Function at 0x4891e0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x86c
mov eax, dword [0x4f72bc]
xor eax, esp
mov dword [esp + 0x868], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x165]
push ebx
push eax
mov byte [esp + 0x16c], bl
call fcn.004d29c0
add esp, 0xc
mov dword [esp + 0x18], 0x104
mov dword [esp + 0x20], ebx
cmp dword [0x506e0c], ebx
je 0x489258
mov ecx, dword [0x4f8b78]
mov edx, dword [0x4f8b7c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
mov dword [0x4f8b78], 0x20019
mov dword [0x4f8b7c], 0xf013f
mov edi, 0x4f8958
mov dword [esp + 0x14], edi
mov edx, dword [edi]
lea eax, [esp + 0x368]
mov ecx, eax
mov esi, 0x200
sub edx, ecx
lea ecx, [esi + 0x7ffffdfe]
test ecx, ecx
je 0x48928c
mov cl, byte [edx + eax]
cmp cl, bl
je 0x48928c
mov byte [eax], cl
inc eax
dec esi
jne 0x489273
jmp 0x489290
cmp esi, ebx
jne 0x489291
dec eax
lea edx, [esp + 0xc]
push edx
mov byte [eax], bl
mov eax, dword [0x4f8b78]
push eax
push ebx
lea ecx, [esp + 0x374]
push ecx
push CreateStatusWindowA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4893cf
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x38]
push ecx
lea edx, [esp + 0x4c]
push edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x54]
push edx
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esp + 0x2c]
push ebx
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x188]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [esp + 0x10], ebx
je 0x4893c4
xor esi, esi
xor edi, edi
lea esp, [esp]
mov eax, 0xff
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], eax
lea edx, [esp + 0x26c]
push edx
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x74]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, edi
inc esi
inc edi
cmp ecx, dword [esp + 0x10]
ja 0x4893c0
cmp eax, 0x103
je 0x4893c0
cmp eax, ebx
jne 0x489310
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x489310
push 0x10
lea eax, [esp + 0x64]
push eax
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [esp + 0x5c]
mov edx, CreateStatusWindowA
call fcn.004bff10
lea ecx, [esp + 0x5c]
add esp, 0xc
push ecx
call fcn.004cf355
add esp, 4
cmp eax, ebx
jle 0x489310
push ebx
push eax
push 0x4e27f8
push 0x4e27f8
lea edx, [esp + 0x278]
lea ecx, [esp + 0x70]
call fcn.004c1eb0
add esp, 0x10
jmp 0x489310
mov edi, dword [esp + 0x14]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 4
mov dword [esp + 0x14], edi
cmp edi, 0x4f897c
jl 0x489261
cmp dword [0x506e0c], ebx
je 0x4893fd
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x2c]
mov dword [0x4f8b78], eax
mov dword [0x4f8b7c], ecx
lea ebx, [esp + 0x568]
call fcn.0047c6f0
mov eax, 0x304
mov ecx, ebx
cmp byte [ecx], 0
je 0x48941b
inc ecx
dec eax
jne 0x489410
jmp 0x489460
test eax, eax
je 0x489460
mov edx, 0x304
sub edx, eax
mov ecx, 0x304
sub ecx, edx
lea eax, [esp + edx + 0x568]
je 0x48945c
mov edi, 0x4ee77c
lea esi, [ecx + edx + 0x7ffffcfb]
sub edi, eax
test esi, esi
je 0x489458
mov dl, byte [edi + eax]
test dl, dl
je 0x489458
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x489444
jmp 0x48945c
test ecx, ecx
jne 0x48945d
dec eax
mov byte [eax], 0
push 1
push 0
push 0
lea edx, [esp + 0x574]
push 0x486eb0
push edx
call fcn.00486cb0
mov ecx, dword [esp + 0x888]
add esp, 0x14
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.004cf2b6
mov esp, ebp
pop ebp
ret