Function at 0x419470
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2f8
mov eax, 0x49e9ec
call fcn.0047bb4d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x250]
push eax
push 0x20019
xor edi, edi
push edi
mov ebx, 0x4b1270
push ebx
push reloc.OLEAUT32.DLL_SysReAllocString
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
cmp eax, edi
je 0x419547
push eax
lea ecx, [ebp - 0x24c]
call fcn.00407d0d
pop ecx
mov ebx, eax
mov dword [ebp - 4], edi
lea eax, [ebp - 0x304]
push eax
call fcn.004090fb
mov esi, eax
mov byte [ebp - 4], 1
push 0x4b12b8
push esi
call fcn.0040b677
push esi
mov ecx, ebx
call fcn.0040b9a3
add esp, 0xc
lea ebx, [ebp - 0x230]
mov ecx, esi
call fcn.00409165
push 2
pop ecx
mov byte [ebp - 4], cl
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x41950e
mov eax, ebx
push eax
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
call fcn.00403d16
mov byte [ebp - 4], 0
lea eax, [ebp - 0x304]
call fcn.00407bad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00403d16
jmp 0x419736
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x258]
push eax
push edi
push edi
push edi
push dword [ebp - 0x250]
mov dword [ebp - 0x258], edi
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyW]
test eax, eax
jne 0x41972a
mov dword [ebp - 0x254], edi
cmp dword [ebp - 0x258], edi
jbe 0x41972a
mov esi, 0x4a9bc8
xor eax, eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x268]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x254]
mov dword [ebp - 0x260], 0x100
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.DLL_RegEnumKeyExW]
cmp eax, 0x103
je 0x41972a
cmp eax, edi
jne 0x419693
lea eax, [ebp - 0x214]
push eax
call fcn.00477a67
pop ecx
cmp eax, 9
jbe 0x419676
push 9
lea eax, [ebp - 0x214]
push 0x4b1368
push eax
call fcn.00478103
add esp, 0xc
test eax, eax
jne 0x419676
lea eax, [ebp - 0x230]
push eax
mov eax, ebx
call fcn.00404cae
mov dword [ebp - 4], 6
push esi
call fcn.00477a67
pop ecx
mov edi, eax
push esi
lea eax, [ebp - 0x230]
call fcn.00405148
lea eax, [ebp - 0x214]
push eax
call fcn.00477a67
pop ecx
lea ecx, [ebp - 0x214]
mov edi, eax
push ecx
lea eax, [ebp - 0x230]
call fcn.00405148
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x230]
call fcn.00419a16
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.00403d16
xor edi, edi
inc dword [ebp - 0x254]
mov eax, dword [ebp - 0x254]
cmp eax, dword [ebp - 0x258]
jb 0x419589
jmp 0x41972a
lea eax, [ebp - 0x24c]
push eax
call fcn.00407cf0
pop ecx
mov edi, eax
mov dword [ebp - 4], 3
lea eax, [ebp - 0x304]
push eax
call fcn.004090fb
mov esi, eax
mov byte [ebp - 4], 4
push 0x4b1310
push esi
call fcn.0040b677
push esi
mov ecx, edi
call fcn.0040b9a3
add esp, 0xc
lea ebx, [ebp - 0x230]
mov ecx, esi
call fcn.00409165
mov byte [ebp - 4], 5
cmp dword [ebp - 0x21c], 8
mov eax, dword [ebp - 0x230]
jae 0x4196f3
mov eax, ebx
push eax
push 2
pop ecx
call fcn.0040d57f
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x230]
call fcn.00403d16
mov byte [ebp - 4], 3
lea eax, [ebp - 0x304]
call fcn.00407bad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00403d16
push dword [ebp - 0x250]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
call fcn.0047bbd0
ret 4