Function at 0x47d610
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov edi, ecx
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x4e37f8]
mov dword [esp + 0x30], edi
mov dword [edi + 8], 0
mov dword [edi], 0x4cdea8
mov dword [edi + 4], 0
mov eax, dword [eax + 0x84]
or eax, 0x20019
push eax
push 0
push dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x47d922
mov esi, dword [ebp + 0xc]
push eax
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push esi
push dword [esp + 0x28]
mov dword [esp + 0x30], eax
call eax
mov ebx, eax
test ebx, ebx
jne 0x47d918
mov eax, dword [esp + 0x1c]
dec eax
cmp eax, 6
ja case.0x47d695.5
jmp dword [eax*4 + 0x47d96c]
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 4
push eax
lea eax, [esp + 0x28]
push eax
push 0
push 0
push esi
push dword [esp + 0x28]
call dword [esp + 0x30]
mov ebx, eax
test ebx, ebx
jne 0x47d918
mov eax, dword [esp + 0x24]
mov dword [edi + 8], 1
mov dword [edi], eax
mov dword [edi + 4], ebx
jmp 0x47d918
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push 0
push 0
push esi
push dword [esp + 0x28]
call dword [esp + 0x30]
mov ebx, eax
test ebx, ebx
jne 0x47d918
mov esi, dword [esp + 0x10]
test esi, esi
je 0x47d918
shr esi, 1
add esi, 2
cmp esi, 0xffffffff
jne 0x47d72f
xor esi, esi
lea ecx, [esi + 2]
nop dword [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47d720
sub esi, ecx
sar esi, 1
lea ecx, [esi + esi]
cmp esi, 0xff
ja 0x47d73f
mov eax, dword [edi + 0x10]
jmp 0x47d766
lea eax, [ecx + 2]
push eax
call fcn.0049eded
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
jne 0x47d763
mov ecx, edi
call fcn.0040db30
test eax, eax
je 0x47d918
jmp 0x47d771
lea ecx, [esi + esi]
mov dword [edi], eax
xor edx, edx
mov word [ecx + eax], dx
mov dword [edi + 4], esi
mov esi, dword [edi]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push esi
push 0
push 0
push eax
push dword [esp + 0x28]
call dword [esp + 0x30]
mov ebx, eax
test ebx, ebx
jne 0x47d7e2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47d7e2
shr eax, 1
cmp word [esi + eax*2 - 2], bx
jne 0x47d7a3
dec eax
jmp 0x47d7a9
xor ecx, ecx
mov word [esi + eax*2], cx
cmp dword [esp + 0x1c], 7
jne 0x47d7e7
test eax, eax
je 0x47d7bc
cmp word [esi + eax*2 - 2], 0
je 0x47d7c3
inc eax
xor ecx, ecx
mov word [esi + eax*2], cx
xor ecx, ecx
test eax, eax
je 0x47d7e7
lea edx, [ecx + 0xa]
nop dword [eax]
cmp word [esi + ecx*2], 0
jne 0x47d7db
mov word [esi + ecx*2], dx
inc ecx
cmp ecx, eax
jb 0x47d7d0
jmp 0x47d7e7
xor eax, eax
mov word [esi], ax
lea ecx, [esi + 2]
nop word [eax + eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x47d7f0
sub esi, ecx
sar esi, 1
mov dword [edi + 4], esi
jmp 0x47d918
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
push 0
push 0
push 0
push esi
push dword [esp + 0x28]
call dword [esp + 0x30]
mov ebx, eax
test ebx, ebx
jne 0x47d918
mov eax, dword [esp + 0x10]
test eax, eax
je 0x47d918
add eax, eax
mov dword [esp + 0x20], eax
lea esi, [eax + eax]
cmp eax, 0xff
ja 0x47d89c
mov eax, dword [edi + 0x10]
mov dword [edi], eax
xor ecx, ecx
mov word [esi + eax], cx
mov eax, dword [esp + 0x20]
mov dword [edi + 4], eax
mov ecx, dword [edi]
xor eax, eax
mov dword [esp + 0x20], ecx
mov word [ecx], ax
mov eax, dword [esp + 0x10]
lea ecx, [ecx + eax*2]
add ecx, eax
lea eax, [esp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push ecx
push 0
push 0
push eax
push dword [esp + 0x28]
mov dword [esp + 0x40], ecx
call dword [esp + 0x30]
mov ebx, eax
mov dword [esp + 0x18], ebx
test ebx, ebx
je 0x47d8bc
mov dword [edi + 4], 0
jmp 0x47d918
lea eax, [esi + 2]
push eax
call fcn.0049eded
add esp, 4
mov dword [edi + 0x14], eax
test eax, eax
jne 0x47d84c
mov ecx, edi
call fcn.0040db30
test eax, eax
je 0x47d918
jmp 0x47d85b
xor edx, edx
xor esi, esi
cmp dword [esp + 0x10], edx
jbe 0x47d907
mov edi, dword [esp + 0x20]
mov ebx, dword [esp + 0x28]
nop
movzx ecx, byte [ebx + edx]
inc edx
mov eax, ecx
shr ecx, 4
and eax, 0xf
movzx eax, word [eax*2 + str.0123456789ABCDEF]
mov word [edi + esi*2 + 2], ax
movzx eax, word [ecx*2 + str.0123456789ABCDEF]
mov word [edi + esi*2], ax
add esi, 2
cmp edx, dword [esp + 0x10]
jb 0x47d8d0
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov word [eax + esi*2], cx
jmp 0x47d918
mov ebx, 0x65e
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4e37f8]
mov dword [eax + 0x38], ebx
cmp ebx, 2
jne 0x47d958
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x47d95c
mov eax, dword [ecx + 4]
mov edx, dword [ecx]
mov dword [edi], edx
mov dword [edi + 4], eax
mov eax, dword [ecx + 8]
mov dword [edi + 8], eax
cmp eax, 5
jne 0x47d964
mov eax, dword [edx]
push edx
call dword [eax + 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x47d964
push ebx
mov ecx, edi
call fcn.0040dc90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret