Function at 0x47e3ea
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x140
mov eax, 0x49c0e9
call fcn.00497265
mov dword [ebp - 0x104], ecx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x100], eax
test ebx, ebx
jne 0x47e5c0
push 0x13
lea eax, [ebp - 0xf8]
push eax
call fcn.004609a6
mov esi, dword [sym.imp.MSVCR120.dll_wcscmp]
push str.HKEY_LOCAL_MACHINE_
push dword [eax]
call esi
pop ecx
mov ebx, eax
pop ecx
neg ebx
lea ecx, [ebp - 0xf8]
sbb bl, bl
call fcn.0045e73f
push 0x12
inc bl
je 0x47e473
mov dword [ebp - 0x100], connect
jmp 0x47e4b2
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp + 0xc]
call fcn.004609a6
push str.HKEY_CURRENT_USER_
push dword [eax]
call esi
pop ecx
mov ebx, eax
pop ecx
neg ebx
lea ecx, [ebp - 0xf8]
sbb bl, bl
call fcn.0045e73f
inc bl
je 0x47e5b6
mov dword [ebp - 0x100], connect
push 0x11
pop esi
push esi
push 0
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp + 0xc]
call fcn.00460ad5
push 2
pop ebx
push dword [ebp - 0x110]
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], bl
call fcn.004622ef
lea ecx, [esi + 1]
mov dword [ebp - 0x118], eax
push ecx
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp + 0xc]
call fcn.00460ab0
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0045f6df
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], bl
call fcn.0045e73f
mov esi, dword [ebp - 0x118]
mov ecx, edi
push esi
call fcn.004425a2
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0xfc], eax
call fcn.004694c6
test eax, eax
jne 0x47e582
push 0x50
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10c], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x47e557
push 0x4a1e60
mov ecx, eax
call fcn.004427f0
jmp 0x47e559
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], bl
mov dword [ebp - 0xfc], eax
call fcn.0044233e
push esi
push str.name
lea ecx, [ebp - 0xfc]
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
lea ecx, [ebp - 0xfc]
call fcn.004694c6
push eax
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.0045e6a5
push dword [ebp - 0x100]
mov ecx, dword [ebp - 0x104]
call fcn.0047e3ea
lea ecx, [ebp - 0x110]
jmp 0x47ecde
xor esi, esi
inc esi
xor eax, eax
jmp 0x47ece7
push eax
push 0x5c
call fcn.0045fcee
mov esi, eax
lea ecx, [ebp - 0x120]
lea eax, [ebp + 0xc]
push eax
call fcn.0045e6a5
mov byte [ebp - 4], 5
test esi, esi
jle 0x47e612
push esi
push 0
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp + 0xc]
call fcn.00460ad5
push eax
lea ecx, [ebp - 0x120]
mov byte [ebp - 4], 6
call fcn.0045f6df
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 5
call fcn.0045e73f
push dword [ebp - 0x120]
lea ecx, [ebp - 0x144]
call fcn.004622ef
push eax
mov ecx, edi
mov dword [ebp - 0xf8], eax
call fcn.004425a2
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0xfc], eax
call fcn.004694c6
test eax, eax
jne 0x47e69b
push 0x50
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10c], eax
mov byte [ebp - 4], 7
test eax, eax
je 0x47e66a
push 0x4a1e60
mov ecx, eax
call fcn.004427f0
jmp 0x47e66c
xor eax, eax
push eax
mov ecx, edi
mov byte [ebp - 4], 5
mov dword [ebp - 0xfc], eax
call fcn.0044233e
push dword [ebp - 0xf8]
lea ecx, [ebp - 0xfc]
push str.name
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
lea eax, [ebp - 0x100]
push eax
push connect
push 0
push dword [ebp - 0x120]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47ec8b
test esi, esi
jle 0x47e71f
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0xf8]
push eax
lea ecx, [ebp + 0xc]
call fcn.00460ab0
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 8
call fcn.0045f6df
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 5
call fcn.0045e73f
lea ecx, [ebp - 0xfc]
call fcn.004694c6
push eax
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
push eax
call fcn.0045e6a5
push dword [ebp - 0x100]
mov ecx, dword [ebp - 0x104]
call fcn.0047e3ea
jmp 0x47ec7d
xor ebx, ebx
lea eax, [ebp - 0x134]
push ebx
push ebx
push eax
lea eax, [ebp - 0x138]
mov dword [ebp - 0x130], ebx
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x12c], ebx
push eax
push ebx
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x128], ebx
push eax
lea eax, [ebp - 0x130]
mov dword [ebp - 0x138], ebx
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x100]
mov dword [ebp - 0x134], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x47ec7d
mov esi, ebx
push 2
pop ebx
cmp dword [ebp - 0x130], esi
jle 0x47e812
mov ebx, dword [ebp - 0x104]
mov eax, dword [ebp - 0x12c]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00497198
pop ecx
mov ecx, dword [ebp - 0x12c]
mov edi, eax
xor eax, eax
inc ecx
push eax
push eax
push eax
push eax
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf8], ecx
push eax
push edi
push esi
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x47e7ff
lea ecx, [ebp - 0xfc]
call fcn.004694c6
push eax
push ecx
mov ecx, esp
push edi
call fcn.0045f630
push dword [ebp - 0x100]
mov ecx, ebx
call fcn.0047e3ea
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
inc esi
pop ecx
cmp esi, dword [ebp - 0x130]
jl 0x47e793
push 2
pop ebx
xor esi, esi
mov dword [ebp - 0x110], esi
cmp dword [ebp - 0x128], esi
jle 0x47ec7d
mov eax, dword [ebp - 0x138]
xor ecx, ecx
inc eax
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00497198
push dword [ebp - 0x134]
mov dword [ebp - 0x104], eax
call fcn.00497198
pop ecx
pop ecx
mov ecx, dword [ebp - 0x138]
mov edi, eax
inc ecx
mov dword [ebp - 0x11c], edi
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14c], ecx
mov ecx, dword [ebp - 0x134]
push eax
push edi
lea eax, [ebp - 0x124]
mov dword [ebp - 0x114], ecx
push eax
xor ecx, ecx
lea eax, [ebp - 0x14c]
push ecx
push eax
push dword [ebp - 0x104]
mov dword [ebp - 0x124], ecx
push esi
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x47ec4f
push dword [ebp - 0x104]
lea ecx, [ebp - 0x144]
call fcn.004622ef
lea ecx, [ebp - 0xfc]
mov esi, eax
call fcn.004694c6
push esi
mov ecx, eax
call fcn.004425a2
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.004694c6
test eax, eax
jne 0x47e92a
push 0x50
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x10c], eax
mov byte [ebp - 4], 9
test eax, eax
je 0x47e90b
push 0x4a1e64
mov ecx, eax
call fcn.004427f0
jmp 0x47e90d
xor eax, eax
push eax
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 5
mov dword [ebp - 0x108], eax
call fcn.004694c6
mov ecx, eax
call fcn.0044233e
push dword [ebp - 0x104]
lea ecx, [ebp - 0x144]
call fcn.004622ef
push eax
push str.name
lea ecx, [ebp - 0x108]
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
xor eax, eax
push 0x7f
push eax
mov byte [ebp - 0xdc], al
lea eax, [ebp - 0xdb]
push eax
call sub.MSVCR120.dll_memset
mov eax, dword [ebp - 0x124]
add esp, 0xc
cmp eax, 3
jne 0x47e97f
mov eax, str.REG_BINARY
jmp 0x47e9db
cmp eax, 4
jne 0x47e98b
mov eax, str.REG_DWORD
jmp 0x47e9db
cmp eax, ebx
jne 0x47e996
mov eax, str.REG_EXPAND_SZ
jmp 0x47e9db
cmp eax, 7
jne 0x47e9a2
mov eax, str.REG_MULTI_SZ
jmp 0x47e9db
cmp eax, 0xb
jne 0x47e9ae
mov eax, str.REG_QWORD
jmp 0x47e9db
cmp eax, 1
jne 0x47e9ba
mov eax, str.REG_SZ
jmp 0x47e9db
push eax
push str.Unknown_type__0x_08x_
lea eax, [ebp - 0xdc]
push 0x80
push eax
call dword [sym.imp.MSVCR120.dll_sprintf_s]
add esp, 0x10
lea eax, [ebp - 0xdc]
push eax
push str.type
lea ecx, [ebp - 0x108]
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
mov eax, dword [ebp - 0x124]
cmp eax, 3
jne 0x47eadb
xor eax, eax
