Function at 0x4a7b40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x11978
call fcn.004e7170
mov dword [ebp - 4], 0
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x804]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004a7910
add esp, 0xc
test eax, eax
je 0x4a810e
mov dword [ebp - 0xc08], 0
lea eax, [ebp - 0xc04]
push eax
push 0x5cad04
lea ecx, [ebp - 0x2978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
lea ecx, [ebp - 0x404]
push ecx
call fcn.004e6fc0
add esp, 0xc
lea edx, [ebp - 0xc08]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x404]
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a810e
mov dword [ebp - 0xc0c], 0x10
lea ecx, [ebp - 0xc0c]
push ecx
lea edx, [ebp - 0xc1c]
push edx
push 0
push 0
push 0x5cad14
lea ecx, [ebp - 0x3978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x4a8101
push 0x5cad20
lea ecx, [ebp - 0x4978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
lea ecx, [ebp - 0xc1c]
push ecx
call fcn.004e7480
add esp, 8
test eax, eax
jne 0x4a8101
mov dword [ebp - 0xd68], 0x40
lea edx, [ebp - 0xd68]
push edx
lea eax, [ebp - 0xd60]
push eax
push 0
push 0
push 0x5cad2c
lea ecx, [ebp - 0x5978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [ebp + 0xc]
mov al, byte [ebp - 0xd60]
mov byte [edx + 0x180], al
mov dword [ebp - 0xd64], 0x80
lea ecx, [ebp - 0xd64]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
push 0x5cad50
lea ecx, [ebp - 0x6978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xd64], 0x80
lea ecx, [ebp - 0xd64]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x80
push edx
push 0
push 0
push 0x5cad60
lea ecx, [ebp - 0x7978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0xd64], 0x80
lea ecx, [ebp - 0xd64]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x100
push edx
push 0
push 0
push 0x5cad74
lea ecx, [ebp - 0x8978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov eax, dword [ebp - 0xc08]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
lea ecx, [ebp - 0xc04]
push ecx
lea edx, [ebp - 0xd20]
push edx
call fcn.004e6ed0
add esp, 8
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0x804]
push edx
call fcn.004a7910
add esp, 0xc
mov dword [ebp - 0xc20], eax
cmp dword [ebp - 0xc20], 0
jne 0x4a7dcf
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x689], 1
lea ecx, [ebp - 0xc04]
push ecx
lea edx, [ebp - 0xd20]
push edx
call fcn.004a7a70
add esp, 8
mov dword [ebp - 0xc20], eax
cmp dword [ebp - 0xc20], 0
je 0x4a80fa
lea eax, [ebp - 0xc04]
push eax
push 0x5cad88
lea ecx, [ebp - 0x9978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
lea ecx, [ebp - 0x1570]
push ecx
call fcn.004e6fc0
add esp, 0xc
lea edx, [ebp - 0xd70]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x1570]
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a803e
mov dword [ebp - 0x1574], 0x100
lea ecx, [ebp - 0x1574]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x281
push edx
push 0
push 0
push 0x5cad98
lea ecx, [ebp - 0xa978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x400
lea ecx, [ebp - 0x1574]
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x181
push edx
push 0
push 0
push 0x5cada4
lea ecx, [ebp - 0xb978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x100
lea ecx, [ebp - 0x1574]
push ecx
lea edx, [ebp - 0x1974]
push edx
push 0
push 0
push 0x5cadb4
lea ecx, [ebp - 0xc978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1978], 0
lea ecx, [ebp - 0x1974]
push ecx
push 0x5cadc0
lea ecx, [ebp - 0xd978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
lea edx, [ebp - 0x1570]
push edx
call fcn.004e6fc0
add esp, 0xc
lea eax, [ebp - 0x1978]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x1570]
push ecx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4a8031
mov dword [ebp - 0x1574], 0x100
lea edx, [ebp - 0x1574]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x381
push eax
push 0
push 0
push 0x5cadf4
lea ecx, [ebp - 0xe978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov ecx, dword [ebp - 0x1978]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x100
lea edx, [ebp - 0x1574]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x481
push eax
push 0
push 0
push 0x5cae04
lea ecx, [ebp - 0xf978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov ecx, dword [ebp - 0x1978]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov dword [ebp - 0x1574], 0x100
lea edx, [ebp - 0x1574]
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x581
push eax
push 0
push 0
push 0x5cae10
lea ecx, [ebp - 0x10978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
mov ecx, dword [ebp - 0x1978]
push ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
mov edx, dword [ebp - 0x1978]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0xd70]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
push 0x400
push 0
lea ecx, [ebp - 0x1170]
push ecx
call fcn.004e6e70
add esp, 0xc
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x681], 0
mov dword [ebp - 0xd6c], 0
push 0x5cae20
lea ecx, [ebp - 0x11978]
call fcn.00497e20
mov ecx, eax
call fcn.00497e50
push eax
lea eax, [ebp - 0x1170]
push eax
call fcn.004e7480
add esp, 8
test eax, eax
je 0x4a80fa
lea ecx, [ebp - 0xc04]
push ecx
lea edx, [ebp - 0x1170]
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.004a7910
add esp, 0xc
test eax, eax
je 0x4a80ce
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0x681]
add edx, 1
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x681], edx
jmp 0x4a80d0
jmp 0x4a80fa
lea ecx, [ebp - 0x1170]
push ecx
lea edx, [ebp - 0x804]
push edx
call fcn.004e6ed0
add esp, 8
mov eax, dword [ebp - 0xd6c]
add eax, 1
mov dword [ebp - 0xd6c], eax
jmp 0x4a806b
mov dword [ebp - 4], 1
mov ecx, dword [ebp - 0xc08]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret