Function at 0x499500
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x58b959
mov eax, dword fs:[0]
push eax
sub esp, 0x5bc
mov eax, dword [0x5ea2c4]
xor eax, esp
mov dword [esp + 0x5b8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5ea2c4]
xor eax, esp
push eax
lea eax, [esp + 0x5d0]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov word [esp + 0x44], ax
mov edi, 7
mov eax, edx
mov dword [esp + 0x58], edi
mov dword [esp + 0x54], ebx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x499556
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x48]
call fcn.00406150
lea ecx, [esp + 0x104]
push ecx
mov ecx, esi
mov dword [esp + 0x5dc], ebx
call fcn.004924e0
add esp, 4
mov byte [esp + 0x5d8], 2
cmp dword [esp + 0x58], 8
jb 0x4995a5
mov edx, dword [esp + 0x44]
push edx
call fcn.005273b8
add esp, 4
lea ecx, [esp + 0x14]
xor eax, eax
push ecx
lea edx, [esp + 0x140]
push edx
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
mov word [esp + 0x4c], ax
mov byte [esp + 0x1c], 1
mov byte [esp + 0x1d], al
call fcn.004a26e0
and dword [esp + 0x34], 0xfffffe00
mov dword [esp + 0x38], ebx
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x10c]
push eax
lea ecx, [esp + 0x188]
mov byte [esp + 0x5e4], 5
call fcn.00405870
mov eax, dword [esp + 0x180]
mov esi, 0x10
cmp dword [esp + 0x194], esi
jae 0x499616
lea eax, [esp + 0x180]
mov ecx, dword [esp + 0x190]
lea edx, [esp + 0x2c]
push edx
add ecx, eax
push ecx
push eax
lea eax, [esp + 0x148]
push eax
call fcn.004a27e0
test al, al
jne 0x49966e
lea eax, [esp + 0x2c]
mov byte [esp + 0x5d8], 3
call fcn.004a6000
lea edi, [esp + 0x13c]
call fcn.0047f4e0
cmp dword [esp + 0x11c], esi
jb 0x49a09c
mov ecx, dword [esp + 0x108]
push ecx
jmp 0x49a094
mov al, byte [esp + 0x34]
test al, al
je 0x49a066
cmp al, 6
jne 0x49a066
xor ebp, ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], ebp
call fcn.004a6510
test eax, eax
jbe 0x499f26
lea esp, [esp]
push ebp
lea edx, [esp + 0x30]
push edx
call fcn.004a65b0
push str.subject
push eax
call fcn.004a6850
mov edi, eax
push ebp
lea eax, [esp + 0x30]
push eax
call fcn.004a65b0
push str.data
push eax
call fcn.004a6850
mov ecx, eax
mov al, byte [edi + 8]
mov dword [esp + 0x20], ecx
test al, al
je 0x499f0b
cmp al, 4
jne 0x499f0b
mov al, byte [ecx + 8]
test al, al
je 0x499f0b
cmp al, 6
jne 0x499f0b
lea esi, [esp + 0xe8]
mov ecx, edi
call fcn.004a6160
mov ecx, esi
push ecx
mov edx, 0x5d223c
mov byte [esp + 0x5dc], 6
call fcn.0048be20
mov edi, eax
cmp edi, 0xffffffff
jne 0x499738
mov ecx, esi
mov byte [esp + 0x5d8], 5
call fcn.004062d0
jmp 0x499f0b
push edi
xor ecx, ecx
lea esi, [esp + 0xd0]
lea edx, [esp + 0xec]
mov dword [esp + 0x20], ebx
call fcn.00403830
mov byte [esp + 0x5d8], 7
mov edx, dword [esp + 0xfc]
sub edx, edi
dec edx
push edx
lea ecx, [edi + 1]
lea esi, [esp + 0x124]
lea edx, [esp + 0xec]
call fcn.00403830
mov byte [esp + 0x5d8], 8
mov esi, dword [esp + 0xe0]
mov eax, esi
cmp esi, 0x11
jb 0x499796
mov eax, 0x11
mov edi, dword [esp + 0xe4]
mov ebp, dword [esp + 0xd0]
mov edx, ebp
cmp edi, 0x10
jae 0x4997b2
lea edx, [esp + 0xd0]
push eax
mov ecx, str.HKEY_CLASSES_ROOT
call fcn.004056f0
add esp, 4
cmp eax, ebx
jne 0x4997d9
cmp esi, 0x11
jb 0x4997de
xor eax, eax
cmp esi, 0x11
setne al
cmp eax, ebx
je 0x49987b
cmp esi, 0x11
jae 0x4997e2
mov eax, esi
jmp 0x4997e7
mov eax, 0x11
mov edx, ebp
cmp edi, 0x10
jae 0x4997f5
lea edx, [esp + 0xd0]
push eax
mov ecx, str.HKEY_CURRENT_USER
call fcn.004056f0
add esp, 4
cmp eax, ebx
jne 0x499818
cmp esi, 0x11
jb 0x499818
xor eax, eax
cmp esi, 0x11
setne al
cmp eax, ebx
je 0x49987b
mov eax, esi
cmp esi, 0x12
jb 0x499824
mov eax, 0x12
mov edx, ebp
cmp edi, 0x10
jae 0x499832
lea edx, [esp + 0xd0]
push eax
mov ecx, str.HKEY_LOCAL_MACHINE
call fcn.004056f0
add esp, 4
cmp eax, ebx
jne 0x499855
cmp esi, 0x12
jb 0x499855
xor eax, eax
cmp esi, 0x12
setne al
cmp eax, ebx
je 0x49987b
cmp esi, 0xa
jb 0x49985f
mov esi, 0xa
mov edx, ebp
cmp edi, 0x10
jae 0x49986d
lea edx, [esp + 0xd0]
push esi
mov ecx, str.HKEY_USERS
call fcn.004056f0
add esp, 4
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x124]
call fcn.004923c0
add esp, 4
cmp dword [eax + 0x18], 8
jb 0x49989a
mov eax, dword [eax + 4]
jmp 0x49989d
add eax, 4
lea ecx, [esp + 0x1c]
push ecx
push 0x109
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x40]
mov esi, eax
call fcn.00406300
cmp esi, ebx
je 0x4998f4
lea ecx, [esp + 0x120]
call fcn.004062d0
lea ecx, [esp + 0xcc]
call fcn.004062d0
lea ecx, [esp + 0xe8]
mov byte [esp + 0x5d8], 5
call fcn.004062d0
jmp 0x499f07
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
call fcn.004a6510
test eax, eax
jbe 0x499ebb
lea ecx, [ecx]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push edx
call fcn.004a67d0
mov esi, eax
cmp byte [esi + 8], 0
je 0x499ebb
call fcn.004a6ab0
test al, al
je 0x499ebb
push 0x5d2f98
mov eax, esi
call fcn.004a6a10
mov edi, eax
push str.type
mov eax, esi
call fcn.004a6a10
mov ebp, eax
push str.value
mov eax, esi
call fcn.004a6a10
mov ebx, eax
mov al, byte [edi + 8]
test al, al
je 0x499ebb
cmp al, 4
jne 0x499ebb
mov al, byte [ebp + 8]
test al, al
je 0x49997f
cmp al, 4
je 0x49998e
mov al, byte [ebx + 8]
test al, al
je 0x49998e
cmp al, 4
je 0x499ebb
lea esi, [esp + 0x40]
mov ecx, edi
call fcn.004a6160
lea ecx, [esp + 0x94]
push ecx
mov ecx, eax
mov byte [esp + 0x5dc], 9
call fcn.004923c0
add esp, 4
mov ecx, esi
mov byte [esp + 0x5d8], 0xb
call fcn.004062d0
mov al, byte [ebp + 8]
test al, al
je 0x4999d8
cmp al, 4
jne 0x4999d8
mov al, byte [ebx + 8]
test al, al
je 0x4999d8
cmp al, 4
je 0x499a10
cmp dword [esp + 0xac], 8
mov eax, dword [esp + 0x98]
jae 0x4999f0
lea eax, [esp + 0x98]
mov edx, dword [esp + 0x1c]
push 0
push 0
push 0
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x499eaf
inc dword [esp + 0x18]
lea esi, [esp + 0x78]
mov ecx, ebp
mov dword [esp + 0x14], 0
call fcn.004a6160
mov byte [esp + 0x5d8], 0xc
mov esi, dword [esp + 0x8c]
mov eax, esi
cmp esi, 6
jb 0x499a3e
mov eax, 6
mov edi, dword [esp + 0x90]
mov ebp, dword [esp + 0x7c]
mov edx, ebp
cmp edi, 0x10
jae 0x499a54
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_SZ
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499a82
cmp esi, 6
jb 0x499a82
cmp esi, 6
setne al
test eax, eax
jne 0x499a82
mov dword [esp + 0x14], 1
jmp 0x499da9
mov eax, esi
cmp esi, 0xd
jb 0x499a8e
mov eax, 0xd
mov edx, ebp
cmp edi, 0x10
jae 0x499a99
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_EXPAND_SZ
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499ac7
cmp esi, 0xd
jb 0x499ac7
cmp esi, 0xd
setne al
test eax, eax
jne 0x499ac7
mov dword [esp + 0x14], 2
jmp 0x499da9
mov eax, esi
cmp esi, 0xa
jb 0x499ad3