mov dword [ebp - 0xe0], 0xf
mov dword [ebp - 0xe4], eax
mov byte [ebp - 0xf4], al
mov esi, eax
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x114], esi
jle 0x47eaa5
movzx eax, byte [esi + edi]
push eax
push 0x4a1ed4
lea eax, [ebp - 0x1c]
push 0xa
push eax
call dword [sym.imp.MSVCR120.dll_sprintf_s]
add esp, 0x10
cmp byte [ebp - 0x1c], 0
jne 0x47ea4b
xor eax, eax
jmp 0x47ea55
lea eax, [ebp - 0x1c]
push eax
call sub.MSVCR120.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xf4]
call fcn.004629d4
mov eax, dword [ebp - 0x114]
cmp esi, eax
jge 0x47ea91
push 0x4bc434
call sub.MSVCR120.dll_strlen
pop ecx
push eax
push 0x4bc434
lea ecx, [ebp - 0xf4]
call fcn.004629d4
mov eax, dword [ebp - 0x114]
inc esi
cmp esi, eax
jl 0x47ea28
cmp dword [ebp - 0xe0], 0x10
mov eax, dword [ebp - 0xf4]
jae 0x47eaab
lea eax, [ebp - 0xf4]
push eax
push str.value
lea ecx, [ebp - 0x108]
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
push 0
push 1
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 5
call fcn.0046282b
jmp 0x47ec4f
cmp eax, 4
jne 0x47eb29
xor eax, eax
push 0x3f
push eax
mov byte [ebp - 0x5c], al
lea eax, [ebp - 0x5b]
push eax
call sub.MSVCR120.dll_memset
push dword [edi]
lea eax, [ebp - 0x5c]
push dword [edi]
push str.0x_08x___lu_
push 0x40
push eax
call dword [sym.imp.MSVCR120.dll_sprintf_s]
add esp, 0x20
lea eax, [ebp - 0x5c]
push eax
push str.value
lea ecx, [ebp - 0x108]
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
jmp 0x47ec4f
cmp eax, 1
je 0x47ec38
cmp eax, ebx
je 0x47ec38
cmp eax, 7
jne 0x47ec4f
mov edx, dword [ebp - 0x11c]
xor eax, eax
mov ecx, eax
mov edi, eax
mov eax, ebx
mov esi, edx
sub eax, edx
mov dword [ebp - 0x10c], eax
xor eax, eax
cmp word [esi], ax
jne 0x47ec30
mov eax, edi
sub eax, ecx
push eax
lea eax, [edx + ecx*2]
push eax
lea ecx, [ebp - 0x118]
call fcn.00466206
push dword [ebp - 0x118]
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0xb
call fcn.004622ef
push 0x50
mov dword [ebp - 0xf8], eax
call sub.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x148], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x47ebb9
push 0x4a1eec
mov ecx, eax
call fcn.004427f0
jmp 0x47ebbb
xor eax, eax
push eax
lea ecx, [ebp - 0x108]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x148], eax
call fcn.004694c6
mov ecx, eax
call fcn.0044233e
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x148]
push str.value
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
lea eax, [edi + 1]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x118]
mov dword [ebp - 0xf8], eax
call fcn.0045e73f
mov edx, dword [ebp - 0x11c]
xor ecx, ecx
cmp word [esi], cx
jne 0x47ec28
mov eax, dword [ebp - 0x10c]
add eax, edx
cmp word [eax + esi], cx
je 0x47ec49
mov ecx, dword [ebp - 0xf8]
xor eax, eax
inc edi
add esi, ebx
jmp 0x47eb5d
push edi
lea ecx, [ebp - 0x144]
call fcn.004622ef
jmp 0x47eb0c
mov edi, dword [ebp - 0x11c]
push dword [ebp - 0x104]
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
mov eax, dword [ebp - 0x110]
inc eax
mov esi, eax
mov dword [ebp - 0x110], eax
pop ecx
pop ecx
cmp eax, dword [ebp - 0x128]
jl 0x47e826
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47ecd8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xf8]
push eax
call fcn.0045fd5c
pop ecx
pop ecx
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], 0xd
call fcn.004622ef
push eax
push str.error
lea ecx, [ebp - 0xfc]
call fcn.004694c6
mov ecx, eax
call fcn.00442a48
lea ecx, [ebp - 0xf8]
call fcn.0045e73f
lea ecx, [ebp - 0x120]
call fcn.0045e73f
xor eax, eax
mov esi, eax
lea ecx, [ebp - 0x144]
mov byte [ebp - 4], al
call fcn.0045f6ac
lea ecx, [ebp + 0xc]
call fcn.0045e73f
mov eax, esi
call fcn.00497214
ret 0xc