Function at 0x47b0c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x496071
mov eax, dword fs:[0]
push eax
sub esp, 0x314
mov eax, dword [0x4a93dc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
mov dword [ebp - 0x268], edi
mov ebx, ecx
mov dword [ebp - 0x26c], edi
mov dword [ebp - 0x318], 0x49a3d8
mov dword [ebp - 0x308], 0x49a3e0
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea eax, [ebp - 0x300]
push eax
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], edi
mov esi, 1
push ecx
mov dword [ebp - 0x268], esi
call fcn.004077f0
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x318]
mov eax, dword [edx + 4]
lea ecx, [ebp - 0x300]
push ecx
mov dword [ebp + eax - method.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
call fcn.00407b20
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0x2c4], edi
mov dword [ebp - 0x2c0], edi
push 0x206
lea eax, [ebp - 0x216]
xor edx, edx
push edi
mov dword [ebp - 4], 3
push eax
mov word [ebp - 0x218], dx
call fcn.00489270
add esp, 0xc
mov dword [ebp - 0x270], 0x208
cmp dword [0x4ab7dc], esi
jle 0x47b2a1
mov ecx, dword [0x4ab7e4]
mov eax, dword [ecx + 4]
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x10], edi
xor edx, edx
mov ecx, eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x268], esp
mov word [esi], dx
lea edi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x47b1e0
sub ecx, edi
sar ecx, 1
push ecx
call fcn.00401d40
lea esi, [ebp - 0x264]
call fcn.004010a0
lea edi, [ebp - 0x234]
mov eax, esi
mov byte [ebp - 4], 4
call fcn.00401310
lea esi, [ebx + 0x68]
mov edi, eax
mov byte [ebp - 4], 5
call fcn.004019e0
mov esi, 8
cmp dword [ebp - 0x220], esi
jb 0x47b23b
mov eax, dword [ebp - 0x234]
push eax
call fcn.00480861
add esp, 4
cmp dword [ebp - 0x240], esi
jb 0x47b252
mov ecx, dword [ebp - 0x254]
push ecx
call fcn.00480861
add esp, 4
xor edx, edx
mov dword [ebp - 0x240], 7
mov dword [ebp - 0x244], 0
mov word [ebp - 0x254], dx
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x260]
mov ecx, dword [eax]
push eax
push ecx
lea edi, [ebp - 0x268]
lea esi, [ebp - 0x264]
call fcn.004020c0
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0x260]
push eax
call fcn.00480861
add esp, 4
mov eax, dword [ebx + 0x78]
lea esi, [ebx + 0x68]
push 0x49a07c
xor edi, edi
mov ecx, esi
mov dword [ebp - 0x268], esi
call fcn.00402aa0
test eax, eax
jne 0x47b55f
push str.updater
push ecx
push 0x49a32c
push ecx
push 0x4a413c
push ecx
push 0x49a32c
push ecx
lea ecx, [ebp - 0x308]
push 0x4a3f7c
push ecx
call fcn.004080f0
add esp, 0xc
push eax
call fcn.004080f0
add esp, 0xc
push eax
call fcn.004080f0
add esp, 0xc
push eax
call fcn.004080f0
add esp, 0xc
push eax
call fcn.004080f0
add esp, 8
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x318]
call fcn.00406ef0
cmp dword [eax + 0x14], 8
jb 0x47b32c
mov eax, dword [eax]
lea edx, [ebp - 0x26c]
push edx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
sete bl
cmp dword [ebp - 0x220], 8
jb 0x47b35c
mov eax, dword [ebp - 0x234]
push eax
call fcn.00480861
add esp, 4
test bl, bl
je 0x47b3b9
mov eax, dword [ebp - 0x26c]
lea ecx, [ebp - 0x270]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push 0
push 0x49a2f4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47b3ac
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47b391
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
call fcn.00401d40
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0x10]
push 0x49a07c
xor edi, edi
mov ecx, esi
call fcn.00402aa0
test eax, eax
jne 0x47b55f
xor edx, edx
mov dword [ebp - 0x224], eax
mov edi, 7
push edx
mov eax, 0x49a07c
lea esi, [ebp - 0x234]
mov dword [ebp - 0x220], edi
mov word [ebp - 0x234], dx
call fcn.00401d40
mov eax, esi
lea ecx, [ebp - 0x300]
mov byte [ebp - 4], 7
call fcn.004791d0
mov esi, 8
mov byte [ebp - 4], 3
cmp dword [ebp - 0x220], esi
jb 0x47b42e
mov eax, dword [ebp - 0x234]
push eax
call fcn.00480861
add esp, 4
push 0x4a413c
push ecx
push 0x49a32c
push ecx
lea ecx, [ebp - 0x308]
push 0x4a3f7c
push ecx
call fcn.004080f0
add esp, 0xc
push eax
call fcn.004080f0
add esp, 0xc
push eax
call fcn.004080f0
add esp, 8
lea ecx, [ebp - 0x234]
lea eax, [ebp - 0x318]
call fcn.00406ef0
cmp dword [eax + 0x14], esi
jb 0x47b478
mov eax, dword [eax]
lea edx, [ebp - 0x26c]
push edx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
sete bl
cmp dword [ebp - 0x220], esi
jb 0x47b4a7
mov eax, dword [ebp - 0x234]
push eax
call fcn.00480861
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], cx
test bl, bl
je 0x47b538
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x218]
push eax
push ecx
push ecx
mov ecx, dword [ebp - 0x26c]
push 0x49a2f4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47b523
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47b4f3
mov esi, dword [ebp - 0x268]
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
call fcn.00401d40
mov edx, dword [ebp - 0x26c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47b53e
mov edx, dword [ebp - 0x26c]
mov esi, dword [ebp - 0x268]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47b53e
mov esi, dword [ebp - 0x268]
mov eax, dword [esi + 0x10]
push 0x49a07c
xor edi, edi
mov ecx, esi
call fcn.00402aa0
test eax, eax
jne 0x47b55f
push 0xb
mov eax, str.default_sid
call fcn.00401d40
lea ecx, [ebp - 0x318]
mov dword [ebp - 4], 0xffffffff
call fcn.00406300
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0048036c
mov esp, ebp
pop ebp
ret