Function at 0x475deb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x840
mov eax, 0x6fc914
call fcn.00458b7c
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x828]
mov ebx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x83c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x840], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x848], eax
mov eax, dword [ebp + 0x18]
push eax
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x84c], edi
call fcn.00420940
mov dword [ebp - 4], edi
mov dword [ebp - 0x838], edi
mov dword [ebp - 0x834], edi
mov dword [ebp - 0x830], edi
call fcn.0046033e
test al, al
je 0x475e72
rcl byte [ebp - 0x5de996fc], 0xd9
adc ebp, edi
mulps xmm1, xmm0
cmp eax, 0x1b12ee5b
cdq
hlt
call fcn.004603c8
test al, al
je 0x475e8e
invalid
lea eax, [ebp - 0x838]
push eax
push 0xf013f
push edi
push str.SoftWare
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x475ed2
lea eax, [ebp - 0x828]
mov ecx, ebx
push eax
call fcn.00422b50
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.004209e0
mov eax, ebx
jmp 0x4760d5
call fcn.004601a0
test al, al
je 0x475efa
invalid
fbstp tbyte [esi]
mov esp, 0x1d65a7be
call fcn.004600d1
test al, al
je 0x475f21
cmp al, 3
jb 0x475f75
and ebx, dword [eax + 0x7b9a8962]
sbb dword [esi - 0x15d6320a], ebp
push ebx
xchg edi, esp
cwde
je 0x475ef3
fistp dword [ebp + 0x40]
sbb al, 0xd2
loope 0x475f03
mov esi, dword fs:[0x70c014]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x834]
xor edi, edi
mov ebx, 0xf013f
push edi
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp - 0x83c]
push dword [ebp - 0x838]
call esi
test eax, eax
je 0x475f70
push dword [ebp - 0x838]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x828]
push eax
call fcn.00422b50
jmp 0x4760c1
push edi
lea eax, [ebp - 0x830]
push eax
push edi
push ebx
push edi
push edi
push edi
push dword [ebp - 0x840]
push dword [ebp - 0x834]
call esi
test eax, eax
je 0x475fa7
invalid
push dword [ebp - 0x834]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x830]
call esi
jmp 0x475f59
call fcn.00460383
test al, al
je 0x475fcd
pop ecx
scasb al, byte es:[edi]
cmp al, 0x61
arpl cx, cx
cmp ah, ch
sahf
push ebp
xor edx, dword [ebx + esi*8 + 0x27]
push edi
push esp
sbb dword [0x9d42d43b], 0x37
invalid
call fcn.00460047
test al, al
je 0x475ff1
jne 0x475f70
invalid
jno 0x475fce
std
sal dword [ecx + 0x32], 1
push ecx
mov byte [ebx], bh
inc esp
inc ecx
test dword [ebx], 0xaed6c837
dec esi
aaa
enter 0xffffffffffffaed6, 0x4e
dec ebp
movsd dword es:[edi], dword [esi]
xchg edx, eax
dec esp
dec esi
mov ah, 0x11
jns 0x475fe3
push 0x800
lea eax, [ebp - 0x810]
push edi
push eax
call fcn.004ea000
add esp, 0xc
mov dword [ebp - 0x844], 0x400
lea eax, [ebp - 0x844]
push eax
lea eax, [ebp - 0x810]
push eax
push edi
push edi
push dword [ebp - 0x848]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x830]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x834]
call esi
push dword [ebp - 0x838]
call esi
lea eax, [ebp - 0x810]
push eax
call fcn.004f2ba9
pop ecx
test eax, eax
je 0x475f59
call fcn.0045ff33
test al, al
je 0x47608f
adc byte [ecx], ch
ret 0xfb36
call fcn.0046026f
test al, al
je 0x4760af
stc
adc al, 0xf8
mov dword [edi], ebp
ror ah, cl
push esp
xchg esp, eax
mov ch, 0x63
dec ebp
test dword [edi + 0x6941ef70], ebx
stosd dword es:[edi], eax
inc ebx
sbb ecx, dword [ebx - 0x82b7275]
invalid
mov ecx, dword [ebp - 0x82c]
lea eax, [ebp - 0x810]
push eax
call fcn.00420940
push edi
push 1
lea ecx, [ebp - 0x828]
call fcn.004209e0
mov eax, dword [ebp - 0x82c]
call fcn.00458b37
ret