Function at 0x47d118
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x33b
push 0
push 0
dec ecx
jne 0x47d120
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d64
xor eax, eax
push ebp
push 0x47d915
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebx + 4], 0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x60]
mov edx, dword [0x4d04a4]
mov eax, 0x80000002
call fcn.0047da38
cmp dword [ebp - 0x40], 0
jbe 0x47d8aa
mov eax, dword [ebp - 0x40]
dec eax
test eax, eax
jb 0x47d8aa
inc eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x54], 0
push 0x400
lea eax, [ebp - 0x159c]
push eax
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.advapi32.dll_RegEnumKeyA
push dword [0x4d04a4]
push 0x47d930
lea edx, [ebp - 0x19a0]
lea eax, [ebp - 0x159c]
call fcn.00409adc
push dword [ebp - 0x19a0]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c34
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x64]
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.0047da38
cmp dword [ebp - 0x44], 0
jbe 0x47d892
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jb 0x47d892
inc eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x58], 0
push 0x400
lea eax, [ebp - 0x159c]
push eax
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x64]
push eax
call sub.advapi32.dll_RegEnumKeyA
push dword [ebp - 0xc]
push 0x47d930
lea edx, [ebp - 0x19a4]
lea eax, [ebp - 0x159c]
call fcn.00409adc
push dword [ebp - 0x19a4]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404c34
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x68]
mov edx, dword [ebp - 0x10]
mov eax, 0x80000002
call fcn.0047da38
cmp dword [ebp - 0x48], 0
jbe 0x47d87a
mov eax, dword [ebp - 0x48]
dec eax
test eax, eax
jb 0x47d87a
inc eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x5c], 0
push 0x400
lea eax, [ebp - 0x159c]
push eax
mov eax, dword [ebp - 0x5c]
push eax
mov eax, dword [ebp - 0x68]
push eax
call sub.advapi32.dll_RegEnumKeyA
push dword [ebp - 0x10]
push 0x47d930
lea edx, [ebp - 0x19a8]
lea eax, [ebp - 0x159c]
call fcn.00409adc
push dword [ebp - 0x19a8]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404c34
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
mov eax, 0x80000002
call fcn.0047da38
lea eax, [ebp - 0x199c]
xor ecx, ecx
mov edx, 0x400
call fcn.0040324c
lea eax, [ebp - 0x199c]
push eax
mov ecx, 0x47d93c
mov dx, word [ebp - 0x38]
mov eax, dword [ebp - 0x6c]
call fcn.0047dc20
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x199c]
call fcn.00409adc
lea eax, [ebp - 0x199c]
xor ecx, ecx
mov edx, 0x400
call fcn.0040324c
lea eax, [ebp - 0x199c]
push eax
mov ecx, 0x47d94c
mov dx, word [ebp - 0x38]
mov eax, dword [ebp - 0x6c]
call fcn.0047dc20
lea edx, [ebp - 0x20]
lea eax, [ebp - 0x199c]
call fcn.00409adc
lea eax, [ebp - 0x199c]
xor ecx, ecx
mov edx, 0x400
call fcn.0040324c
lea eax, [ebp - 0x199c]
push eax
mov ecx, 0x47d960
mov dx, word [ebp - 0x38]
mov eax, dword [ebp - 0x6c]
call fcn.0047dc20
lea edx, [ebp - 0x80]
lea eax, [ebp - 0x199c]
call fcn.00409adc
lea eax, [ebp - 0x199c]
push eax
mov ecx, 0x47d97c
mov dx, word [ebp - 0x38]
mov eax, dword [ebp - 0x6c]
call fcn.0047dc20
lea edx, [ebp - 0x24]
lea eax, [ebp - 0x199c]
call fcn.00409adc
lea edx, [ebp - 0x19ac]
mov eax, dword [ebp - 0x1c]
call fcn.00408d0c
mov eax, dword [ebp - 0x19ac]
push eax
lea edx, [ebp - 0x19b0]
