Function at 0x3533788
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor ebx, ebx
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
mov dword [ebp - 8], ebx
push 0x20019
mov dword [edi], ebx
push ebx
mov dword [esi], ebx
push str.softwaremicrosoftwindows_ntcurrentversionperflib
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x3533833
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov dword [ebp - 0x14], 4
push eax
push dword [ebp + 0x18]
push edx
push ebx
push str.Last_Counter
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x3533833
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x18]
push ecx
push edx
push ebx
push str.Version
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 1
sbb eax, eax
inc eax
je 0x3533885
mov dword [ebp - 0xc], str.Counters
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push str.softwaremicrosoftwindows_ntcurrentversionperflib009
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x3533892
cmp dword [ebp - 4], 0
je 0x3533853
mov eax, dword [edi]
test eax, eax
je 0x3533846
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi]
test eax, eax
je 0x3533853
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x10], 0
je 0x3533862
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], 0
je 0x3533879
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 8], eax
je 0x3533879
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov dword [ebp - 0xc], str.Counter_009
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x18]
push ebx
push ecx
push ebx
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x3533833
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [edi], eax
cmp eax, ebx
jne 0x35338cd
mov dword [ebp - 4], 8
jmp 0x3533833
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
lea edx, [eax*4 + 4]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [esi], eax
test eax, eax
jne 0x35338f4
mov dword [ebp - 4], 8
jmp 0x3533833
lea eax, [ebp - 0x14]
lea edx, [ebp - 0x18]
push eax
push dword [edi]
push edx
push 0
push dword [ebp - 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
test eax, eax
jne 0x3533833
mov ebx, dword [edi]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x3533833
push ebx
call fcn.03533748
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 0x18]
lea ebx, [ebx + ecx*2 + 2]
cmp dword [edx], eax
jb 0x3533944
mov ecx, dword [esi]
mov dword [ecx + eax*4], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [ebx + eax*2 + 2]
jmp 0x3533919