Function at 0x472fca
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x3c
mov eax, 0x483b98
call fcn.00482ede
mov ebx, edx
mov dword [ebp - 0x18], ecx
lea eax, [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
xor eax, eax
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x30]
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
xor eax, eax
mov word [ebp - 0x30], ax
mov edi, 0x101
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp + 0xc]
mov eax, esi
mov byte [ebp - 4], 2
sub eax, ecx
je 0x4730a0
sub eax, 1
je 0x47309b
sub eax, 1
je 0x4730a0
mov edi, dword [0x4aa6b4]
test edi, edi
je 0x473045
push esi
push 0x4637dc
cmp dword [0x4aa6b0], ecx
jne 0x473094
mov ecx, edi
call dword [0x4ab2d4]
call edi
pop ecx
pop ecx
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
mov edx, ebx
call fcn.00471cd3
cmp dword [ebp - 0x14], 0
je 0x473061
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x30]
mov esi, 0x401a5f
cmp dword [ebp - 0x38], eax
je 0x473079
push esi
push dword [ebp - 0x38]
call fcn.004834ca
pop ecx
pop ecx
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x48], eax
je 0x47308c
push esi
push dword [ebp - 0x48]
call fcn.004834ca
pop ecx
pop ecx
call fcn.00482eac
ret 8
call fcn.00471d2a
jmp 0x473043
mov edi, 0x109
mov edx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x48]
call fcn.004762f2
test eax, eax
js 0x473045
push dword [ebp - 0x48]
lea eax, [ebp - 0x38]
push dword [esi*4 + 0x40185c]
push 0x46380c
push eax
call fcn.00476356
add esp, 0x10
test eax, eax
js 0x473045
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x14], 0
test eax, eax
je 0x4730e5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push edi
xor edi, edi
push edi
push dword [ebp - 0x38]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x47314f
cmp dword [0x4aa6b4], edi
je 0x473045
mov esi, dword [ebp - 0x38]
cmp dword [0x4aa6b0], edi
jne 0x47313b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x463820
mov esi, dword [0x4aa6b4]
mov ecx, esi
call dword [0x4ab2d4]
call esi
add esp, 0xc
jmp 0x473045
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x463820
call fcn.00471d2a
jmp 0x473133
cmp esi, 1
jne 0x473226
push ecx
push 0xff
lea ecx, [ebp - 0x48]
call fcn.0047075c
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x48]
sar eax, 1
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x48]
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x4731c5
cmp dword [0x4aa6b4], edi
je 0x473045
mov esi, dword [ebp - 0x38]
cmp dword [0x4aa6b0], edi
jne 0x4731b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x463878
jmp 0x473123
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x463878
jmp 0x473148
push 1
push 0x40231c
lea ecx, [ebp - 0x38]
call fcn.004708b9
test al, al
je 0x473045
mov eax, dword [ebp - 0x44]
lea ecx, [ebp - 0x38]
sub eax, dword [ebp - 0x48]
sar eax, 1
push eax
push dword [ebp - 0x48]
call fcn.004708b9
test al, al
je 0x473045
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], edi
test eax, eax
je 0x473209
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x14]
push eax
push 1
push edi
push dword [ebp - 0x38]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4730ff
mov eax, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x48]
mov word [eax], dx
lea edx, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
call fcn.0047644e
test eax, eax
jns 0x473284
cmp dword [0x4aa6b4], edi
je 0x473045
mov esi, dword [ebp - 0x38]
cmp dword [0x4aa6b0], edi
jne 0x473272
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x4638e0
jmp 0x473123
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x4638e0
jmp 0x473148
push dword [ebp - 0x48]
mov ecx, dword [ebp - 0x18]
mov edx, ebx
call fcn.0046c982
jmp 0x473052