mov eax, dword [ebp - 4]
call fcn.00408d0c
mov edx, dword [ebp - 0x19b0]
pop eax
call fcn.00404cc0
jne 0x47d862
lea eax, [ebp - 0x18]
mov ecx, 0x47d990
mov edx, dword [ebp - 0x14]
call fcn.00404bc0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x70]
mov edx, dword [ebp - 0x18]
mov eax, 0x80000002
call fcn.0047da38
lea eax, [ebp - 0x119c]
push eax
mov ecx, 0x47d9a4
mov dx, word [ebp - 0x3c]
mov eax, dword [ebp - 0x70]
call fcn.0047dc20
neg al
sbb eax, eax
test eax, eax
je 0x47d862
cmp word [ebx + 4], 0x3ff
jae 0x47d69d
inc word [ebx + 4]
movzx eax, word [ebx + 4]
lea eax, [ebx + eax*4 + 4]
mov edx, dword [ebp - 0x20]
call fcn.00404908
movzx eax, word [ebx + 4]
lea eax, [ebx + eax*4 + 0x84]
mov edx, dword [ebp - 0x24]
call fcn.00404908
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0x40
jne 0x47d4a6
lea eax, [ebp - 0x19b4]
push eax
mov ecx, 2
mov edx, 0x47d9b8
mov eax, dword [ebp - 0x24]
call fcn.004750bc
mov edx, dword [ebp - 0x19b4]
movzx eax, word [ebx + 4]
lea eax, [ebx + eax*4 + 0x84]
call fcn.00404908
mov eax, dword [ebp - 0x80]
cmp byte [eax], 0x40
jne 0x47d5a3
mov edx, dword [ebp - 0x80]
mov eax, 0x47d9c4
call fcn.00404eb8
xor ecx, ecx
mov cl, al
inc ecx
lea eax, [ebp - 0x80]
mov edx, 1
call fcn.00404e14
mov edx, dword [ebp - 0x80]
mov eax, 0x47d9d0
call fcn.00404eb8
xor edx, edx
mov dl, al
lea eax, [ebp - 0x80]
mov ecx, pe_nt_image_headers32
call fcn.00404e14
lea eax, [ebp - 0x84]
mov edx, dword [ebp - 0x80]
call fcn.0040494c
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x19d0]
push eax
mov ecx, 1
mov edx, 0x47d9dc
mov eax, dword [ebp - 0x84]
call fcn.004750bc
mov eax, dword [ebp - 0x19d0]
mov dword [ebp - 0x19cc], eax
mov byte [ebp - 0x19c8], 0xb
lea eax, [ebp - 0x19d4]
push eax
mov ecx, 2
mov edx, 0x47d9dc
mov eax, dword [ebp - 0x84]
call fcn.004750bc
mov eax, dword [ebp - 0x19d4]
mov dword [ebp - 0x19c4], eax
mov byte [ebp - 0x19c0], 0xb
lea eax, [ebp - 0x19d8]
push eax
mov ecx, 3
mov edx, 0x47d9dc
mov eax, dword [ebp - 0x84]
call fcn.004750bc
mov eax, dword [ebp - 0x19d8]
mov dword [ebp - 0x19bc], eax
mov byte [ebp - 0x19b8], 0xb
lea edx, [ebp - 0x19cc]
mov ecx, 2
mov eax, 0x47d9e8
call fcn.00409fcc
movzx eax, word [ebx + 4]
lea eax, [ebx + eax*4 + 0xc4]
mov edx, dword [ebp - 0x80]
call fcn.00404908
movzx eax, word [ebx + 4]
lea eax, [eax + eax*2]
lea edx, [ebx + eax*2 + 0xfa6]
push edx
lea ecx, [ebx + eax*2 + 0xfa4]
lea edx, [ebx + eax*2 + 0xfa2]
mov eax, dword [ebp - 0x80]
call fcn.0047dcf0
lea eax, [ebp - 0x199c]
xor ecx, ecx
mov edx, 0x400
call fcn.0040324c
lea eax, [ebp - 0x18]
mov ecx, 0x47da14
mov edx, dword [ebp - 0x14]
call fcn.00404bc0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x70]
mov edx, dword [ebp - 0x18]
mov eax, 0x80000002
call fcn.0047da38
lea eax, [ebp - 0x199c]
push eax
mov ecx, 0x47da30
mov dx, word [ebp - 0x3c]
mov eax, dword [ebp - 0x70]
call fcn.0047dc20
lea edx, [ebp - 0x19dc]
lea eax, [ebp - 0x199c]
call fcn.00409adc
mov edx, dword [ebp - 0x19dc]
movzx eax, word [ebx + 4]
lea eax, [ebx + eax*4 + 0x44]
call fcn.00404908
movzx eax, word [ebx + 4]
lea eax, [eax + eax*8]
mov word [ebx + eax*2 + 0xf6], 0
movzx eax, word [ebx + 4]
lea eax, [eax + eax*8]
mov word [ebx + eax*2 + 0x216], 0
movzx eax, word [ebx + 4]
mov edx, eax
shl eax, 5
add eax, edx
mov word [ebx + eax*2 + 0x306], 0
movzx eax, word [ebx + 4]
