Function at 0x472cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5046c6
mov eax, dword fs:[0]
push eax
sub esp, 0x454
mov eax, dword [0x5364d0]
xor eax, esp
mov dword [esp + 0x450], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5364d0]
xor eax, esp
push eax
lea eax, [esp + 0x468]
mov dword fs:[0], eax
xor ebp, ebp
mov edi, ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x28], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x470], ebp
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
lea eax, [esp + 0x24]
push eax
push 0x2001f
push ebp
mov byte [esp + 0x47c], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x510bac
push SHChangeNotifyDeregister
mov dword [esp + 0x38], ebp
call esi
cmp eax, ebp
jne 0x472dc7
mov ebx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push ecx
push 0x2001f
push ebp
push str.Recent_Document_List
push ebx
mov dword [esp + 0x40], ebp
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x2c], ebp
call esi
cmp eax, ebp
jne 0x472dbc
mov esi, dword [esp + 0x18]
lea edx, [esp + 0x38]
push edx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x1c]
push ecx
push ebp
push str.DocumentCount
push esi
mov dword [esp + 0x38], ebp
mov dword [esp + 0x34], esi
mov dword [esp + 0x48], ebp
mov dword [esp + 0x50], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
jne 0x472da1
cmp dword [esp + 0x14], 4
je 0x472dce
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x472dae
push esi
call edi
cmp ebx, ebp
je 0x472db5
push ebx
call edi
xor eax, eax
jmp 0x472f23
cmp ebx, ebp
je 0x472dc7
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x472f23
mov eax, dword [esp + 0x30]
cmp eax, 2
jge 0x472dde
mov eax, 2
jmp 0x472de8
cmp eax, 0x10
jle 0x472de8
mov eax, 0x10
mov dword [edi + 0xc], eax
mov eax, dword [edi]
cmp eax, ebp
je 0x472dfc
push eax
call fcn.004e4b2f
add esp, 4
mov dword [edi], ebp
push 0x206
lea eax, [esp + 0x262]
xor edx, edx
push ebp
push eax
mov dword [edi + 4], ebp
mov dword [edi + 8], ebp
mov word [esp + 0x268], dx
call fcn.004e8fe0
mov ebx, dword [edi + 0xc]
add esp, 0xc
cmp ebx, ebp
jle 0x472eda
lea ecx, [ecx]
xor eax, eax
xor ecx, ecx
push ebx
push str.Document_i
lea edx, [esp + 0x24c]
mov word [esp + 0x24c], cx
mov dword [esp + 0x24e], eax
mov dword [esp + 0x252], eax
mov dword [esp + 0x256], eax
mov dword [esp + 0x25a], eax
mov dword [esp + 0x25e], eax
call fcn.0047eb50
add esp, 8
lea edx, [esp + 0x244]
push edx
lea eax, [esp + 0x20]
push eax
lea edi, [esp + 0x1c]
lea esi, [esp + 0x264]
mov dword [esp + 0x1c], 0x104
call fcn.0047ead0
test eax, eax
jne 0x472ec9
mov ecx, esi
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x104
jae 0x472ebb
mov edx, esi
push edx
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x34]
push ecx
lea eax, [esp + 0x40]
call fcn.00476450
dec ebx
cmp ebx, ebp
jg 0x472e30
mov edi, dword [esp + 0x34]
mov esi, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x472eeb
push esi
call ebx
mov dword [esp + 0x1c], ebp
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], ebp
cmp eax, ebp
je 0x472efe
push eax
call ebx
mov dword [esp + 0x28], ebp
mov ecx, edi
mov dword [esp + 0x2c], ebp
call fcn.004492f0
mov esi, eax
mov eax, dword [esp + 0x1c]
cmp eax, ebp
je 0x472f16
push eax
call ebx
mov eax, dword [esp + 0x28]
cmp eax, ebp
je 0x472f21
push eax
call ebx
mov eax, esi
mov ecx, dword [esp + 0x468]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x450]
xor ecx, esp
call fcn.004e3edb
add esp, 0x460
ret