Function at 0x450201
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
xor eax, eax
mov ecx, 0x41
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x220]
xor esi, esi
push ebx
xor ebx, ebx
sub esp, 0x2ac
mov dword [ebp - 0x278], ebx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x27c]
mov dword [ebp - 0x270], ebx
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x20019
mov dword [esp + 8], esi
mov dword [esp + 4], str.SOFTWAREMicrosoftWIMMountMounted_Images
mov dword [esp], 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
sub esp, 0x14
test eax, eax
je 0x450265
xor eax, eax
jmp 0x45049c
lea eax, [ebp - 0x254]
xor ecx, ecx
lea esi, [ebp - 0x250]
xor ebx, ebx
mov dword [ebp - 0x26c], 0x104
mov dword [esp + 0x28], eax
lea eax, [ebp - 0x258]
mov dword [esp + 0x24], eax
lea eax, [ebp - 0x25c]
mov dword [esp + 0x20], eax
lea eax, [ebp - 0x260]
mov dword [esp + 0x1c], eax
lea eax, [ebp - 0x264]
mov dword [esp + 0x18], eax
lea eax, [ebp - 0x268]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x270]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x26c]
mov dword [esp + 8], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0x2c], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
sub esp, 0x30
mov eax, dword [ebp - 0x27c]
cmp ebx, dword [ebp - 0x270]
jae 0x450473
xor edx, edx
lea edi, [ebp - 0x248]
mov dword [ebp - 0x278], 0x28
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x278]
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], edi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
sub esp, 0x20
test eax, eax
je 0x450346
inc ebx
jmp 0x4502ed
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x11c]
mov dword [esp + 8], str.SOFTWAREMicrosoftWIMMountMounted_Images_sWIM_Path
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [ebp - 0x19], 0
mov ecx, 1
mov edx, edi
mov dword [esp + 4], 0x104
mov eax, 0x80000002
mov dword [esp], 0x52a940
call fcn.0044e84a
test eax, eax
jne 0x4503ea
lea edx, [ebp - 0x11c]
lea edi, [ebp - 0x248]
mov dword [esp + 8], str.SOFTWAREMicrosoftWIMMountMounted_Images_sImage_Index
mov dword [esp], edx
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x104
call dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [ebp - 0x274]
mov byte [ebp - 0x19], 0
mov ecx, 4
mov dword [esp], eax
lea edx, [ebp - 0x11c]
mov eax, 0x80000002
mov dword [esp + 4], 4
call fcn.0044e84a
test eax, eax
jne 0x450406
jmp 0x450415
mov eax, dword [ebp + 8]
mov dword [esp], 0x52a940
mov dword [esp + 4], eax
call sub.msvcrt.dll__stricmp_1
test eax, eax
je 0x450391
jmp 0x450343
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x274], eax
jne 0x450343
mov byte [0x52a940], 0
mov dword [esp + 0xc], edi
lea edi, [ebp - 0x11c]
mov dword [esp + 8], str.SOFTWAREMicrosoftWIMMountMounted_Images_sMount_Path
mov dword [esp + 4], 0x104
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll__snprintf]
mov byte [ebp - 0x19], 0
mov ecx, 1
mov edx, edi
mov dword [esp + 4], 0x104
mov eax, 0x80000002
mov dword [esp], 0x52a940
call fcn.0044e84a
test eax, eax
je 0x450343
cmp ebx, dword [ebp - 0x270]
jb 0x45047a
mov byte [0x52a940], 0
mov eax, dword [ebp - 0x27c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
cmp byte [0x52a940], 0
je 0x45025e
mov eax, 0x52a940
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret