Function at 0x4f0a10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x539c37
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x59a0a0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x23c], edi
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
push 0x208
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], ebx
push ebx
push eax
call fcn.0049e130
add esp, 0xc
call fcn.00401980
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4f0a99
push 0x80004005
call fcn.00401b40
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f0aae
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4f0ab0
call edx
add eax, 0x10
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 1
call fcn.00401980
mov ecx, eax
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x4f0ad9
push 0x80004005
call fcn.00401b40
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f0aee
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
jmp 0x4f0af0
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x230], esi
mov byte [ebp - 4], 2
mov dword [edi + 0x24], 0x65
mov dword [edi + 0x28], 0xc9
mov dword [edi + 0x2c], 0x12d
mov dword [edi + 0x34], 0x191
mov dword [edi + 0x3c], 0x15f
mov dword [edi + 0x30], 0x259
mov dword [edi + 0x38], 0x1f5
mov dword [edi + 0x40], 0x385
mov dword [edi + 0xe0], 0x508e10
mov dword [edi + 0xe4], 0
mov edx, dword [0x59fb98]
mov dword [ebp - 0x228], 0x562544
mov dword [ebp - 0x224], 0x5625b0
mov dword [ebp - 0x220], 0x562580
mov eax, dword [edx - 0xc]
test eax, eax
jne 0x4f0b7d
push 5
push 0x5625fc
jmp 0x4f0be7
lea ecx, [edx - 0x10]
lea edi, [esi - 0x10]
cmp ecx, edi
je 0x4f0bf8
cmp dword [edi + 0xc], 0
lea esi, [edi + 0xc]
jl 0x4f0be5
mov eax, dword [ecx]
cmp eax, dword [edi]
jne 0x4f0be2
call fcn.004021e0
mov ebx, eax
or eax, 0xffffffff
lock xadd dword [esi], eax
dec eax
test eax, eax
jg 0x4f0bd5
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f0bd3
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea esi, [ebx + 0x10]
xor ebx, ebx
mov dword [ebp - 0x230], esi
jmp 0x4f0bf8
call edx
lea esi, [ebx + 0x10]
xor ebx, ebx
mov dword [ebp - 0x230], esi
jmp 0x4f0bf8
mov eax, dword [edx - 0xc]
push eax
push edx
lea ecx, [ebp - 0x230]
call fcn.00402d50
mov esi, dword [ebp - 0x230]
mov eax, dword [0x59fb74]
push esi
cmp dword [eax - 0xc], 0
jne 0x4f0c10
push 0x5625e0
push str.SoftwareTencent_s_s
jmp 0x4f0c16
push eax
push 0x562608
lea eax, [ebp - 0x238]
push eax
call fcn.004023f0
mov edi, dword [ebp - 0x238]
lea eax, [ebp - 0x22c]
add esp, 0x10
mov dword [ebp - 0x22c], 0
push eax
push 0x2001f
push 0
push edi
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4f0db1
mov ebx, dword [ebp - 0x22c]
mov dword [ebp - 0x248], eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 0x24c], ebx
push eax
lea eax, [ebp - 0x234]
mov dword [ebp - 0x22c], 0x208
push eax
push 0
push 0x562678
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f0db1
mov eax, dword [ebp - 0x234]
cmp eax, 1
je 0x4f0cb2
cmp eax, 2
jne 0x4f0db1
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x4f0cd6
test al, 1
jne 0x4f0db1
shr eax, 1
cmp word [ebp + eax*2 - 0x21e], 0
je 0x4f0cdf
jmp 0x4f0db1
xor eax, eax
mov word [ebp - 0x21c], ax
push 3
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.00509e30
mov dword [ebp - 0x240], eax
test eax, eax
je 0x4f0db1
lea eax, [ebp - 0x22c]
mov dword [ebp - 0x22c], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x234]
push eax
push 0
push 0x562668
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4f0db1
mov eax, dword [ebp - 0x234]
cmp eax, 1
je 0x4f0d47
cmp eax, 2
jne 0x4f0db1
mov eax, dword [ebp - 0x22c]
test eax, eax
je 0x4f0d64
test al, 1
jne 0x4f0db1
shr eax, 1
cmp word [ebp + eax*2 - 0x21e], 0
je 0x4f0d6d
jmp 0x4f0db1
xor eax, eax
mov word [ebp - 0x21c], ax
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x21c]
lea eax, [edx + 2]
mov dword [ebp - 0x234], eax
lea ecx, [ecx + 0x68]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x4f0d85
sub edx, dword [ebp - 0x234]
lea eax, [ebp - 0x21c]
sar edx, 1
push edx
push eax
call fcn.00402d50
mov eax, dword [ebp - 0x23c]
mov dword [eax], 1
mov byte [ebp - 4], 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4f0de8
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f0de6
mov eax, dword [ecx + 4]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
push dword [eax + 4]
call esi
jmp 0x4f0dee
call edx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 0
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x4f0e1f
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x4f0e1d
mov eax, dword [ecx + 4]
push 0
push dword [eax + 4]
call esi
jmp 0x4f0e1f
call edx
test ebx, ebx
je 0x4f0e2a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x240]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0049aa22
mov esp, ebp
pop ebp
ret 4