Function at 0x47ddd4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x470
mov eax, 0x4cc14a
call fcn.004ae269
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x474], ebx
mov dword [ebp - 0x434], eax
mov dword [ebp - 0x470], ecx
mov dword [ebp - 0x45c], edx
test eax, eax
jne 0x47de11
xor eax, eax
jmp 0x47e30a
push ecx
lea ecx, [ebp - 0x430]
call fcn.004025a1
and dword [ebp - 4], 0
lea edi, [ebp - 0x430]
call fcn.00411ade
push str.wow6432node
xor ecx, ecx
mov esi, edi
call fcn.004077b1
test eax, eax
jle 0x47de4e
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.00402883
jmp 0x47de0a
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.00402883
push dword [ebp - 0x470]
xor esi, esi
lea eax, [ebp - 0x430]
push 0x539ad0
push eax
mov dword [ebp - 0x44c], esi
mov dword [ebp - 0x450], esi
mov dword [ebp - 0x440], 0x400000
mov dword [ebp - 0x468], esi
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x47c], esi
mov dword [ebp - 0x444], esi
mov dword [ebp - 0x448], esi
call fcn.0040c5f2
add esp, 0xc
push 0x539ac8
push eax
lea eax, [ebp - 0x438]
push eax
mov dword [ebp - 4], 1
call fcn.004021ba
add esp, 0xc
lea edi, [ebx + 8]
mov byte [ebp - 4], 2
mov ecx, dword [edi + 8]
push eax
push ecx
mov ecx, edi
call fcn.00495a83
mov ecx, dword [ebp - 0x438]
add ecx, 0xfffffff0
call fcn.00402883
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.00402883
push esi
push esi
lea eax, [ebp - 0x448]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x47c]
push eax
push esi
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x468]
push eax
push esi
push esi
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x460], eax
mov eax, 0x4000
cmp dword [ebp - 0x444], eax
ja 0x47df4d
mov eax, dword [ebp - 0x444]
lea ecx, [eax + 2]
mov eax, 0x400000
mov dword [ebp - 0x444], ecx
cmp dword [ebp - 0x448], eax
ja 0x47df69
mov eax, dword [ebp - 0x448]
add eax, 2
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 4]
mov dword [ebp - 0x44c], ecx
mov byte [eax], 0
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x440]
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x450]
push eax
push esi
lea eax, [ebp - 0x44c]
push eax
push dword [ebx]
push esi
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x438], 1
jmp 0x47e11b
cmp eax, esi
jne 0x47e126
call fcn.0048aa29
push eax
lea ecx, [ebp - 0x430]
call fcn.00402840
push 3
pop ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x44c], esi
jne 0x47dff9
mov eax, dword [ebx]
push 0x40
pop edx
mov word [eax], dx
mov eax, dword [ebx]
xor edx, edx
mov word [eax + 2], dx
mov eax, dword [ebp - 0x450]
dec eax
je 0x47e067
sub eax, ecx
je 0x47e036
lea eax, [ebp - 0x430]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
call fcn.0040255d
push dword [ebp - 0x450]
push dword [ebp - 0x440]
push dword [ebx + 4]
call fcn.0047e74e
add esp, 0x14
jmp 0x47e09f
mov eax, dword [ebx + 4]
movzx eax, byte [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
mov dword [ebp - 0x464], eax
call fcn.0040255d
push dword [ebp - 0x464]
lea ecx, [ebp - 0x430]
call fcn.0047e4c8
pop ecx
pop ecx
jmp 0x47e09f
lea eax, [ebp - 0x430]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x458], esp
push dword [ebx]
call fcn.0040255d
push ecx
mov byte [ebp - 4], 4
mov ecx, esp
mov dword [ebp - 0x46c], esp
push dword [ebx + 4]
call fcn.0040255d
mov byte [ebp - 4], 3
call fcn.0047e64c
add esp, 0xc
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x430]
push ecx
push eax
mov ecx, edi
call fcn.00495a83
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x430]
add ecx, 0xfffffff0
call fcn.00402883
mov eax, dword [ebp - 0x444]
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0x440], eax
mov eax, dword [ebx + 4]
mov byte [eax], 0
mov eax, dword [ebx]
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x440]
push eax
push dword [ebx + 4]
lea eax, [ebp - 0x450]
push eax
push esi
lea eax, [ebp - 0x44c]
push eax
push dword [ebx]
push dword [ebp - 0x438]
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x438]
cmp eax, 0x103
jne 0x47dfc2
lea eax, [ebp - 0x454]
push eax
mov eax, dword [ebp - 0x45c]
mov eax, dword [eax]
or eax, 0x20019
push eax
push esi
push esi
push dword [ebp - 0x434]
mov dword [ebp - 0x454], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47e307
cmp dword [ebp - 0x460], esi
jne 0x47de0a
push 0x412
lea eax, [ebp - 0x42c]
push esi
push eax
call fcn.004adda0
add esp, 0xc
mov dword [ebp - 0x434], esi
cmp dword [ebp - 0x468], esi
jbe 0x47e2fb
push 0x208
lea eax, [ebp - 0x42c]
push eax
push dword [ebp - 0x434]
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
jne 0x47e2e3
mov dword [ebp - 0x43c], esi
mov dword [ebp - 0x438], esi
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 4], 5
push dword [ebp - 0x454]
mov eax, dword [eax]
lea edi, [ebp - 0x43c]
call fcn.00411f6e
test eax, eax
jne 0x47e2cb
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x460]
call fcn.0040255d
push 0x5236d0
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.004118b1
test eax, eax
mov byte [ebp - 4], 5
mov ecx, dword [ebp - 0x460]
setne bl
add ecx, 0xfffffff0
call fcn.00402883
test bl, bl
je 0x47e2c0
cmp dword [ebp - 0x43c], esi
je 0x47e2c0
lea ebx, [ebp - 0x458]
call fcn.004348cc
push eax
push dword [ebp - 0x470]
lea eax, [ebp - 0x46c]
push eax
mov byte [ebp - 4], 7
call fcn.00402163
add esp, 0xc
lea ecx, [ebp - 0x42c]
push ecx
push eax
lea eax, [ebp - 0x464]
push eax
mov byte [ebp - 4], 8
call fcn.004021ba
add esp, 0xc
push dword [ebp - 0x45c]
mov ecx, dword [ebp - 0x474]
push eax
mov byte [ebp - 4], 9
push dword [ebp - 0x43c]
call fcn.0047ddd4
mov ecx, dword [ebp - 0x464]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x46c]
add ecx, 0xfffffff0
call fcn.00402883
mov ecx, dword [ebp - 0x458]
add ecx, 0xfffffff0
call fcn.00402883
xor esi, esi
lea ecx, [ebp - 0x43c]
call fcn.00411faa
or dword [ebp - 4], 0xffffffff
xor eax, eax
lea ecx, [ebp - 0x43c]
mov word [ebp - 0x42c], ax
call fcn.00411faa
inc dword [ebp - 0x434]
mov eax, dword [ebp - 0x434]
cmp eax, dword [ebp - 0x468]
jb 0x47e18a
push dword [ebp - 0x454]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
call fcn.004ae2ec
ret 0xc