mov edx, eax
shl eax, 5
add eax, edx
mov word [ebx + eax*4 + 0x6e4], 0
mov al, byte [ebp - 0x119c]
test al, al
jbe 0x47d862
mov byte [ebp - 0x91], al
lea eax, [ebp - 0x118c]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dl, byte [eax]
test dl, dl
jbe 0x47d84c
mov eax, dword [ebp - 0x98]
add eax, 4
mov esi, eax
mov cl, byte [esi]
dec cl
je 0x47d6fb
dec cl
je 0x47d766
dec cl
je 0x47d7a8
dec cl
je 0x47d80b
jmp 0x47d841
movzx ecx, word [ebx + 4]
mov edi, ecx
shl ecx, 5
add ecx, edi
inc word [ebx + ecx*2 + 0x306]
movzx ecx, word [ebx + 4]
mov edi, ecx
shl ecx, 5
add ecx, edi
mov cl, byte [ebx + ecx*2 + 0x306]
mov byte [ebp - 0x25], cl
xor ecx, ecx
mov cl, byte [ebp - 0x25]
movzx edi, word [ebx + 4]
imul edi, edi, 0x21
lea edi, [ebx + edi*2]
lea ecx, [edi + ecx*2 + 0x306]
push ecx
mov cx, word [esi + 4]
pop edi
mov word [edi], cx
mov cx, word [esi + 4]
add cx, word [esi + 0xc]
dec ecx
movzx esi, byte [ebp - 0x25]
movzx edi, word [ebx + 4]
imul edi, edi, 0x21
lea edi, [ebx + edi*2]
mov word [edi + esi*2 + 0x326], cx
jmp 0x47d841
movzx ecx, word [ebx + 4]
lea ecx, [ecx + ecx*8]
inc word [ebx + ecx*2 + 0xf6]
movzx ecx, word [ebx + 4]
lea ecx, [ecx + ecx*8]
mov cl, byte [ebx + ecx*2 + 0xf6]
mov byte [ebp - 0x25], cl
xor ecx, ecx
mov cl, byte [ebp - 0x25]
movzx edi, word [ebx + 4]
lea edi, [edi + edi*8]
lea edi, [ebx + edi*2]
lea ecx, [edi + ecx + 0xf7]
push ecx
mov cl, byte [esi + 8]
pop esi
mov byte [esi], cl
jmp 0x47d841
movzx ecx, word [ebx + 4]
mov edi, ecx
shl ecx, 5
add ecx, edi
inc word [ebx + ecx*4 + 0x6e4]
movzx ecx, word [ebx + 4]
mov edi, ecx
shl ecx, 5
add ecx, edi
mov cl, byte [ebx + ecx*4 + 0x6e4]
mov byte [ebp - 0x25], cl
xor ecx, ecx
mov cl, byte [ebp - 0x25]
movzx edi, word [ebx + 4]
imul edi, edi, 0x21
lea edi, [ebx + edi*4]
lea ecx, [edi + ecx*4 + 0x6e4]
push ecx
mov ecx, dword [esi + 4]
pop edi
mov dword [edi], ecx
mov ecx, dword [esi + 4]
add ecx, dword [esi + 0xc]
dec ecx
movzx esi, byte [ebp - 0x25]
movzx edi, word [ebx + 4]
imul edi, edi, 0x21
lea edi, [ebx + edi*4]
mov dword [edi + esi*4 + 0x724], ecx
jmp 0x47d841
movzx ecx, word [ebx + 4]
lea ecx, [ecx + ecx*8]
inc word [ebx + ecx*2 + 0x216]
movzx ecx, word [ebx + 4]
lea ecx, [ecx + ecx*8]
movzx ecx, word [ebx + ecx*2 + 0x216]
movzx edi, word [ebx + 4]
lea edi, [edi + edi*8]
lea edi, [ebx + edi*2]
lea ecx, [edi + ecx + 0x217]
push ecx
mov cl, byte [esi + 4]
pop esi
mov byte [esi], cl
add eax, 0x10
dec dl
jne 0x47d6d6
add dword [ebp - 0x98], 0x110
dec byte [ebp - 0x91]
jne 0x47d6bd
mov eax, dword [ebp - 0x6c]
push eax
call sub.advapi32.dll_RegCloseKey
inc dword [ebp - 0x5c]
dec dword [ebp - 0x90]
jne 0x47d290
mov eax, dword [ebp - 0x68]
push eax
call sub.advapi32.dll_RegCloseKey
inc dword [ebp - 0x58]
dec dword [ebp - 0x8c]
jne 0x47d20f
mov eax, dword [ebp - 0x64]
push eax
call sub.advapi32.dll_RegCloseKey
inc dword [ebp - 0x54]
dec dword [ebp - 0x88]
jne 0x47d18b
mov eax, dword [ebp - 0x60]
push eax
call sub.advapi32.dll_RegCloseKey
cmp word [ebx + 4], 0
seta al
neg al
sbb eax, eax
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d91c
lea eax, [ebp - 0x19dc]
mov edx, 4
call fcn.004048d8
lea eax, [ebp - 0x19b4]
mov edx, 6
call fcn.004048d8
lea eax, [ebp - 0x84]
mov edx, 2
call fcn.004048d8
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.004048d8
lea eax, [ebp - 4]
call fcn.004048b4
ret