Function at 0x447a85
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x49f2a0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
cmp dword [0x4d7530], edi
jne 0x447c99
push ebx
push esi
lea eax, [ebp - 0x20]
push eax
push str.SoftwareSnapShot
push Ordinal_2
mov dword [0x4d7530], 1
call dword [sym.imp.ical_size__lu_MB_RegOpenKeyA]
mov esi, dword [sym.imp.ical_size__lu_MB_RegQueryValueExA]
push 8
pop ebx
lea eax, [ebp - 0x1c]
push eax
push 0x49f080
push edi
push edi
push str.DialogSettings
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
mov dword [ebp - 0x1c], ebx
cmp dword [0x4cd2e4], edi
je 0x447b05
lea eax, [ebp - 0x1c]
push eax
push 0x4d7524
push edi
push edi
push str.DialogSettingsTiny
push dword [ebp - 0x20]
call esi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x18]
push str.RecentFile_d
push eax
call fcn.00450c76
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebx*4 + 0x49efd8]
lea eax, [ebp - 0x18]
push edi
push edi
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x104
call esi
inc ebx
cmp ebx, 0xa
jb 0x447b07
xor ebx, ebx
push ebx
lea eax, [ebp - 0x18]
push str.RecentHashFile_d
push eax
call fcn.00450c76
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
push dword [ebx*4 + 0x49f000]
lea eax, [ebp - 0x18]
push edi
push edi
push eax
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x104
call esi
inc ebx
cmp ebx, 0xa
jb 0x447b3e
push 4
pop ebx
lea eax, [ebp - 0x1c]
push eax
push 0x4d638c
push edi
push edi
push str.RecentVirtualDrive
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
lea eax, [ebp - 0x1c]
push eax
push 0x4d67ac
push edi
push edi
push str.MinClusterSizeToUseByteMode
push dword [ebp - 0x20]
mov dword [0x4d67ac], 0x10001
mov dword [ebp - 0x1c], ebx
call esi
mov eax, dword [0x4d67ac]
mov dword [0x4d586c], eax
mov eax, dword [0x4cd2c0]
mov dword [0x4d5974], eax
lea eax, [ebp - 0x1c]
push eax
push 0x4d5974
push edi
push edi
push str.MaxImageSizeMB
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
cmp dword [0x4cd2d4], edi
jne 0x447bee
mov eax, dword [0x4d5974]
mov dword [0x4cd2c0], eax
xor eax, eax
cmp dword [0x4cd2a0], edi
mov dword [ebp - 0x1c], ebx
sete al
mov dword [0x4d5f6c], eax
lea eax, [ebp - 0x1c]
push eax
push 0x4d5f6c
push edi
push edi
push str.Maintenancemode
push dword [ebp - 0x20]
call esi
lea eax, [ebp - 0x1c]
push eax
push 0x49f02c
push edi
push edi
push str.GenerateHashFile
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
lea eax, [ebp - 0x1c]
push eax
push 0x4d751c
push edi
push edi
push str.BeepWhenReady
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
lea eax, [ebp - 0x1c]
push eax
push 0x4d7520
push edi
push edi
push str.CreateDirectory
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
lea eax, [ebp - 0x1c]
push eax
push 0x49f028
push edi
push edi
push str.VssOptions
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
lea eax, [ebp - 0x1c]
push eax
push 0x4d5760
push edi
push edi
push str.VssAllWriters
push dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
call esi
push dword [ebp - 0x20]
call dword [sym.imp.___total_physical_size__lu_MB_CloseHandle]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.00450b32
leave
ret