Function at 0x4a80cbd0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x184
mov eax, dword [0x4a89c5b8]
xor eax, esp
mov dword [esp + 0x180], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
push esi
push edi
mov dword [esp + 0x28], 0x2c
xor ebp, ebp
jmp 0x4a80cc00
mov ecx, dword [ebp*4 + 0x4a874bfc]
lea eax, [esp + 0x10]
push eax
push 1
push 0
push ecx
push 0x80000002
call ebx
mov edx, dword [esp + 0x10]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4a80cc31
add ebp, 1
cmp ebp, 2
jl 0x4a80cc00
push 0xac
lea eax, [esp + 0x88]
push 0
push eax
mov dword [esp + 0x24], ebp
call fcn.4a859720
add esp, 0xc
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [esp + 0xc8]
mov edx, dword [esp + 0x84]
mov ecx, dword [esp + 0xcc]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0xd4]
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0xd0]
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x11c]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x124]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x120]
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x128]
mov dword [esp + 0x50], eax
or eax, 0xffffffff
xor edi, edi
cmp dword [str.Etc_GMT12], edi
mov dword [esp + 0x4c], edx
mov dword [esp + 0x54], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], eax
je 0x4a80ce03
xor eax, eax
mov edx, dword [eax + 0x4a8748fc]
push ebp
push edx
lea eax, [esp + 0x18]
push eax
call fcn.4a80bf30
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4a80cd11
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x5c]
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push 0x4a8748f4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a80cde4
mov esi, dword [esp + 0x14]
test esi, esi
jl 0x4a80cd3a
mov edx, dword [esp + 0x2c]
cmp edx, dword [esp + 0x58]
jne 0x4a80cdff
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov eax, 0x2c
lea ecx, [esp + 0x58]
lea edx, [esp + 0x2c]
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x4a80cd6f
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x4a80cd57
test eax, eax
je 0x4a80cdcc
movzx ebp, byte [ecx]
movzx esi, byte [edx]
sub esi, ebp
jne 0x4a80cdbe
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4a80cdcc
movzx ebp, byte [ecx]
movzx esi, byte [edx]
sub esi, ebp
jne 0x4a80cdbe
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4a80cdcc
movzx ebp, byte [ecx]
movzx esi, byte [edx]
sub esi, ebp
jne 0x4a80cdbe
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4a80cdcc
movzx eax, byte [ecx]
movzx esi, byte [edx]
sub esi, eax
je 0x4a80cdcc
test esi, esi
mov eax, 1
jg 0x4a80cdce
or eax, 0xffffffff
jmp 0x4a80cdce
xor eax, eax
test eax, eax
jne 0x4a80cde0
cmp dword [esp + 0x14], eax
jge 0x4a80cddc
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], edi
mov ebp, dword [esp + 0x18]
add edi, 1
lea eax, [edi*8]
cmp dword [eax + 0x4a8748f8], 0
jne 0x4a80ccd8
mov esi, dword [esp + 0x14]
test esi, esi
jge 0x4a80ce0a
xor eax, eax
jmp 0x4a80cf98
cmp esi, dword [esp + 0x1c]
je 0x4a80cf91
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
push str.SYSTEMCurrentControlSetControlTimeZoneInformation_
push 0x80000002
call ebx
test eax, eax
mov ecx, dword [esp + 0x10]
jne 0x4a80cf8a
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x134]
push eax
push 0
push 0
push str.StandardName
push ecx
mov dword [esp + 0x3c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, dword [esp + 0x1c]
mov edi, esi
jg 0x4a80cf91
mov ebx, 0x40
mov eax, dword [edi*8 + 0x4a8748fc]
push ebp
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.4a80bf30
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x4a80ceb7
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x154]
push eax
push esi
push esi
push 0x4a874bf8
push ecx
mov dword [esp + 0x38], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4a80cf6f
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x20], eax
jne 0x4a80cf6f
cmp eax, 4
lea ecx, [esp + 0x150]
lea edx, [esp + 0x130]
jb 0x4a80cf04
jmp 0x4a80cef0
mov esi, dword [edx]
cmp esi, dword [ecx]
jne 0x4a80cf08
sub eax, 4
add ecx, 4
add edx, 4
cmp eax, 4
jae 0x4a80cef0
test eax, eax
je 0x4a80cf65
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x4a80cf57
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4a80cf65
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x4a80cf57
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4a80cf65
movzx esi, byte [edx]
movzx ebp, byte [ecx]
sub esi, ebp
jne 0x4a80cf57
sub eax, 1
add ecx, 1
add edx, 1
test eax, eax
je 0x4a80cf65
movzx esi, byte [edx]
movzx eax, byte [ecx]
sub esi, eax
je 0x4a80cf65
test esi, esi
mov eax, 1
jg 0x4a80cf67
or eax, 0xffffffff
jmp 0x4a80cf67
xor eax, eax
test eax, eax
je 0x4a80cf82
mov ebp, dword [esp + 0x18]
add edi, 1
cmp edi, dword [esp + 0x1c]
jle 0x4a80ce76
mov esi, dword [esp + 0x14]
jmp 0x4a80cf91
mov dword [esp + 0x14], edi
mov esi, edi
jmp 0x4a80cf91
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi*8 + 0x4a8748f8]
mov ecx, dword [esp + 0x190]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.4a859707
add esp, 0x184
ret