Function at 0x402e10
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4325fd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x12c
push ebx
push ebp
xor ebp, ebp
push esi
push edi
xor esi, esi
mov dword [esp + 0x1c], ebp
mov al, byte [0x442bbc]
mov ecx, 0x40
mov byte [esp + 0x38], al
xor eax, eax
lea edi, [esp + 0x39]
mov dword [esp + 0x144], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x18]
mov dword [esp + 0x2c], 0x104
push ecx
stosb byte es:[edi], al
call sub.MFC42.DLL_CTime::GetTickCount
mov edx, dword [eax]
lea eax, [esp + 0x20]
push str._Y_m_d
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0x30], edx
call sub.MFC42.DLL_CTime::Format
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], 1
push ecx
push 0xf003f
push esi
push str.SOFTWAREAnCamCorder
push SysReAllocStringLen
mov dword [esp + 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x402eb5
mov ebp, dword [esp + 0x10]
mov dword [esp + 0x1c], ebp
lea edx, [esp + 0x2c]
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
push esi
push str.timestamp
push ebp
mov dword [esp + 0x2c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
je 0x402f0d
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, esi
je 0x402eec
push ebp
call edi
xor ebp, ebp
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x20]
mov byte [esp + 0x144], 0
call sub.MFC42.DLL_CString::CString
cmp ebp, esi
je 0x4030cf
push ebp
call edi
jmp 0x4030cf
lea edx, [esp + 0x38]
lea ecx, [esp + 0x10]
push edx
call sub.MFC42.DLL_CString::CString_3
lea eax, [esp + 0x18]
push 2
push eax
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], 2
call sub.MFC42.DLL_CString::Right
mov esi, dword [eax]
push 2
lea ecx, [esp + 0x38]
push 4
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x150], 3
call sub.MFC42.DLL_CString::Mid
mov edi, dword [eax]
lea edx, [esp + 0x30]
push 4
push edx
lea ecx, [esp + 0x18]
mov byte [esp + 0x14c], 4
call sub.MFC42.DLL_CString::Left
mov ebx, dword [eax]
push 0xffffffffffffffff
push 0
push 0
push 0
push esi
mov esi, dword [sym.imp.MSVCRT.dll_atoi]
mov byte [esp + 0x158], 5
call esi
add esp, 4
push eax
push edi
call esi
add esp, 4
push eax
push ebx
call esi
add esp, 4
lea ecx, [esp + 0x3c]
push eax
call sub.MFC42.DLL_CTime::CTime
lea ecx, [esp + 0x30]
mov byte [esp + 0x144], 4
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x34]
mov byte [esp + 0x144], 3
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
mov byte [esp + 0x144], 2
call sub.MFC42.DLL_CString::CString
push ecx
mov ecx, dword [esp + 0x28]
mov eax, esp
mov dword [esp + 0x1c], esp
lea edx, [esp + 0x1c]
mov dword [eax], ecx
push edx
lea ecx, [esp + 0x30]
call fcn.004030f0
mov ecx, dword [eax]
mov eax, 0xc22e4507
imul ecx
mov eax, edx
push str._Y_m_d
add eax, ecx
sar eax, 0x10
mov ecx, eax
shr ecx, 0x1f
add eax, ecx
cdq
mov edi, eax
mov esi, edx
lea edx, [esp + 0x18]
lea ecx, [esp + 0x28]
push edx
call sub.MFC42.DLL_CTime::Format
mov eax, dword [esp + 0x14c]
cdq
cmp esi, edx
jg 0x403082
jl 0x40302e
cmp edi, eax
jae 0x403082
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x403041
push ebp
call esi
xor ebp, ebp
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], 1
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x20]
mov byte [esp + 0x144], 0
call sub.MFC42.DLL_CString::CString
test ebp, ebp
je 0x40307b
push ebp
call esi
mov eax, 1
jmp 0x4030d1
lea ecx, [esp + 0x14]
mov byte [esp + 0x144], 2
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x144], 1
call sub.MFC42.DLL_CString::CString
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
je 0x4030b7
push ebp
call esi
xor ebp, ebp
mov dword [esp + 0x1c], ebp
lea ecx, [esp + 0x20]
mov byte [esp + 0x144], 0
call sub.MFC42.DLL_CString::CString
test ebp, ebp
je 0x4030cf
push ebp
call esi
xor eax, eax
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x138
ret 4