Function at 0x479550
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f51d0
push fcn.00556a70
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x61094c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4795a5
mov eax, dword [edi]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x479778
test dword [ebp + 0x18], 1
jne 0x4795e4
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
cmp dword [ebp + 0x1c], eax
je 0x4795d2
push dword [ebp + 8]
call fcn.00478d50
jmp 0x479778
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x479778
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x4795f7
test esi, esi
jne 0x4795f7
lea eax, [esi + 0x57]
jmp 0x479778
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
call fcn.004790c0
test esi, esi
je 0x479612
mov ecx, dword [ebp - 0x28]
mov dword [esi], ecx
test eax, eax
jne 0x479778
test edi, edi
je 0x479778
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x4796a2
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x479672
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00554680
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4796a4
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4796db
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.00560371
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x4796a4
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4796db
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4796db
test esi, esi
jne 0x4796e7
lea eax, [esi + 0xe]
jmp 0x479778
push dword [ebp - 0x24]
push 0
push esi
call fcn.00556260
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 8]
mov ecx, ebx
call fcn.004790c0
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x479761
cmp dword [ebp + 0x1c], eax
je 0x479738
mov ecx, dword [ebp - 0x28]
cmp ecx, 1
je 0x479721
cmp ecx, 7
jne 0x479738
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
push edi
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, ebx
call fcn.00479470
mov dword [ebp - 0x20], eax
jmp 0x479761
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x24]
test ecx, ecx
je 0x47975f
mov edx, dword [edi]
cmp ebx, edx
jbe 0x479752
mov eax, 0xea
mov dword [ebp - 0x20], eax
jmp 0x47975f
push ebx
push esi
call fcn.00428c80
add esp, 8
mov eax, dword [ebp - 0x20]
mov dword [edi], ebx
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x479778
push esi
call fcn.0055e8cd
mov eax, dword [ebp - 0x20]
add esp, 4
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00553daa
mov esp, ebp
pop ebp
ret 0x18