp - 0x268]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x268], esi
jmp 0x4d09bd