Function at 0x404d30
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xc2c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xc48]
xor ebx, ebx
mov dword [esp + 0x10], ebx
cmp edi, ebx
jne 0x404d58
mov eax, dword [esp + 0xc40]
mov dword [esp + 0x10], eax
jmp 0x404dac
push 0x104
lea ecx, [esp + 0x238]
push edi
push ecx
call fcn.004316e2
lea edx, [esp + 0x240]
push edx
call fcn.004043c0
lea eax, [esp + 0x20]
add esp, 0x10
push eax
call fcn.004020a0
mov edx, dword [esp + 0xc44]
or eax, 0x20019
push eax
push ebx
lea ecx, [esp + 0x240]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x404fbf
push 0x18
call fcn.004318ee
mov ebp, eax
add esp, 4
mov dword [ebp], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
cmp edi, ebx
jne 0x404dcf
xor eax, eax
jmp 0x404dd8
push edi
call fcn.0044b978
add esp, 4
mov dword [ebp + 0x14], eax
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x440]
push ecx
mov ecx, dword [esp + 0x18]
push ebx
push ebx
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x40]
push eax
push ebx
push ecx
xor edi, edi
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x38], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, 0x103
je 0x404ee6
cmp esi, ebx
jne 0x404fb8
mov ecx, str.DYNAMORIO_HOT_PATCH_MODES
lea eax, [esp + 0x2c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x404e57
cmp dx, bx
je 0x404e53
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x404e57
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x404e31
xor eax, eax
jmp 0x404e5c
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x404e8c
xor edx, edx
cmp edx, fcn.00404b60
je 0x404e8c
lea eax, [esp + 0x43c]
push eax
lea ecx, [esp + 0x30]
push ecx
push ebp
call fcn.00404b60
mov esi, eax
add esp, 0xc
cmp esi, ebx
jne 0x404fb8
jmp 0x404ea2
lea edx, [esp + 0x43c]
push edx
lea eax, [esp + 0x30]
push eax
push ebp
call fcn.00404770
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x440]
push edx
mov edx, dword [esp + 0x18]
push ebx
push ebx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
push ecx
inc edi
push edi
push edx
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x38], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov esi, eax
cmp esi, 0x103
jne 0x404e20
xor esi, esi
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0xc4c], ebx
je 0x404faf
lea esp, [esp]
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x20]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
lea edx, [esp + 0x40]
push edx
push eax
push ecx
mov dword [esp + 0x34], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp esi, 0x103
je 0x404fad
cmp esi, ebx
jne 0x404fb8
mov edx, dword [esp + 0xc4c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x28]
push ecx
push edx
call fcn.00404d30
add esp, 0x10
cmp eax, ebx
jne 0x404fd4
mov esi, dword [ebp + 4]
mov edi, dword [esp + 0x20]
mov ebx, dword [edi + 0x14]
test esi, esi
je 0x404f87
lea ecx, [ecx]
mov eax, dword [esi + 0x14]
push eax
push ebx
call fcn.00434256
add esp, 8
test eax, eax
je 0x404f87
mov esi, dword [esi]
test esi, esi
jne 0x404f70
cmp dword [ebp + 4], 0
jne 0x404f90
mov dword [ebp + 4], edi
mov eax, dword [ebp + 8]
test eax, eax
je 0x404f99
mov dword [eax], edi
inc dword [esp + 0x1c]
mov dword [ebp + 8], edi
mov dword [edi], 0
xor ebx, ebx
jmp 0x404f00
xor esi, esi
mov ecx, dword [esp + 0xc44]
mov dword [ecx], ebp
mov edi, dword [esp + 0xc48]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x404fd2
cmp edi, ebx
je 0x404fd2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc2c
ret