Function at 0x452350
Capabilities:
Enumerate files on windows
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20478
call fcn.0042beb0
mov eax, dword [0x48d800]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x20478], ecx
push 0x479c3c
lea eax, [ebp - 0x20470]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x1025c]
push ecx
lea edx, [ebp - 0x20470]
push edx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x452514
mov dword [ebp - 0x20474], 0
jmp 0x4523bb
mov eax, dword [ebp - 0x20474]
add eax, 1
mov dword [ebp - 0x20474], eax
push 0x104
lea ecx, [ebp - 0x10468]
push ecx
mov edx, dword [ebp - 0x20474]
push edx
mov eax, dword [ebp - 0x1025c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4523fc
mov ecx, dword [ebp - 0x1025c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x20478]
call fcn.00451b90
jmp 0x45262d
movzx edx, word [ebp - 0x10466]
cmp edx, 0x3a
jne 0x45240a
jmp 0x45240c
jmp 0x4523ac
lea eax, [ebp - 0x10468]
push eax
lea ecx, [ebp - 0x10008]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x1025c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x479c70
lea eax, [ebp - 0x20470]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x10468]
push ecx
lea edx, [ebp - 0x20470]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x1025c]
push eax
lea ecx, [ebp - 0x20470]
push ecx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x452500
push 0x104
lea edx, [ebp - 0x10468]
push edx
push 0
mov eax, dword [ebp - 0x1025c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4524a2
mov ecx, dword [ebp - 0x1025c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x452500
push 0x479c74
lea edx, [ebp - 0x10008]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x10468]
push eax
lea ecx, [ebp - 0x10008]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x479c78
lea edx, [ebp - 0x20470]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x10468]
push eax
lea ecx, [ebp - 0x20470]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp - 0x1025c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x452453
push 0x479c7c
lea eax, [ebp - 0x10008]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x452524
mov ecx, dword [ebp - 0x20478]
call fcn.00451b90
jmp 0x45262d
mov dword [ebp - 0x10258], 0x825
push 0xffff0002
push 0xffff0000
push 0
push 0
push 0
push 1
push 0
lea ecx, [ebp - 0x10008]
push ecx
push 0x27
mov ecx, dword [ebp - 0x20478]
add ecx, 0x78
call fcn.0040c00e
mov dword [ebp - 4], eax
push 0x479c80
lea edx, [ebp - 0x10008]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x10258]
push eax
lea ecx, [ebp - 0x10008]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x1046c], eax
cmp dword [ebp - 0x1046c], 0xffffffff
jne 0x452596
jmp 0x45262d
mov edx, dword [ebp - 0x10258]
and edx, 0x410
jne 0x4525ce
push 0xffff0002
mov eax, dword [ebp - 4]
push eax
push 1
push 0
push 0
push 4
push 4
lea ecx, [ebp - 0x1022c]
push ecx
push 0x27
mov ecx, dword [ebp - 0x20478]
add ecx, 0x78
call fcn.0040c00e
lea edx, [ebp - 0x10258]
push edx
mov eax, dword [ebp - 0x1046c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x452620
mov ecx, dword [ebp - 0x10258]
and ecx, 0x410
jne 0x45261e
push 0xffff0002
mov edx, dword [ebp - 4]
push edx
push 1
push 0
push 0
push 4
push 4
lea eax, [ebp - 0x1022c]
push eax
push 0x27
mov ecx, dword [ebp - 0x20478]
add ecx, 0x78
call fcn.0040c00e
jmp 0x4525ce
mov ecx, dword [ebp - 0x1046c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00427b2d
mov esp, ebp
pop ebp
ret