Function at 0x47d337
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x144
mov eax, 0x499e48
call fcn.004961c2
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x120], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x14c], edi
mov dword [ebp - 0x148], edi
mov dword [ebp - 0x144], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x100], edi
lea ecx, [ebp + 0xc]
cmp eax, edi
jne 0x47d536
push 0x13
lea eax, [ebp - 0xfc]
push eax
call fcn.004600e8
mov eax, dword [eax]
mov esi, dword [sym.imp.MSVCR100.dll_wcscmp]
push str.HKEY_LOCAL_MACHINE_
push eax
call esi
pop ecx
mov ebx, eax
pop ecx
neg ebx
lea ecx, [ebp - 0xfc]
sbb bl, bl
call fcn.0045ddba
inc bl
push 0x12
je 0x47d3cd
mov dword [ebp - 0x100], connect
jmp 0x47d40d
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004600e8
mov eax, dword [eax]
push 0x4a04cc
push eax
call esi
pop ecx
mov ebx, eax
pop ecx
neg ebx
lea ecx, [ebp - 0xfc]
sbb bl, bl
call fcn.0045ddba
inc bl
je 0x47d512
mov dword [ebp - 0x100], connect
push 0x11
pop esi
push esi
push edi
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp + 0xc]
call fcn.00460063
push dword [ebp - 0x108]
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 2
call fcn.004616dc
mov ebx, eax
inc esi
push esi
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004600c5
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 3
call fcn.0045f9b8
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 2
call fcn.0045ddba
mov ecx, dword [ebp - 0x120]
push ebx
call fcn.00442ea8
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
call fcn.004627c5
test eax, eax
jne 0x47d4d8
push 0x50
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 4
cmp eax, edi
je 0x47d4a8
push 0x4a04c8
mov ecx, eax
call fcn.004430fc
jmp 0x47d4aa
xor eax, eax
mov ecx, dword [ebp - 0x120]
push eax
mov byte [ebp - 4], 2
mov dword [ebp - 0x104], eax
call fcn.00442c56
push ebx
push 0x49de40
lea ecx, [ebp - 0x104]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
lea ecx, [ebp - 0x104]
call fcn.004627c5
push eax
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x11c], esp
push eax
call fcn.0045e829
push dword [ebp - 0x100]
mov ecx, dword [ebp - 0x114]
call fcn.0047d337
lea ecx, [ebp - 0x108]
jmp 0x47dc40
xor edi, edi
inc edi
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0
call fcn.0045fe4f
lea ecx, [ebp + 0xc]
call fcn.0045ddba
mov eax, edi
call fcn.00496245
ret 0xc
push edi
push 0x5c
call fcn.0045f1f0
mov dword [ebp - 0x110], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x124]
call fcn.0045e829
mov byte [ebp - 4], 5
cmp dword [ebp - 0x110], edi
jle 0x47d594
push dword [ebp - 0x110]
lea eax, [ebp - 0xfc]
push edi
push eax
lea ecx, [ebp + 0xc]
call fcn.00460063
push eax
lea ecx, [ebp - 0x124]
mov byte [ebp - 4], 6
call fcn.0045f9b8
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 5
call fcn.0045ddba
push dword [ebp - 0x124]
lea ecx, [ebp - 0x14c]
call fcn.004616dc
mov ebx, eax
push ebx
mov ecx, esi
call fcn.00442ea8
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x118], eax
call fcn.004627c5
test eax, eax
jne 0x47d614
push 0x50
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 7
cmp eax, edi
je 0x47d5e8
push 0x4a04c8
mov ecx, eax
call fcn.004430fc
jmp 0x47d5ea
xor eax, eax
push eax
mov ecx, esi
mov byte [ebp - 4], 5
mov dword [ebp - 0x118], eax
call fcn.00442c56
push ebx
push 0x49de40
lea ecx, [ebp - 0x118]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
lea eax, [ebp - 0x100]
push eax
push connect
push edi
push dword [ebp - 0x124]
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x47dbed