mov eax, 0xa
mov edx, ebp
cmp edi, 0x10
jae 0x499ade
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_BINARY
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499b0c
cmp esi, 0xa
jb 0x499b0c
cmp esi, 0xa
setne al
test eax, eax
jne 0x499b0c
mov dword [esp + 0x14], 3
jmp 0x499da9
mov eax, esi
cmp esi, 9
jb 0x499b18
mov eax, 9
mov edx, ebp
cmp edi, 0x10
jae 0x499b23
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_DWORD
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499b51
cmp esi, 9
jb 0x499b51
cmp esi, 9
setne al
test eax, eax
jne 0x499b51
mov dword [esp + 0x14], 4
jmp 0x499da9
mov eax, esi
cmp esi, 0x17
jb 0x499b5d
mov eax, 0x17
mov edx, ebp
cmp edi, 0x10
jae 0x499b68
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_DWORD_LITTLE_ENDIAN
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499b96
cmp esi, 0x17
jb 0x499b96
cmp esi, 0x17
setne al
test eax, eax
jne 0x499b96
mov dword [esp + 0x14], 4
jmp 0x499da9
mov eax, esi
cmp esi, 0x14
jb 0x499ba2
mov eax, 0x14
mov edx, ebp
cmp edi, 0x10
jae 0x499bad
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_DWORD_BIG_ENDIAN
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499bdb
cmp esi, 0x14
jb 0x499bdb
cmp esi, 0x14
setne al
test eax, eax
jne 0x499bdb
mov dword [esp + 0x14], 5
jmp 0x499da9
mov eax, esi
cmp esi, 8
jb 0x499be7
mov eax, 8
mov edx, ebp
cmp edi, 0x10
jae 0x499bf2
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_LINK
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499c20
cmp esi, 8
jb 0x499c20
cmp esi, 8
setne al
test eax, eax
jne 0x499c20
mov dword [esp + 0x14], 6
jmp 0x499da9
mov eax, esi
cmp esi, 0xc
jb 0x499c2c
mov eax, 0xc
mov edx, ebp
cmp edi, 0x10
jae 0x499c37
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_MULTI_SZ
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499c65
cmp esi, 0xc
jb 0x499c65
cmp esi, 0xc
setne al
test eax, eax
jne 0x499c65
mov dword [esp + 0x14], 7
jmp 0x499da9
mov eax, esi
cmp esi, 0x11
jb 0x499c71
mov eax, 0x11
mov edx, ebp
cmp edi, 0x10
jae 0x499c7c
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_RESOURCE_LIST
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499caa
cmp esi, 0x11
jb 0x499caa
cmp esi, 0x11
setne al
test eax, eax
jne 0x499caa
mov dword [esp + 0x14], 8
jmp 0x499da9
mov eax, esi
cmp esi, 0x1c
jb 0x499cb6
mov eax, 0x1c
mov edx, ebp
cmp edi, 0x10
jae 0x499cc1
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_FULL_RESOURCE_DESCRIPTOR
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499cef
cmp esi, 0x1c
jb 0x499cef
cmp esi, 0x1c
setne al
test eax, eax
jne 0x499cef
mov dword [esp + 0x14], 9
jmp 0x499da9
mov eax, esi
cmp esi, 0x1e
jb 0x499cfb
mov eax, 0x1e
mov edx, ebp
cmp edi, 0x10
jae 0x499d06
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_RESOURCE_REQUIREMENTS_LIST
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499d31
cmp esi, 0x1e
jb 0x499d31
cmp esi, 0x1e
setne al
test eax, eax
jne 0x499d31
mov dword [esp + 0x14], 0xa
jmp 0x499da9
mov eax, esi
cmp esi, 9
jb 0x499d3d
mov eax, 9
mov edx, ebp
cmp edi, 0x10
jae 0x499d48
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_QWORD
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499d69
cmp esi, 9
jb 0x499d69
cmp esi, 9
setne al
test eax, eax
je 0x499da1
mov eax, esi
cmp esi, 0x17
jb 0x499d75
mov eax, 0x17
mov edx, ebp
cmp edi, 0x10
jae 0x499d80
lea edx, [esp + 0x7c]
push eax
mov ecx, str.REG_QWORD_LITTLE_ENDIAN
call fcn.004056f0
add esp, 4
test eax, eax
jne 0x499da9
cmp esi, 0x17
jb 0x499da9
cmp esi, 0x17
setne al
test eax, eax
jne 0x499da9
mov dword [esp + 0x14], 0xb
xor eax, eax
push 0x3fe
push eax
lea ecx, [esp + 0x1d6]
push ecx
mov word [esp + 0x1d8], ax
call fcn.0052e300
add esp, 0xc
lea esi, [esp + 0x5c]
mov ecx, ebx
mov dword [esp + 0x3c], 0x200
call fcn.004a6160
lea edx, [esp + 0xb0]
push edx
mov ecx, eax
mov byte [esp + 0x5dc], 0xd
call fcn.004923c0
add esp, 4
mov ecx, esi
call fcn.004062d0
mov eax, dword [esp + 0x14]
cmp eax, 2
je 0x499f5d
cmp eax, 1
je 0x499f5d
cmp eax, 7
je 0x499f5d
cmp eax, 4
je 0x499e26
cmp eax, 3
jne 0x499e9a
mov eax, dword [esp + 0x98]
mov edi, 8
cmp dword [esp + 0xac], edi
jae 0x499e42
lea eax, [esp + 0x98]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1d0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x499fd1
movsx esi, word [esp + 0x1cc]
mov eax, dword [esp + 0xb4]
cmp dword [esp + 0xc8], edi
jae 0x499e89
lea eax, [esp + 0xb4]
push eax
call fcn.00527f79
add esp, 4
cmp eax, esi
je 0x499fcd
lea ecx, [esp + 0xb0]
call fcn.00406300
lea ecx, [esp + 0x78]
call fcn.004062d0
lea ecx, [esp + 0x94]
call fcn.00406300
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x20]
call fcn.004a6510
lea ecx, [esp + 0x120]
cmp eax, dword [esp + 0x18]
je 0x49a019
call fcn.004062d0
lea ecx, [esp + 0xcc]
call fcn.004062d0
lea ecx, [esp + 0xe8]
mov byte [esp + 0x5d8], 5
call fcn.004062d0
xor ebx, ebx
mov ebp, dword [esp + 0x28]
inc ebp
lea ecx, [esp + 0x2c]
mov dword [esp + 0x28], ebp
call fcn.004a6510
cmp ebp, eax
jb 0x4996a0
mov esi, 0x10
lea eax, [esp + 0x2c]
mov byte [esp + 0x5d8], 3
call fcn.004a6000
lea edi, [esp + 0x13c]
call fcn.0047f4e0
cmp dword [esp + 0x11c], esi
jb 0x49a09c
mov edx, dword [esp + 0x108]
push edx
jmp 0x49a094
mov eax, dword [esp + 0x98]
mov esi, 8
cmp dword [esp + 0xac], esi
jae 0x499f79
lea eax, [esp + 0x98]
lea ecx, [esp + 0x3c]
push ecx
lea edx, [esp + 0x1d0]
push edx
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
push ecx
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x499fd1
mov eax, dword [esp + 0xb4]
cmp dword [esp + 0xc8], esi
jae 0x499fb4
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x1d0]
push eax
call fcn.00527ed8
add esp, 8
test eax, eax
je 0x499e9a
inc dword [esp + 0x18]
lea ecx, [esp + 0xb0]
call fcn.00406300
lea ecx, [esp + 0x78]
call fcn.004062d0
lea ecx, [esp + 0x94]
mov byte [esp + 0x5d8], 8
call fcn.00406300
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
inc esi
mov dword [esp + 0x24], esi
call fcn.004a6510
cmp esi, eax
jb 0x499910
jmp 0x499ebb
call fcn.004062d0
lea ecx, [esp + 0xcc]
call fcn.004062d0
lea ecx, [esp + 0xe8]
call fcn.004062d0
lea eax, [esp + 0x2c]
mov byte [esp + 0x5d8], 3
call fcn.004a6000
lea edi, [esp + 0x13c]
call fcn.0047f4e0
lea ecx, [esp + 0x104]
call fcn.004062d0
mov eax, 1
jmp 0x49a09e
lea eax, [esp + 0x2c]
mov byte [esp + 0x5d8], 3
call fcn.004a6000
lea edi, [esp + 0x13c]
call fcn.0047f4e0
cmp dword [esp + 0x11c], esi
jb 0x49a09c
mov eax, dword [esp + 0x108]
push eax
call fcn.005273b8
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x5d0]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x5b8]
xor ecx, esp
call fcn.005273c3
add esp, 0x5c8
ret