Function at 0x472a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x565bdf
mov eax, dword fs:[0]
push eax
sub esp, 0xc8
mov eax, dword [0x5b3680]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
push 8
mov dword [ebp - 0xac], eax
call fcn.00529b2d
mov ebx, eax
mov dword [ebp - 0xb0], eax
add esp, 4
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 4], 0
test ebx, ebx
je 0x472ab9
mov dword [ebx], reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebx + 4], 0
jmp 0x472ac1
xor ebx, ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x472b10
push 0
lea esi, [ebx + 4]
push esi
push 0
push 3
push 0
push 0
push 0
push 0x584038
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x472b17
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
test eax, eax
je 0x472b07
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
push ebx
call fcn.005295dd
add esp, 4
xor eax, eax
jmp 0x472d6a
push 0x400
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], 0
call fcn.0041b760
mov dword [ebp - 4], 1
lea eax, [ebp - 0xa4]
push eax
push 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa4], 0
push eax
push 0
push str.servUsers
push dword [esi]
mov edi, 4
mov dword [ebp - 0xa0], 3
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x472b7b
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xa4]
test eax, eax
je 0x472d29
push eax
lea ecx, [ebp - 0x9c]
call fcn.004736a0
lea eax, [ebp - 0xa4]
mov ecx, ebx
push eax
push dword [ebp - 0x9c]
push str.servUsers
call fcn.00416520
mov ecx, dword [ebp - 0x9c]
mov edx, dword [ebp - 0xa4]
push 0
call fcn.004fb8d0
mov eax, dword [ebp - 0x9c]
add esp, 4
or esi, 0xffffffff
mov dword [ebp - 0xc0], vtable.CLockMgr_class_CMutexWrapper_.0
mov dword [ebp - 0xb8], 1
movzx eax, byte [eax]
mov dword [ebp - 0xb4], eax
mov eax, dword [0x5ba1b0]
add eax, 0x1434
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0xbc], eax
cmp dword [eax], 0
je 0x472c24
call dword [sym.imp.USER32.dll_InSendMessage]
test eax, eax
mov ecx, 0x2710
mov eax, dword [ebp - 0xa0]
cmovne esi, ecx
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
cmp esi, eax
je 0x472c59
mov edi, eax
lea esp, [esp]
mov ecx, esi
call fcn.00472e70
add esi, 0x10
cmp esi, edi
jne 0x472c40
mov ecx, dword [ebp - 0xac]
mov edi, 4
cmp dword [ebp - 0xb4], 0
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov dword [ebp - 0xa8], 0
jbe 0x472d05
mov ebx, dword [ebp - 0xac]
jmp 0x472c80
cmp edi, dword [ebp - 0xa4]
jae 0x472cff
lea ecx, [ebp - 0xd0]
call fcn.00472d90
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x9c]
movzx esi, byte [ecx + edi]
add edi, 4
mov eax, esi
shr eax, 1
push eax
lea eax, [ecx + edi]
push eax
lea ecx, [ebp - 0xd0]
call fcn.00402600
mov eax, dword [ebp - 0x9c]
add edi, esi
mov ecx, ebx
movzx eax, byte [eax + edi]
add edi, 4
mov dword [ebp - 0xc4], eax
lea eax, [ebp - 0xd0]
push eax
call fcn.00473930
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xd0]
call fcn.00472e70
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp eax, dword [ebp - 0xb4]
jb 0x472c80
mov ebx, dword [ebp - 0xb0]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xc0], vtable.CLockMgr_class_CMutexWrapper_.0
mov eax, dword [eax]
test eax, eax
je 0x472d26
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
lea esi, [ebx + 4]
mov eax, dword [esi]
test eax, eax
je 0x472d3c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esi], 0
push ebx
call fcn.005295dd
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x98]
cmp dword [ebp - 0x9c], eax
je 0x472d65
lea ecx, [ebp - 0x9c]
call fcn.0041b750
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005295e2
mov esp, ebp
pop ebp
ret 4