Function at 0x47f840
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55d616
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x2f8], edi
push ecx
mov ecx, dword [edi + 4]
xor dl, dl
xor ebx, ebx
call fcn.00518450
mov esi, eax
add esp, 4
mov dword [ebp - 0x2f4], esi
test esi, esi
je 0x47f954
sub esp, 8
lea edx, [ebp - 0xdc]
xor eax, eax
mov ecx, esi
mov word [ebp - 0xdc], ax
call fcn.00518390
mov ecx, dword [esi + 4]
lea eax, [ebp - 0x2e4]
push 0x20019
push eax
lea edx, [ebp - 0xdc]
call fcn.00518680
add esp, 0x10
test al, al
je 0x47f94d
cmp byte [edi + 8], bl
je 0x47f8df
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea ecx, [edi + 0x24]
mov dword [ebp - 0x2f0], ecx
call fcn.004804c0
push str.Messages
lea eax, [ebp - 0x2dc]
push 0x100
push eax
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
mov ecx, dword [ebp - 0x2e4]
lea eax, [ebp - 0x2e8]
add esp, 0xc
lea edx, [ebp - 0x2dc]
push 0x20019
push eax
call fcn.00518680
add esp, 8
test al, al
jne 0x47f95b
cmp byte [edi + 8], bl
je 0x47f93a
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x2e4]
call dword [0x5c00ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, esi
call fcn.00518070
xor al, al
jmp 0x47faa9
mov edi, dword [ebp - 0x2f0]
mov byte [ebp - 0x2dd], bl
push 0xe
lea eax, [ebp - 0x30]
push eax
push ebx
push dword [ebp - 0x2e8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
jne 0x47fa5b
push 5
lea eax, [ebp - 0x30]
inc ebx
push str.Node_
push eax
call dword [sym.imp.MSVCR120.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x47fa4e
mov ecx, dword [ebp - 0x2e8]
lea eax, [ebp - 0x2ec]
push 0x20019
push eax
lea edx, [ebp - 0x30]
call fcn.00518680
add esp, 8
test al, al
je 0x47fa4e
lea ecx, [ebp - 0x324]
call fcn.00495a10
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x324]
push dword [ebp - 0x2ec]
call fcn.00509550
test al, al
je 0x47fa29
mov eax, dword [edi]
lea ecx, [ebp - 0x2de]
push ecx
lea ecx, [ebp - 0x324]
push ecx
mov ecx, edi
call dword [eax + 8]
cmp byte [ebp - 0x2de], 0
jne 0x47fa29
push ecx
lea ecx, [ebp - 0x324]
push ecx
push eax
mov ecx, edi
call fcn.00480500
test eax, eax
jne 0x47fa29
mov byte [ebp - 0x2dd], 1
push dword [ebp - 0x2ec]
call dword [0x5c00ac]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x324]
call fcn.00509110
cmp byte [ebp - 0x2dd], 0
je 0x47f967
mov edi, dword [ebp - 0x2f8]
cmp byte [edi + 8], 0
je 0x47fa71
lea eax, [edi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x2e8]
mov esi, dword [0x5c00ac]
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push eax
call ebx
push dword [ebp - 0x2e4]
call esi
push eax
call ebx
mov ecx, dword [ebp - 0x2f4]
call fcn.00518070
xor eax, eax
cmp byte [ebp - 0x2dd], al
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret 4