Function at 0x475b19
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x6fc914
call fcn.00458b7c
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x844], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x838], ebx
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x84c], edi
call fcn.00420940
mov dword [ebp - 4], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x830], edi
mov dword [ebp - 0x82c], edi
call fcn.0045fe1f
test al, al
je 0x475b9c
fbstp tbyte [eax + ebp*8 + 0x16326b9d]
aas
sti
add byte [ecx], dh
push es
sub byte [edx - 0x7d], dl
shr dword [0x4ed80f7], 1
mov ebx, dword [ebp - 0x838]
lea eax, [ebp - 0x834]
push eax
push 0x20119
push edi
push str.SoftWare
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x475be0
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00422b50
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.004209e0
mov eax, ebx
jmp 0x475de5
call fcn.0045fe1f
test al, al
je 0x475c0f
cmp byte [edi - 0x17f5bf0b], ah
repne scasd eax, dword es:[edi]
cmp dword [esi + 0x74ace3cd], edi
or cl, cl
cmp edx, dword [esi]
push ss
out 0x20, al
xchg edx, eax
out 0x69, al
jl 0x475bfa
stc
push edx
insb byte es:[edi], dx
mov cl, 0xd9
mov esi, dword [ebp - 0x840]
xor edi, edi
lea eax, [ebp - 0x830]
push eax
push 0x20119
push edi
push dword [ebp - 0x844]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x475c43
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x475bbd
lea eax, [ebp - 0x82c]
push eax
push 0x20119
push edi
push esi
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x475c7c
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x82c]
call esi
jmp 0x475bbd
call fcn.00460383
test al, al
je 0x475ca4
retf 0x5581
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.004ea000
add esp, 0xc
mov dword [ebp - 0x848], 0x400
lea eax, [ebp - 0x848]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.0046033e
test al, al
je 0x475d11
jle 0x475d4d
sbb al, 0xa9
fdivr qword [ebx + 0x56]
ror ch, 1
in eax, 0xcf
pushal
add edi, 0x4a53c263
push eax
lea ecx, [eax - 0x4d17a3c0]
cmpsb byte [esi], byte es:[edi]
invalid
call fcn.004603c8
test al, al
je 0x475d2d
pop edx
test byte [edi + 0x343fa4d5], al
cdq
push ebx
and bl, bh
pop eax
jp 0x475d46
ror dh, 0xe9
insb byte es:[edi], dx
jmp 0xd0fd5c9c
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x834]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x810]
push eax
call fcn.004f2ba9
pop ecx
mov dword [ebp - 0x83c], eax
call fcn.004601a0
test al, al
je 0x475d80
test eax, esi
idiv edi
call dword [eax - 0x18]
pop eax
into
pop es
add byte [ecx - 0x77], bl
test esp, eax
idiv edi
invalid
cmp edi, edx
sbb eax, 0x5a32a082
inc eax
ficom dword [esi - 0x2def134d]
out dx, al
insd dword es:[edi], dx
clc
invalid
call fcn.004600d1
test al, al
je 0x475da7
pop esi
sal dl, cl
add al, 0x5c
mov edi, dword [ebx]
out 0x60, eax
bound esi, qword [ebp + edx - 0x7139d9be]
fnsave dword [edi - 0x23]
adc al, 0x7a
add eax, 0xc341fb71
sbb al, 0x76
daa
jmp 0x475d2b
cmp dword [ebp - 0x83c], 0
mov ecx, dword [ebp - 0x838]
jne 0x475dc4
lea eax, [ebp - 0x828]
push eax
call fcn.00422b50
jmp 0x475dd0
lea eax, [ebp - 0x810]
push eax
call fcn.00420940
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.004209e0
mov eax, dword [ebp - 0x838]
call fcn.00458b37
ret