Function at 0x4a7df0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x56003e
mov eax, dword fs:[0]
push eax
sub esp, 0x4d0
mov eax, dword [0x5c04b4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push 0x54
mov dword [ebp - 0x4d4], ebx
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4b8], 0
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x4d0], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4a7e63
mov ecx, eax
call fcn.004a7890
mov edi, eax
jmp 0x4a7e65
xor edi, edi
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x4b4]
mov ecx, edi
push eax
push 0
push 0x1000600
call fcn.004a7950
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4b4]
push eax
push ecx
push dword [ebp - 0x4c4]
push ebx
call fcn.00463e90
lea ebx, [esi + 0x21f0]
mov esi, dword [ebx + 8]
push ecx
mov ecx, ebx
mov dword [ebp - 0x4d0], ebx
lea eax, [esi + 1]
push eax
call fcn.00433880
mov eax, dword [ebx + 4]
mov edx, 0x58a418
push 0x20019
mov ecx, reloc.WS2_32.dll_bind
mov dword [eax + esi*4], edi
lea eax, [ebp - 0x4bc]
push eax
mov dword [edi + 4], esi
call fcn.00518680
add esp, 8
test al, al
je 0x4a8112
xor eax, eax
push 0x105
mov dword [ebp - 0x4c0], eax
lea eax, [ebp - 0x224]
push eax
push 0
push dword [ebp - 0x4bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, dword [0x5c00ac]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
test eax, eax
jne 0x4a8107
mov edi, dword [0x5c0058]
jmp 0x4a7f30
inc dword [ebp - 0x4c0]
lea eax, [ebp - 0x4d8]
push eax
lea eax, [ebp - 0x224]
push str._08X
push eax
call dword [sym.imp.MSVCR120.dll_swscanf_s]
add esp, 0xc
cmp eax, 1
jne 0x4a80e0
mov ecx, dword [ebp - 0x4bc]
lea eax, [ebp - 0x4c8]
push 0x20019
push eax
lea edx, [ebp - 0x224]
call fcn.00518680
add esp, 8
test al, al
je 0x4a80e0
mov esi, dword [ebp - 0x4c8]
lea eax, [ebp - 0x4b8]
push eax
push 0
lea eax, [ebp - 0x4cc]
mov dword [ebp - 0x4b8], 0x208
push eax
push 0
push str.Filename
push esi
call edi
test eax, eax
je 0x4a7fb8
push eax
call ebx
xor bl, bl
jmp 0x4a800d
mov eax, dword [ebp - 0x4cc]
cmp eax, 1
je 0x4a7fd0
cmp eax, 2
je 0x4a7fd0
push 0xd
call ebx
xor bl, bl
jmp 0x4a800d
cmp dword [ebp - 0x4b8], 0x208
jbe 0x4a7fe4
push 0x7a
call ebx
xor bl, bl
jmp 0x4a800d
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x434]
push eax
lea eax, [ebp - 0x4cc]
push eax
push 0
push str.Filename
push esi
call edi
mov esi, eax
push esi
call ebx
test esi, esi
sete bl
push dword [ebp - 0x4c8]
mov esi, dword [0x5c00ac]
call esi
test bl, bl
je 0x4a80da
push 0x54
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4a804a
mov ecx, eax
call fcn.004a7890
mov edi, eax
jmp 0x4a804c
xor edi, edi
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4a80d4
lea eax, [ebp - 0x4b8]
mov dword [ebp - 0x4b8], 0
push eax
lea eax, [ebp - 0x4b4]
mov ecx, edi
push eax
lea eax, [ebp - 0x434]
push eax
push dword [ebp - 0x4d8]
call fcn.004a7950
test eax, eax
je 0x4a8091
mov eax, dword [edi]
mov ecx, edi
push 1
call dword [eax]
jmp 0x4a80d4
push dword [ebp - 0x4b8]
lea eax, [ebp - 0x4b4]
push eax
push ecx
push dword [ebp - 0x4c4]
push dword [ebp - 0x4d4]
call fcn.00463e90
mov ebx, dword [ebp - 0x4d0]
push ecx
mov ecx, ebx
mov esi, dword [ebx + 8]
lea eax, [esi + 1]
push eax
call fcn.00433880
mov eax, dword [ebx + 4]
mov dword [eax + esi*4], edi
mov dword [edi + 4], esi
mov esi, dword [0x5c00ac]
mov edi, dword [0x5c0058]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push 0x105
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp - 0x4c0]
push eax
push dword [ebp - 0x4bc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x4a7f30
push dword [ebp - 0x4bc]
call esi
push eax
call ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00553510
mov esp, ebp
pop ebp
ret 0xc