Function at 0x47ffd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x82c
mov eax, dword [0x563a68]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
mov byte [ebp - 0x418], 0
push 0x3ff
push 0
lea eax, [ebp - 0x417]
push eax
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov byte [ebp - 0x820], 0
push 0x3ff
push 0
lea ecx, [ebp - 0x81f]
push ecx
call fcn.004054d0
add esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0x41c], 0x400
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x420], 0
mov edx, dword [ebp + 0xc]
mov eax, dword [edx + 0x58]
push eax
push 0x5697f8
lea ecx, [ebp - 0x418]
push ecx
call fcn.004633a8
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
push 0x20007
push 0
push 0x569804
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x48011c
push 0x56982c
mov eax, dword [0x5d3d1c]
push eax
call fcn.00463647
add esp, 8
cmp dword [0x589f34], 0
je 0x48010b
mov ecx, dword [0x589f34]
cmp dword [ecx + 0x80], 0
je 0x4800ce
xor edx, edx
je 0x4800ce
mov eax, dword [0x589f34]
mov ecx, dword [eax + 0x80]
mov dword [ebp - 0x828], ecx
jmp 0x4800d8
mov dword [ebp - 0x828], 0xffffff86
mov edx, dword [0x589f34]
mov eax, dword [ebp - 0x828]
mov dword [edx + 0x80], eax
push 0
push 0xff
push 0
push 0
push 0x24f
push 0xffffffffffffff86
mov ecx, dword [0x589f34]
push ecx
call fcn.00495fc0
add esp, 0x1c
mov edx, dword [0x589f34]
mov eax, dword [edx + 0x80]
jmp 0x48029f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x82c], eax
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x820]
push edx
mov eax, dword [ebp - 0x82c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
test eax, eax
jne 0x480293
mov eax, dword [ebp - 0x41c]
mov byte [ebp + eax - 0x820], 0
lea ecx, [ebp - 0x418]
push ecx
call fcn.004035e0
add esp, 4
push eax
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x820]
push eax
call fcn.00408106
add esp, 0xc
test eax, eax
jne 0x480284
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
call fcn.004035e0
add esp, 4
push eax
mov edx, dword [ebp + 0xc]
add edx, 4
push edx
lea eax, [ebp - 0x820]
push eax
call fcn.004035e0
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 0xc]
add ecx, 4
push ecx
call fcn.004035e0
add esp, 4
sub esi, eax
lea edx, [ebp + esi - 0x820]
push edx
call fcn.00408106
add esp, 0xc
test eax, eax
jne 0x480284
mov dword [ebp - 0x420], 0
push 1
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x820]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0048dc00
add esp, 0x14
cmp dword [ebp - 0x420], 0
je 0x480282
mov dword [ebp - 0x824], 0
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [ebp - 0x420]
jae 0x480262
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x824]
movsx eax, byte [edx]
xor eax, 0xff
mov ecx, dword [ebp - 4]
add ecx, dword [ebp - 0x824]
mov byte [ecx], al
mov edx, dword [ebp - 0x824]
add edx, 2
mov dword [ebp - 0x824], edx
jmp 0x480227
push 1
mov eax, dword [ebp - 0x420]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x820]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0048def0
add esp, 0x14
jmp 0x480293
mov dword [ebp - 0x41c], 0x400
jmp 0x48011c
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0040526d
mov esp, ebp
pop ebp
ret