Function at 0x4478e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x158
mov eax, dword [0x481630]
xor eax, ebp
mov dword [esp + 0x154], eax
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
cmp edx, eax
push edi
mov edi, dword [ebp + 0xc]
mov dword [esp + 0x14], edx
je 0x447ad3
cmp esi, eax
je 0x447ad3
cmp ecx, eax
je 0x4479bd
mov byte [esp + 0x18], al
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push edx
stosb byte es:[edi], al
lea eax, [esp + 0x1c]
push str.SOFTWARERising_s
push eax
mov dword [esp + 0x20], 1
call dword [0x4713e8]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
lea edx, [esp + 0x24]
push edx
push 0x80000002
call dword [0x47103c]
test eax, eax
jne 0x4479a2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
push esi
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.installpath
push edx
mov dword [esp + 0x24], ebx
call dword [0x471038]
mov eax, dword [esp + 0x10]
push eax
call dword [0x471040]
push esi
call dword [0x471314]
pop edi
pop ebx
mov ecx, dword [esp + 0x154]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
push str.Shell32.dll
call dword [0x471334]
test eax, eax
mov dword [esp + 0x10], eax
je 0x447b77
push str.SHGetFolderPathA
push eax
call dword [0x471338]
test eax, eax
mov dword [esp + 0xc], eax
jne 0x447a22
mov ecx, dword [esp + 0x10]
push ecx
call dword [0x471330]
push str.SHFolder.dll
call dword [0x471334]
test eax, eax
mov dword [esp + 0x10], eax
je 0x447a16
push str.SHGetFolderPathA
push eax
call dword [0x471338]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
test eax, eax
je 0x447b68
push esi
neg edi
sbb edi, edi
push 1
push 0
and edi, 7
add edi, 0x1c
push edi
push 0
call eax
test eax, eax
jl 0x447b68
push esi
call dword [0x471314]
test eax, eax
jle 0x447b68
mov eax, esi
mov dword [esp + 0xc], 1
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447a60
sub eax, edi
mov edx, ebx
sub edx, eax
dec edx
push edx
push str.Rising
push esi
call fcn.0045914f
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push esi
call dword [0x471258]
mov edi, eax
cmp edi, 0xffffffff
mov al, byte [esp + 0x18]
je 0x447a98
test al, 0x10
jne 0x447ab0
test al, 0x10
jne 0x447aa3
push esi
call dword [0x4712dc]
push 0
push esi
call dword [0x471120]
mov dword [esp + 0xc], eax
cmp edi, 0xffffffff
je 0x447abc
push edi
call dword [0x471268]
mov eax, dword [esp + 0xc]
test eax, eax
jne 0x447ae9
mov eax, dword [esp + 0x10]
test eax, eax
je 0x447ad3
push eax
call dword [0x471330]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [esp + 0x154]
xor ecx, ebp
call fcn.0045856e
mov esp, ebp
pop ebp
ret
mov eax, esi
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447af0
sub eax, edx
mov ecx, ebx
sub ecx, eax
dec ecx
push ecx
push 0x4718c4
push esi
call fcn.0045914f
mov eax, esi
add esp, 0xc
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x447b12
mov edx, dword [esp + 0x14]
sub eax, edi
sub ebx, eax
dec ebx
push ebx
push edx
push esi
call fcn.0045914f
add esp, 0xc
lea eax, [esp + 0x18]
push eax
push esi
call dword [0x471258]
mov edi, eax
cmp edi, 0xffffffff
mov al, byte [esp + 0x18]
je 0x447b48
test al, 0x10
jne 0x447b5c
test al, 0x10
jne 0x447b53
push esi
call dword [0x4712dc]
push 0
push esi
call dword [0x471120]
cmp edi, 0xffffffff
je 0x447b68
push edi
call dword [0x471268]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x447b77
push eax
call dword [0x471330]
push esi
call dword [0x471314]
mov ecx, dword [esp + 0x15c]
pop edi
xor ecx, ebp
pop ebx
call fcn.0045856e
mov esp, ebp
pop ebp
ret