Function at 0x48ef1b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x500144]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x220], 0
and dword [ebp - 0x214], 0
and dword [ebp - 0x224], 0
xor eax, eax
push ebx
push esi
mov ebx, ecx
mov word [ebp - 0x210], ax
push edi
mov dword [ebp - 0x234], ebx
mov eax, dword [section..data]
mov edi, section..data
mov esi, 0x4154b8
cmp eax, edi
je 0x48ef98
test byte [eax + 0x1c], 1
je 0x48ef98
cmp byte [eax + 0x19], 5
jb 0x48ef98
call fcn.0042386b
push eax
mov eax, dword [section..data]
mov edx, esi
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x15
pop ecx
call fcn.004238e7
mov eax, dword [section..data]
test ebx, ebx
jne 0x48efcb
cmp eax, edi
je 0x48efc1
test byte [eax + 0x1c], 8
je 0x48efc1
cmp byte [eax + 0x19], 2
jb 0x48efc1
push 0x4151f8
push dword [eax + 0x14]
mov edx, esi
push dword [eax + 0x10]
push 0x16
pop ecx
call fcn.0044fb0f
mov edi, 0x80070057
jmp 0x48f3ca
and dword [ebx], 0
lea eax, [ebp - 0x224]
push eax
push 0x7c
call fcn.0048d040
mov esi, eax
test esi, esi
je 0x48f021
mov ecx, dword [section..data]
cmp ecx, edi
je 0x48f017
test byte [ecx + 0x1c], 1
je 0x48f017
cmp byte [ecx + 0x19], 2
jb 0x48f017
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x4154b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x17
pop ecx
call fcn.00421fda
mov edi, 0x80004005
jmp 0x48f3ca
mov eax, dword [ebp - 0x224]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx]
mov ecx, esi
call dword [0x5035f0]
call esi
mov ebx, dword [ebp - 0x224]
lea eax, [ebp - 0x214]
push eax
push 0x20019
push 0
push 0x415278
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x48f09d
mov ecx, dword [section..data]
cmp ecx, edi
je 0x48f095
test byte [ecx + 0x1c], 1
je 0x48f095
cmp byte [ecx + 0x19], 3
jb 0x48f095
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x4154b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x18
pop ecx
call fcn.00421fda
xor edi, edi
inc edi
jmp 0x48f3ac
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x228]
call fcn.0048f401
test eax, eax
js 0x48f0ca
mov dword [ebp - 0x220], 1
mov eax, dword [ebx]
push dword [ebp - 0x228]
mov esi, dword [eax + 0x30]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
mov edi, eax
test edi, edi
jns 0x48f11e
mov eax, dword [section..data]
cmp eax, section..data
je 0x48f3b0
test byte [eax + 0x1c], 8
je 0x48f3b0
cmp byte [eax + 0x19], 2
jb 0x48f3b0
push edi
push 0x4152ec
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x19
jmp 0x48f35b
cmp dword [ebp - 0x218], 0
je 0x48f156
mov eax, dword [ebx]
push 1
mov esi, dword [eax + 0x68]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
cmp dword [ebp - 0x21c], 0
je 0x48f156
mov eax, dword [ebx]
push 1
mov esi, dword [eax + 0x64]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
push ecx
mov ecx, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
call fcn.0048f5a9
mov edi, eax
test edi, edi
js 0x48f186
mov dword [ebp - 0x220], 1
cmp dword [ebp - 0x218], 0
je 0x48f215
mov eax, dword [ebx]
lea ecx, [ebp - 0x210]
push ecx
mov esi, dword [eax + 0x1c]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
test edi, edi
jns 0x48f1e6
mov eax, dword [section..data]
cmp eax, section..data
je 0x48f3b0
test byte [eax + 0x1c], 8
je 0x48f3b0
cmp byte [eax + 0x19], 2
jb 0x48f3b0
push edi
push 0x415228
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1a
jmp 0x48f35b
mov eax, dword [ebx]
push 2
mov esi, dword [eax + 0x68]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
cmp dword [ebp - 0x21c], 0
je 0x48f215
mov eax, dword [ebx]
push 2
mov esi, dword [eax + 0x64]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x21c]
push eax
lea edx, [ebp - 0x228]
call fcn.0048f782
test eax, eax
js 0x48f242
mov dword [ebp - 0x220], 1
mov eax, dword [ebx]
push dword [ebp - 0x228]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
mov edi, eax
test edi, edi
jns 0x48f296
mov eax, dword [section..data]
cmp eax, section..data
je 0x48f3b0
test byte [eax + 0x1c], 8
je 0x48f3b0
cmp byte [eax + 0x19], 2
jb 0x48f3b0
push edi
push 0x415308
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1b
jmp 0x48f35b
cmp dword [ebp - 0x218], 0
je 0x48f2ce
mov eax, dword [ebx]
push 4
mov esi, dword [eax + 0x68]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
cmp dword [ebp - 0x21c], 0
je 0x48f2ce
mov eax, dword [ebx]
push 4
mov esi, dword [eax + 0x64]
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x230]
push eax
push 0
push 0x415334
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x48f363
cmp dword [ebp - 0x230], 1
jne 0x48f363
cmp dword [ebp - 0x22c], eax
jbe 0x48f363
mov eax, dword [ebx]
mov esi, dword [eax + 0x58]
lea eax, [ebp - 0x210]
push eax
mov ecx, esi
call dword [0x5035f0]
mov ecx, ebx
call esi
mov edi, eax
test edi, edi
jns 0x48f3aa
mov eax, dword [section..data]
cmp eax, section..data
je 0x48f3b0
test byte [eax + 0x1c], 8
je 0x48f3b0
cmp byte [eax + 0x19], 2
jb 0x48f3b0
push edi
push 0x415258
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1c
pop ecx
call fcn.0048edb8
jmp 0x48f3b0
mov eax, dword [section..data]
cmp eax, section..data
je 0x48f39a
test byte [eax + 0x1c], 1
je 0x48f39a
cmp byte [eax + 0x19], 5
jb 0x48f39a
call fcn.0042386b
push esi
push eax
mov eax, dword [section..data]
mov edx, 0x4154b8
push dword [eax + 0x14]
push dword [eax + 0x10]
push 0x1d
pop ecx
call fcn.00421fda
cmp dword [ebp - 0x220], 0
jne 0x48f3a8
xor edi, edi
inc edi
jmp 0x48f3b0
test edi, edi
je 0x48f3c2
test ebx, ebx
je 0x48f3ca
mov eax, dword [ebx]
push ebx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x5035f0]
call esi
jmp 0x48f3ca
mov eax, dword [ebp - 0x234]
mov dword [eax], ebx
cmp dword [ebp - 0x214], 0
je 0x48f3df
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x224]
call fcn.0048c070
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004fb5e0
leave
ret