mov eax, dword [ebp - 0x110]
cmp eax, edi
jle 0x47d6a6
inc eax
push eax
lea eax, [ebp - 0xfc]
push eax
lea ecx, [ebp + 0xc]
call fcn.004600c5
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 8
call fcn.0045f9b8
lea ecx, [ebp - 0xfc]
mov byte [ebp - 4], 5
call fcn.0045ddba
lea ecx, [ebp - 0x118]
call fcn.004627c5
push eax
push ecx
lea eax, [ebp + 0xc]
mov ecx, esp
mov dword [ebp - 0x11c], esp
push eax
call fcn.0045e829
push dword [ebp - 0x100]
mov ecx, dword [ebp - 0x114]
call fcn.0047d337
jmp 0x47dbdf
push edi
push edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x120]
push eax
push edi
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0x134]
push eax
push edi
push edi
push edi
push dword [ebp - 0x100]
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x120], edi
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x12c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jne 0x47dbdf
xor ebx, ebx
cmp dword [ebp - 0x134], ebx
jle 0x47d797
mov eax, dword [ebp - 0x138]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049608e
pop ecx
push ebx
mov esi, eax
mov eax, dword [ebp - 0x138]
push ebx
push ebx
inc eax
push ebx
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xfc]
push eax
push esi
push edi
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
jne 0x47d783
lea ecx, [ebp - 0x118]
call fcn.004627c5
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x11c], esp
push esi
call fcn.0045ffe5
push dword [ebp - 0x100]
mov ecx, dword [ebp - 0x114]
call fcn.0047d337
push esi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
inc edi
pop ecx
cmp edi, dword [ebp - 0x134]
jl 0x47d70f
mov dword [ebp - 0x110], ebx
cmp dword [ebp - 0x120], ebx
jle 0x47dbdd
mov eax, dword [ebp - 0x130]
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049608e
push dword [ebp - 0x12c]
mov dword [ebp - 0x114], eax
call fcn.0049608e
mov edi, eax
mov eax, dword [ebp - 0x130]
pop ecx
inc eax
pop ecx
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x128]
push eax
push edi
lea eax, [ebp - 0x108]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x150]
push eax
push dword [ebp - 0x114]
mov dword [ebp - 0x104], edi
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x47dbb2
push dword [ebp - 0x114]
lea ecx, [ebp - 0x14c]
call fcn.004616dc
lea ecx, [ebp - 0x118]
mov esi, eax
call fcn.004627c5
push esi
mov ecx, eax
call fcn.00442ea8
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x10c], eax
call fcn.004627c5
test eax, eax
jne 0x47d8b5
push 0x50
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x11c], eax
mov byte [ebp - 4], 9
cmp eax, ebx
je 0x47d896
push 0x4a04c4
mov ecx, eax
call fcn.004430fc
jmp 0x47d898
xor eax, eax
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 5
mov dword [ebp - 0x10c], eax
call fcn.004627c5
mov ecx, eax
call fcn.00442c56
push dword [ebp - 0x114]
lea ecx, [ebp - 0x14c]
call fcn.004616dc
push eax
push 0x49de40
lea ecx, [ebp - 0x10c]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
push 0x7f
lea eax, [ebp - 0xdb]
push ebx
push eax
mov byte [ebp - 0xdc], 0
call sub.MSVCR100.dll_memset
mov eax, dword [ebp - 0x108]
add esp, 0xc
cmp eax, 3
jne 0x47d909
mov eax, str.REG_BINARY
jmp 0x47d966
cmp eax, 4
jne 0x47d915
mov eax, str.REG_DWORD
jmp 0x47d966
cmp eax, 2
jne 0x47d921
mov eax, str.REG_EXPAND_SZ
jmp 0x47d966
cmp eax, 7
jne 0x47d92d
mov eax, str.REG_MULTI_SZ
jmp 0x47d966
cmp eax, 0xb
jne 0x47d939
mov eax, str.REG_QWORD
jmp 0x47d966
cmp eax, 1
jne 0x47d945
mov eax, str.REG_SZ
jmp 0x47d966
push eax
