Function at 0x4476a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
push ebx
push ebp
mov ebp, dword [esp + 0x41c]
xor ebx, ebx
test byte [0x500240], 1
push esi
jne 0x4476d5
or dword [0x500240], 1
push 0x4d3df0
mov dword [0x50023c], ebx
call fcn.0049e958
add esp, 4
mov eax, dword [0x50023c]
cmp eax, ebx
je 0x4476e3
mov eax, dword [eax + 4]
jmp 0x4476e5
xor eax, eax
cmp eax, ebx
je 0x4476ec
sub eax, 2
test eax, 0xfffffffe
jne 0x4477d9
push 0x1f
call fcn.0049e995
mov esi, eax
mov dword [esi], 1
mov dword [esi + 4], 0x14
mov eax, dword [0x4de160]
mov dword [esi + 8], eax
mov ecx, dword [0x4de164]
mov dword [esi + 0xc], ecx
mov edx, dword [0x4de168]
mov dword [esi + 0x10], edx
mov eax, dword [0x4de16c]
mov dword [esi + 0x14], eax
mov ecx, dword [0x4de170]
mov dword [esi + 0x18], ecx
mov eax, dword [0x50023c]
add esp, 4
cmp eax, ebx
je 0x44775c
push edi
push eax
mov edi, eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x44775b
push edi
call fcn.0049e96f
add esp, 4
pop edi
lea edx, [esp + 0xc]
push edx
push 8
mov dword [0x50023c], esi
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4477d9
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push 0x400
lea ecx, [esp + 0x20]
push ecx
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4477ce
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x10]
push eax
push ecx
mov dword [esp + 0x18], ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x4477ce
mov esi, dword [esp + 0x10]
mov eax, 0x50023c
call fcn.00490590
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [0x500234], bx
jne 0x44786c
lea ecx, [esp + 0x14]
push ecx
push 1
push ebx
push 0x4e6238
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44784f
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x10]
push eax
push ebx
push ebx
push str.Current
push ecx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x44784f
push eax
push str._03d
push 0x500234
mov edx, 4
call fcn.0044d670
add esp, 0xc
cmp word [0x500234], bx
jne 0x44786c
push 0x4e6270
push 4
push 0x500234
call fcn.0049ee55
add esp, 0xc
cmp word [ebp], 0xa
jbe 0x447abd
mov esi, dword [esp + 0x41c]
push 0xa
push 0x4e6274
push esi
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x447abd
cmp word [ebp], 0x11
jb 0x44799b
push 7
lea edx, [esi + 0x14]
push str.MACHINE
push edx
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x44799b
cmp word [ebp], 0x44
jb 0x4478f5
push 0x33
lea eax, [esi + 0x22]
push str.SYSTEMCURRENTCONTROLSETHARDWARE_PROFILESCURRENT
push eax
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x4478f5
push ebp
mov edx, str.HKCC
lea ebx, [eax + 0x44]
push esi
call fcn.00446ca0
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8
cmp word [ebp], 0x22
jb 0x44792e
push 0x11
lea ecx, [esi + 0x22]
push str.SOFTWARECLASSES
push ecx
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x44792e
push ebp
mov edx, str.HKCR
lea ebx, [eax + 0x22]
push esi
call fcn.00446ca0
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8
cmp word [ebp], 0x26
jb 0x44797e
push 0x12
lea edx, [esi + 0x22]
push str.SYSTEMControlSet
push edx
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x44797e
push 3
lea eax, [esi + 0x46]
push 0x500234
push eax
call fcn.004a0f54
add esp, 0xc
test eax, eax
jne 0x44797e
push ebp
mov edx, str.HKLMSystemCurrentControlSet
lea ebx, [eax + 0x26]
push esi
call fcn.00446ca0
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8
push ebp
mov edx, str.HKLM
mov ebx, 0x11
push esi
call fcn.00446ca0
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8
cmp word [ebp], 0xe
jb 0x447abd
push 4
lea ecx, [esi + 0x14]
push str.USER
push ecx
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x447abd
mov ecx, dword [0x50023c]
cmp ecx, ebx
je 0x4479d0
mov eax, dword [ecx + 4]
jmp 0x4479d2
xor eax, eax
cmp eax, ebx
je 0x4479d9
sub eax, 2
movzx edx, word [ebp]
shr eax, 1
add eax, 0xf
cmp edx, eax
jb 0x447aac
cmp word [esi + 0x1c], 0x5c
jne 0x447aac
cmp ecx, ebx
je 0x447a02
lea eax, [ecx + 8]
mov ecx, eax
cmp eax, ebx
jne 0x447a07
mov ecx, 0x4d9064
mov eax, 0x50023c
call fcn.00490570
push eax
push ecx
lea eax, [esi + 0x1e]
push eax
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x447aac
mov eax, 0x50023c
call fcn.00490570
movzx ecx, word [ebp]
add eax, 0x17
cmp ecx, eax
jb 0x447a85
push 8
push str._CLASSES
mov eax, 0x50023c
call fcn.00490570
lea edx, [esi + eax*2 + 0x1e]
push edx
call fcn.004a04a5
add esp, 0xc
test eax, eax
jne 0x447a85
mov eax, 0x50023c
call fcn.00490570
mov ebx, eax
push ebp
add ebx, 0x17
mov edx, str.HKCUSoftwareClasses
push esi
call fcn.00446ca0
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8
mov eax, 0x50023c
call fcn.00490570
mov ebx, eax
push ebp
add ebx, 0xf
mov edx, str.HKCU
push esi
call fcn.00446ca0
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8
push ebp
mov edx, 0x4e0b44
mov ebx, 0xe
push esi
call fcn.00446ca0
pop esi
pop ebp
pop ebx
add esp, 0x40c
ret 8