Function at 0x4711b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x894
mov eax, dword [0x5732cc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4711d2
jmp 0x47156f
mov dword [ebp - 0xc], 0x400
mov dword [ebp - 0x414], 0
jmp 0x4711f4
mov ecx, dword [ebp - 0x414]
add ecx, 1
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0xc], 0x400
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x410]
push ecx
mov edx, dword [ebp - 0x414]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x47156f
lea edx, [ebp - 0x410]
mov dword [ebp - 0x824], edx
lea eax, [ebp - 0x818]
mov dword [ebp - 0x828], eax
mov ecx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], ecx
mov edx, dword [ebp - 0x824]
mov al, byte [edx]
mov byte [ebp - 0x82d], al
mov ecx, dword [ebp - 0x828]
mov dl, byte [ebp - 0x82d]
mov byte [ecx], dl
mov eax, dword [ebp - 0x824]
add eax, 1
mov dword [ebp - 0x824], eax
mov ecx, dword [ebp - 0x828]
add ecx, 1
mov dword [ebp - 0x828], ecx
cmp byte [ebp - 0x82d], 0
jne 0x47124f
lea edx, [ebp - 0x818]
add edx, 0xffffffff
mov dword [ebp - 0x834], edx
mov eax, dword [ebp - 0x834]
mov cl, byte [eax + 1]
mov byte [ebp - 0x835], cl
add dword [ebp - 0x834], 1
cmp byte [ebp - 0x835], 0
jne 0x4712a1
mov edi, dword [ebp - 0x834]
mov edx, dword [0x51da48]
mov dword [edi], edx
mov ax, word [0x51da4c]
mov word [edi + 4], ax
lea ecx, [ebp - 0x81c]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x818]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x47156a
movzx edx, byte [ebp + 0xc]
test edx, edx
je 0x471361
lea eax, [ebp - 0x410]
add eax, 0xffffffff
mov dword [ebp - 0x83c], eax
mov ecx, dword [ebp - 0x83c]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x83d], dl
add dword [ebp - 0x83c], 1
cmp byte [ebp - 0x83d], 0
jne 0x471318
mov edi, dword [ebp - 0x83c]
mov eax, dword [0x51da50]
mov dword [edi], eax
mov ecx, dword [0x51da54]
mov dword [edi + 4], ecx
mov dx, word [0x51da58]
mov word [edi + 8], dx
mov eax, dword [ebp - 0xc]
add eax, 9
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x844], ecx
mov edx, dword [ebp - 0x844]
add edx, 1
mov dword [ebp - 0x848], edx
mov eax, dword [ebp - 0x844]
mov cl, byte [eax]
mov byte [ebp - 0x849], cl
add dword [ebp - 0x844], 1
cmp byte [ebp - 0x849], 0
jne 0x471379
mov edx, dword [ebp - 0x844]
sub edx, dword [ebp - 0x848]
mov dword [ebp - 0x850], edx
mov eax, dword [ebp - 0x850]
mov dword [ebp - 0x820], eax
mov ecx, dword [ebp - 0x820]
add ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp + 0x14]
jae 0x47155d
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x854], edx
mov eax, dword [ebp - 0x854]
add eax, 1
mov dword [ebp - 0x858], eax
mov ecx, dword [ebp - 0x854]
mov dl, byte [ecx]
mov byte [ebp - 0x859], dl
add dword [ebp - 0x854], 1
cmp byte [ebp - 0x859], 0
jne 0x4713df
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x858]
mov dword [ebp - 0x860], eax
jne 0x47147a
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x864], ecx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x868], edx
mov eax, dword [ebp - 0x868]
mov dword [ebp - 0x86c], eax
mov ecx, dword [ebp - 0x864]
mov dl, byte [ecx]
mov byte [ebp - 0x86d], dl
mov eax, dword [ebp - 0x868]
mov cl, byte [ebp - 0x86d]
mov byte [eax], cl
mov edx, dword [ebp - 0x864]
add edx, 1
mov dword [ebp - 0x864], edx
mov eax, dword [ebp - 0x868]
add eax, 1
mov dword [ebp - 0x868], eax
cmp byte [ebp - 0x86d], 0
jne 0x471432
jmp 0x47155d
mov ecx, dword [ebp + 0x10]
add ecx, 0xffffffff
mov dword [ebp - 0x874], ecx
mov edx, dword [ebp - 0x874]
mov al, byte [edx + 1]
mov byte [ebp - 0x875], al
add dword [ebp - 0x874], 1
cmp byte [ebp - 0x875], 0
jne 0x471486
mov edi, dword [ebp - 0x874]
mov cx, word [0x51da5c]
mov word [edi], cx
mov dl, byte [0x51da5e]
mov byte [edi + 2], dl
lea eax, [ebp - 0x410]
mov dword [ebp - 0x87c], eax
mov ecx, dword [ebp - 0x87c]
mov dword [ebp - 0x880], ecx
mov edx, dword [ebp - 0x87c]
mov al, byte [edx]
mov byte [ebp - 0x881], al
add dword [ebp - 0x87c], 1
cmp byte [ebp - 0x881], 0
jne 0x4714d6
mov ecx, dword [ebp - 0x87c]
sub ecx, dword [ebp - 0x880]
mov edx, dword [ebp - 0x880]
mov dword [ebp - 0x888], edx
mov dword [ebp - 0x88c], ecx
mov eax, dword [ebp + 0x10]
add eax, 0xffffffff
mov dword [ebp - 0x890], eax
mov ecx, dword [ebp - 0x890]
mov dl, byte [ecx + 1]
mov byte [ebp - 0x891], dl
add dword [ebp - 0x890], 1
cmp byte [ebp - 0x891], 0
jne 0x47151e
mov edi, dword [ebp - 0x890]
mov esi, dword [ebp - 0x888]
mov eax, dword [ebp - 0x88c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp - 0x81c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4711e5
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004db901
mov esp, ebp
pop ebp
ret