push str.Unknown_type__0x_08x_
lea eax, [ebp - 0xdc]
push 0x80
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x10
lea eax, [ebp - 0xdc]
push eax
push str.type
lea ecx, [ebp - 0x10c]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
mov eax, dword [ebp - 0x108]
cmp eax, 3
jne 0x47da54
mov dword [ebp - 0xe4], 0xf
mov dword [ebp - 0xe8], ebx
mov byte [ebp - 0xf8], 0
xor esi, esi
mov byte [ebp - 4], 0xa
cmp dword [ebp - 0x128], ebx
jle 0x47da1f
movzx eax, byte [esi + edi]
push eax
push 0x4a0450
lea eax, [ebp - 0x1c]
push 0xa
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
lea eax, [ebp - 0x1c]
push eax
call sub.MSVCR100.dll_strlen
add esp, 0x14
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0xf8]
call fcn.004621b7
cmp esi, dword [ebp - 0x128]
jge 0x47da07
mov ebx, 0x4b9cb0
push ebx
call sub.MSVCR100.dll_strlen
pop ecx
push eax
push ebx
lea ecx, [ebp - 0xf8]
call fcn.004621b7
xor ebx, ebx
inc esi
cmp esi, dword [ebp - 0x128]
jl 0x47d9b2
cmp dword [ebp - 0xe4], 0x10
mov eax, dword [ebp - 0xf8]
jae 0x47da25
lea eax, [ebp - 0xf8]
push eax
push str.value
lea ecx, [ebp - 0x10c]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
push ebx
push 1
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 5
call fcn.00461e79
jmp 0x47dbb2
cmp eax, 4
jne 0x47daa1
push 0x3f
lea eax, [ebp - 0x5b]
push ebx
push eax
mov byte [ebp - 0x5c], 0
call sub.MSVCR100.dll_memset
mov eax, dword [edi]
push eax
push eax
push str.0x_08x___lu_
lea eax, [ebp - 0x5c]
push 0x40
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x20
lea eax, [ebp - 0x5c]
push eax
push str.value
lea ecx, [ebp - 0x10c]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
jmp 0x47dbb2
cmp eax, 1
je 0x47db9b
cmp eax, 2
je 0x47db9b
cmp eax, 7
jne 0x47dbb2
mov ebx, dword [ebp - 0x104]
push 2
pop eax
xor esi, esi
xor edi, edi
sub eax, ebx
mov dword [ebp - 0x11c], eax
cmp word [ebx], 0
jne 0x47db92
mov eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 0x104]
lea eax, [eax + esi*2]
push eax
lea ecx, [ebp - 0xfc]
call fcn.00463d57
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0xb
call fcn.004616dc
push 0x50
mov esi, eax
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x13c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x47db30
push 0x4a043c
mov ecx, eax
call fcn.004430fc
jmp 0x47db32
xor eax, eax
push eax
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x13c], eax
call fcn.004627c5
mov ecx, eax
call fcn.00442c56
push esi
push str.value
lea ecx, [ebp - 0x13c]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
lea ecx, [ebp - 0xfc]
lea esi, [edi + 1]
mov byte [ebp - 4], 5
call fcn.0045ddba
cmp word [ebx], 0
jne 0x47db92
mov eax, dword [ebp - 0x104]
add eax, dword [ebp - 0x11c]
cmp word [eax + ebx], 0
je 0x47dbac
inc edi
add ebx, 2
jmp 0x47dad1
push edi
lea ecx, [ebp - 0x14c]
call fcn.004616dc
jmp 0x47da84
mov edi, dword [ebp - 0x104]
push dword [ebp - 0x114]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
inc dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
pop ecx
pop ecx
cmp eax, dword [ebp - 0x120]
jl 0x47d7a9
xor edi, edi
push dword [ebp - 0x100]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x47dc3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xfc]
push eax
call fcn.004609a6
pop ecx
pop ecx
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x14c]
mov byte [ebp - 4], 0xd
call fcn.004616dc
push eax
push str.error
lea ecx, [ebp - 0x118]
call fcn.004627c5
mov ecx, eax
call fcn.0044334e
lea ecx, [ebp - 0xfc]
call fcn.0045ddba
lea ecx, [ebp - 0x124]
call fcn.0045ddba
jmp 0x47d515