Function at 0x470083
Capabilities:
Query or enumerate registry value
Terminate process

Disassembly:
push 0x74
mov eax, 0x50ef7e
call fcn.004f41e2
mov ecx, dword [0x5a22a0]
xor bl, bl
mov edi, dword [ebp + 8]
call fcn.0040f8d1
xor ecx, ecx
inc ecx
test al, al
je 0x4700bf
push ecx
push ecx
mov bl, cl
mov ecx, dword [0x5a22a0]
push str.CheckOptionsFast_was_skipped_due_to__basic_or__resetdefault_switch
call fcn.00410feb
jmp 0x4701d3
mov ecx, dword [0x5a23ec]
mov al, byte [ebp + 0xc]
and al, 1
mov byte [0x5a4de7], al
cmp byte [ecx + 0x10fde], 0
sete byte [0x5a4de4]
cmp byte [ecx + 0x1160f], 0
sete byte [0x5a4de5]
xor eax, eax
cmp dword [0x5a22cc], 6
mov byte [0x5a4de6], al
jne 0x4701d3
cmp dword [0x5a22d0], eax
jne 0x4701d3
push eax
mov dword [ebp - 0x70], eax
call fcn.0045e5c5
mov esi, eax
test esi, esi
je 0x47015d
mov edx, dword [esi]
mov ecx, esi
push 0
push 0x20019
push str.SoftwareConEmu
call dword [edx]
test al, al
je 0x470154
lea eax, [ebp - 0x70]
mov ecx, esi
push eax
push str.StopWarningConIme
call fcn.0049e814
mov ecx, dword [ebp - 0x70]
xor edx, edx
test al, al
cmove ecx, edx
mov dword [ebp - 0x70], ecx
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x20]
cmp dword [ebp - 0x70], 0
jne 0x4701d3
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
xor esi, esi
push str.Console
inc esi
push SysReAllocString
mov dword [ebp - 0x74], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4701cb
push 4
pop eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push str.LoadConIme
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0x74]
test eax, eax
push dword [ebp - 0x78]
cmovne ecx, esi
mov dword [ebp - 0x74], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x74], 0
je 0x4701d3
xor eax, eax
inc eax
mov byte [0x5a4de6], al
push dword [ebp + 0xc]
call fcn.0047156e
test byte [ebp + 0xc], 0x10
pop ecx
je 0x4701ef
mov ecx, dword [0x5a23ec]
push 0
call fcn.0045e45d
test bl, bl
jne 0x4702c3
cmp byte [0x5a4de4], bl
jne 0x470213
cmp byte [0x5a4de5], bl
jne 0x470213
cmp byte [0x5a4de6], bl
je 0x4702c3
call fcn.004229f3
mov eax, dword [0x5a23f0]
xor ebx, ebx
cmp byte [eax + 0x11a60], bl
je 0x470298
mov ecx, dword [0x5a22a0]
cmp byte [ecx + 0x9e4], bl
je 0x470298
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push str._n_nDo_you_want_to_continue_anyway_
add ecx, 0x710
call fcn.0044612f
push eax
push str.Something_is_going_wrong..._n_nAutomatic_action_is_pending__but_settings_werent_initialized__n_nTo_avoid_this_problem_without_need_to_create_nsettings_file_you_may_use___basic__switch._n_nCurrent_command_line:_n
lea ecx, [ebp - 0x6c]
call fcn.004e2531
xor eax, eax
mov dword [ebp - 4], ebx
inc eax
lea ecx, [ebp - 0x6c]
push eax
push ebx
push ebx
push 0x34
call fcn.0044612f
push eax
call fcn.004726cd
add esp, 0x14
cmp eax, 7
jne 0x47028c
push 0x94
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
mov esi, 0x5a4e44
push esi
call fcn.00439761
push edi
push 0x4702c9
push ebx
push 0xd7
call fcn.0043fc51
push esi
call fcn.00403b73
add esp, 0x18
mov dword [0x5a4de0], ebx
call fcn.004f418c
ret