Function at 0x479470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5f4d88
push fcn.00556990
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x61094c]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x30], 0
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x4794c5
mov eax, dword [edi]
mov dword [ebp - 0x30], eax
mov eax, dword [ebx + 4]
test eax, eax
jne 0x479698
test dword [ebp + 0x18], 1
jne 0x479504
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
cmp dword [ebp + 0x1c], eax
je 0x4794f2
push dword [ebp + 8]
call fcn.00478c70
jmp 0x479698
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x479698
mov esi, dword [ebp + 0xc]
test edi, edi
jne 0x479517
test esi, esi
jne 0x479517
lea eax, [esi + 0x57]
jmp 0x479698
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebp + 8]
call fcn.00478fe0
test esi, esi
je 0x479532
mov ecx, dword [ebp - 0x28]
mov dword [esi], ecx
test eax, eax
jne 0x479698
test edi, edi
je 0x479698
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x24]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x4795c2
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x479592
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.005545a0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x34], esi
test esi, esi
je 0x4795c4
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4795fb
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.0056027d
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
test esi, esi
je 0x4795c4
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4795fb
xor esi, esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x4795fb
test esi, esi
jne 0x479607
lea eax, [esi + 0xe]
jmp 0x479698
push dword [ebp - 0x24]
push 0
push esi
call fcn.00556180
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp + 8]
mov ecx, ebx
call fcn.00478fe0
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x479681
cmp dword [ebp + 0x1c], eax
je 0x479658
mov ecx, dword [ebp - 0x28]
cmp ecx, 1
je 0x479641
cmp ecx, 7
jne 0x479658
mov eax, dword [ebp - 0x30]
mov dword [edi], eax
push edi
push dword [ebp + 0x10]
push esi
push ecx
mov ecx, ebx
call fcn.00479390
mov dword [ebp - 0x20], eax
jmp 0x479681
mov ecx, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x24]
test ecx, ecx
je 0x47967f
mov edx, dword [edi]
cmp ebx, edx
jbe 0x479672
mov eax, 0xea
mov dword [ebp - 0x20], eax
jmp 0x47967f
push ebx
push esi
call fcn.00428c00
add esp, 8
mov eax, dword [ebp - 0x20]
mov dword [edi], ebx
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x479698
push esi
call fcn.0055e7dd
mov eax, dword [ebp - 0x20]
add esp, 4
lea esp, [ebp - 0x48]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00553cca
mov esp, ebp
pop ebp
ret 0x18