Function at 0x455ae0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1138
call fcn.0042beb0
mov eax, dword [0x48d800]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10f8], ecx
mov dword [ebp - 8], 0
mov ecx, dword [ebp - 0x10f8]
call fcn.004555a0
lea eax, [ebp - 4]
push eax
push 0x479f70
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x45601c
mov dword [ebp - 0xc], 0
push 0x1260
call fcn.0040855c
add esp, 4
mov dword [ebp - 0x10ec], eax
mov ecx, dword [ebp - 0x10ec]
mov dword [ebp - 0xdc], ecx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x10e8], 0x800
mov dword [ebp - 0xd8], 0x1000
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x10fc], edx
lea eax, [ebp - 0xd8]
push eax
mov ecx, dword [ebp - 0xdc]
add ecx, 0x260
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
lea eax, [ebp - 0x10e8]
push eax
lea ecx, [ebp - 0x10e0]
push ecx
mov edx, dword [ebp - 0x10fc]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
cmp eax, 0x103
jne 0x455bde
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0x10f0], edx
mov eax, dword [ebp - 0x10f0]
push eax
call fcn.00408596
add esp, 4
jmp 0x45600b
mov ecx, dword [ebp - 0xdc]
push ecx
mov edx, dword [ebp - 0xdc]
add edx, 0x260
push edx
call fcn.0044e0e0
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + 0x258], eax
mov dword [ecx + 0x25c], edx
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0x1100], edx
mov eax, dword [ebp - 0x1100]
mov ecx, dword [ebp - 0x1100]
mov edx, dword [eax + 0x258]
or edx, dword [ecx + 0x25c]
jne 0x455c4f
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x10f4], eax
mov ecx, dword [ebp - 0x10f4]
push ecx
call fcn.00408596
add esp, 4
jmp 0x455ffe
lea edx, [ebp - 0xac]
push edx
mov eax, dword [ebp - 0xdc]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push 0x40
lea ecx, [ebp - 0x98]
push ecx
push 0
lea edx, [ebp - 0xac]
push edx
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push 0x479fbc
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x9c], eax
mov edx, 0x40
sub edx, dword [ebp - 0x9c]
push edx
mov eax, dword [ebp - 0x9c]
lea ecx, [ebp + eax*2 - 0x98]
push ecx
push 0
lea edx, [ebp - 0xac]
push edx
push 8
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTimeFormatW]
push 0x28
push 0
lea eax, [ebp - 0xd4]
push eax
call fcn.00427eb0
add esp, 0xc
mov dword [ebp - 0xd4], 5
lea ecx, [ebp - 0x98]
mov dword [ebp - 0xc0], ecx
mov edx, dword [ebp - 0xdc]
mov dword [ebp - 0xb4], edx
lea eax, [ebp - 0xd4]
push eax
mov ecx, dword [ebp - 0x10f8]
add ecx, 0x1388
call fcn.00403b70
mov dword [ebp - 0x10e4], eax
mov ecx, dword [ebp - 0xdc]
mov dword [ebp - 0x1104], ecx
mov edx, dword [ebp - 0x1104]
cmp dword [edx + 0x25c], 0
ja 0x455ddf
jb 0x455d60
mov eax, dword [ebp - 0x1104]
cmp dword [eax + 0x258], 0x100000
jae 0x455ddf
mov ecx, dword [ebp - 0xdc]
mov edx, dword [ecx + 0x258]
mov eax, dword [ecx + 0x25c]
mov dword [ebp - 0x110c], edx
mov dword [ebp - 0x1108], eax
mov ecx, dword [ebp - 0x1108]
mov dword [ebp - 0x1110], ecx
and dword [ebp - 0x1108], 0x7fffffff
fild qword [ebp - 0x110c]
and dword [ebp - 0x1110], 0x80000000
mov dword [ebp - 0x1114], 0
fild qword [ebp - 0x1114]
fchs
faddp st(1)
fdiv qword [0x480578]
sub esp, 8
fstp qword [esp]
push 0x479fc0
push 0x40
lea edx, [ebp - 0x98]
push edx
call fcn.00428c03
add esp, 0x14
jmp 0x455f21
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1118], eax
mov ecx, dword [ebp - 0x1118]
cmp dword [ecx + 0x25c], 0
ja 0x455e9b
jb 0x455e16
mov edx, dword [ebp - 0x1118]
cmp dword [edx + 0x258], 0x40000000
jae 0x455e9b
mov eax, dword [ebp - 0xdc]
mov ecx, dword [eax + 0x258]
mov edx, dword [eax + 0x25c]
mov dword [ebp - 0x1120], ecx
mov dword [ebp - 0x111c], edx
mov eax, dword [ebp - 0x111c]
mov dword [ebp - 0x1124], eax
and dword [ebp - 0x111c], 0x7fffffff
fild qword [ebp - 0x1120]
and dword [ebp - 0x1124], 0x80000000
mov dword [ebp - 0x1128], 0
fild qword [ebp - 0x1128]
fchs
faddp st(1)
fdiv qword [0x480578]
fdiv qword [0x480578]
sub esp, 8
fstp qword [esp]
push str._.1f_MB
push 0x40
lea ecx, [ebp - 0x98]
push ecx
call fcn.00428c03
add esp, 0x14
jmp 0x455f21
mov edx, dword [ebp - 0xdc]
mov eax, dword [edx + 0x258]
mov ecx, dword [edx + 0x25c]
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x112c], ecx
mov edx, dword [ebp - 0x112c]
mov dword [ebp - 0x1134], edx
and dword [ebp - 0x112c], 0x7fffffff
fild qword [ebp - 0x1130]
and dword [ebp - 0x1134], 0x80000000
mov dword [ebp - 0x1138], 0
fild qword [ebp - 0x1138]
fchs
faddp st(1)
fdiv qword [0x480578]
fdiv qword [0x480578]
fdiv qword [0x480578]
sub esp, 8
fstp qword [esp]
push str._.1f_GB
push 0x40
lea eax, [ebp - 0x98]
push eax
call fcn.00428c03
add esp, 0x14
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x98]
push ecx
push 1
push 1
mov edx, dword [ebp - 0x10e4]
push edx
mov ecx, dword [ebp - 0x10f8]
add ecx, 0x1388
call fcn.0040be32
mov eax, dword [ebp - 0xdc]
movzx ecx, word [eax + 0x10]
push ecx
push 0x479ff0
lea edx, [ebp - 0x98]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x98]
push eax
push 1
push 2
mov ecx, dword [ebp - 0x10e4]
push ecx
mov ecx, dword [ebp - 0x10f8]
add ecx, 0x1388
call fcn.0040be32
push 0
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0xdc]
add edx, 0x52
push edx
push 1
push 3
mov eax, dword [ebp - 0x10e4]
push eax
mov ecx, dword [ebp - 0x10f8]
add ecx, 0x1388
call fcn.0040be32
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp - 0xdc]
add ecx, 0x260
push ecx
push 1
push 4
mov edx, dword [ebp - 0x10e4]
push edx
mov ecx, dword [ebp - 0x10f8]
add ecx, 0x1388
call fcn.0040be32
mov eax, 1
test eax, eax
jne 0x455b32
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 8], 1
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00427b2d
mov esp, ebp
pop ebp
ret