Function at 0x489260
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x21f]
push ebx
push eax
mov byte [ebp - 0x220], bl
call fcn.004a3190
add esp, 0xc
mov dword [ebp - 0x84c], 0x104
mov dword [ebp - 0x83c], ebx
cmp dword [0x4d2afc], ebx
je 0x4892d7
mov ecx, dword [0x4c6444]
mov edx, dword [0x4c6448]
mov dword [ebp - 0x838], ecx
mov dword [ebp - 0x844], edx
mov dword [0x4c6444], 0x20019
mov dword [0x4c6448], 0xf013f
mov edi, 0x4c4730
mov dword [ebp - 0x834], edi
mov edx, dword [edi]
lea eax, [ebp - 0x520]
mov ecx, eax
mov esi, 0x200
sub edx, ecx
lea ecx, [esi + 0x7ffffdfe]
test ecx, ecx
je 0x48930c
mov cl, byte [edx + eax]
cmp cl, bl
je 0x48930c
mov byte [eax], cl
inc eax
dec esi
jne 0x4892f3
jmp 0x489310
cmp esi, ebx
jne 0x489311
dec eax
lea edx, [ebp - 0x82c]
push edx
mov byte [eax], bl
mov eax, dword [0x4c6444]
push eax
push ebx
lea ecx, [ebp - 0x520]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x489475
lea edx, [ebp - 0x86c]
push edx
lea eax, [ebp - 0x864]
push eax
lea ecx, [ebp - 0x850]
push ecx
lea edx, [ebp - 0x85c]
push edx
lea eax, [ebp - 0x830]
push eax
lea ecx, [ebp - 0x854]
push ecx
lea edx, [ebp - 0x858]
push edx
lea eax, [ebp - 0x83c]
push eax
mov eax, dword [ebp - 0x82c]
push ebx
lea ecx, [ebp - 0x84c]
push ecx
lea edx, [ebp - 0x220]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp dword [ebp - 0x830], ebx
je 0x489468
xor esi, esi
xor edi, edi
nop
mov eax, 0xff
lea ecx, [ebp - 0x840]
push ecx
mov dword [ebp - 0x840], eax
mov dword [ebp - 0x848], eax
lea edx, [ebp - 0x320]
push edx
lea eax, [ebp - 0x860]
push eax
mov eax, dword [ebp - 0x82c]
push ebx
lea ecx, [ebp - 0x848]
push ecx
lea edx, [ebp - 0x118]
push edx
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ecx, edi
inc esi
inc edi
cmp ecx, dword [ebp - 0x830]
ja 0x489462
cmp eax, 0x103
je 0x489462
cmp eax, ebx
jne 0x4893a0
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4893a0
push 0x10
lea eax, [ebp - 0x118]
push eax
push str.SoftwareBillP_StudiosWinPatrolDisabled
lea ecx, [ebp - 0x14]
mov edx, 0x80000002
call fcn.0048e050
lea ecx, [ebp - 0x14]
add esp, 0xc
push ecx
call fcn.004a02f9
add esp, 4
cmp eax, ebx
jle 0x4893a0
push ebx
push eax
push 0x4b17de
push 0x4b17de
lea edx, [ebp - 0x320]
lea ecx, [ebp - 0x118]
call fcn.0048f730
add esp, 0x10
jmp 0x4893a0
mov edi, dword [ebp - 0x834]
mov edx, dword [ebp - 0x82c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 4
mov dword [ebp - 0x834], edi
cmp edi, 0x4c4754
jl 0x4892e2
cmp dword [0x4d2afc], ebx
je 0x4894a9
mov eax, dword [ebp - 0x838]
mov ecx, dword [ebp - 0x844]
mov dword [0x4c6444], eax
mov dword [0x4c6448], ecx
lea ebx, [ebp - 0x828]
call fcn.0047ea60
mov eax, 0x304
mov ecx, ebx
jmp 0x4894c0
cmp byte [ecx], 0
je 0x4894cb
inc ecx
dec eax
jne 0x4894c0
jmp 0x489510
test eax, eax
je 0x489510
mov edx, 0x304
sub edx, eax
mov ecx, 0x304
sub ecx, edx
lea eax, [ebp + edx - 0x828]
je 0x48950c
mov edi, str.Disabled
lea esi, [ecx + edx + 0x7ffffcfb]
sub edi, eax
test esi, esi
je 0x489508
mov dl, byte [edi + eax]
test dl, dl
je 0x489508
mov byte [eax], dl
inc eax
dec esi
dec ecx
jne 0x4894f4
jmp 0x48950c
test ecx, ecx
jne 0x48950d
dec eax
mov byte [eax], 0
push 1
push 0
push 0
lea edx, [ebp - 0x828]
push 0x487110
push edx
call fcn.00486f10
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004a01d6
mov esp, ebp
pop ebp
ret