Function at 0x470227
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
push dword [esp + 0x3c]
mov edi, dword [esp + 0x34]
xor esi, esi
push dword [esp + 0x3c]
mov ebp, esi
mov dword [esp + 0x1c], esi
push edi
call fcn.00471ccb
mov ecx, edi
mov ebx, eax
add esp, 0xc
mov dword [esp + 0x28], ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x470256
xor eax, eax
sub ecx, edx
mov word [edi + ebx*2], ax
lea eax, [esp + 0x30]
mov ebx, dword [esp + 0x34]
push eax
push 0x1000b
push dword [esp + 0x44]
sar ecx, 1
push dword [esp + 0x44]
mov dword [esp + 0x30], ecx
push ebx
push edi
call fcn.0046fdff
add esp, 0x18
cmp eax, 2
jne 0x47029b
xor eax, eax
jmp 0x4703c7
test eax, eax
jne 0x4703c7
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
push esi
push esi
push esi
jmp 0x470355
cmp dword [esp + 0x18], 0
je 0x47038e
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x14], ecx
jae 0x470303
lea esi, [ecx*2 + 2]
mov dword [esp + 0x24], esi
test ebp, ebp
je 0x4702ea
push ebp
call fcn.005c3f1c
pop ecx
mov ecx, dword [esp + 0x10]
push esi
mov dword [esp + 0x18], ecx
call fcn.005c3f21
mov ebp, eax
pop ecx
test ebp, ebp
je 0x4703cf
mov ecx, dword [esp + 0x10]
inc ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
push ebp
push ecx
push dword [esp + 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x47041e
push ebp
push dword [esp + 0x34]
push ebx
push edi
call fcn.00470227
mov eax, dword [esp + 0x30]
add esp, 0x10
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov word [edi + eax*2], cx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x34]
push eax
push ecx
push ecx
push ecx
push dword [esp + 0x5c]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
je 0x4702bb
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 2
push 0x1a0
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005BaseRegistry.c
push edi
push str.RegQueryInfoKey
push esi
push 1
push ebx
call fcn.0046e15b
add esp, 0x34
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4703a3
push ebp
call fcn.005c3f1c
pop ecx
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov word [edi + eax*2], cx
test esi, esi
jne 0x4703c5
push dword [esp + 0x3c]
push dword [esp + 0x3c]
push ebx
push edi
call fcn.0047016e
add esp, 0x10
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1b0
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005BaseRegistry.c
push eax
push str.malloc
push 0xe
pop esi
push esi
push 1
push ebx
call fcn.0046e15b
add esp, 0x34
test ebx, ebx
je 0x47038e
push dword [esp + 0x24]
lea eax, [ebx + 0x288]
push 0x60bd10
push 0xffffffffffffffff
push 0x100
push eax
call fcn.0040c5e7
add esp, 0x14
jmp 0x47038e
xor eax, eax
push eax
push eax
push eax
push eax
push edi
push 2
push 0x1c4
push str.D:SOURCESMacheteMachete51_3MacheteWinNTInclude_VS2005BaseRegistry.c
push edi
push str.RegEnumKeyEx
jmp 0x470382