Function at 0x462970
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47fa14
mov eax, dword fs:[0]
push eax
sub esp, 0x638
mov eax, dword [0x4be5b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x644], ecx
push str.Check_Run_Environment_from_ludashi_begin
call fcn.0044e890
add esp, 4
mov dword [ebp - 0x640], 0
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x638], 0
push 0x20219
push str.SOFTWARELudashi
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x640]
mov dword [ebp - 4], 0
call fcn.0040f4c0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x640]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x462a5e
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0x208
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x634]
push eax
push 0
push str.Setup_Path
push esi
call edi
test eax, eax
jne 0x462a5e
mov eax, dword [ebp - 0x634]
cmp eax, 1
je 0x462a43
cmp eax, 2
jne 0x462a5e
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x462a6f
test al, 1
jne 0x462a5e
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x462a78
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x462f4e
jmp 0x462ad9
xor eax, eax
mov word [ebp - 0x218], ax
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x462f58
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x62c]
call fcn.00406bc0
test al, al
jne 0x462b11
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x462ac0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
jmp 0x462b06
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
push 0x482aa0
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 2
call fcn.00406bc0
test al, al
jne 0x462b11
push 0
push 0x482aa0
lea ecx, [ebp - 0x62c]
call fcn.00416a50
test esi, esi
je 0x462b18
push esi
call ebx
mov ecx, dword [ebp - 0x644]
lea edx, [ebp - 0x62c]
push 8
push 0x494088
push edx
lea eax, [ecx + 4]
mov dword [ebp - 4], 3
push eax
call fcn.00462610
mov edx, dword [ebp - 0x62c]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x462b63
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Check_Run_Environment_from_ludashi_end
call fcn.0044e890
add esp, 4
test esi, esi
jne 0x462f30
push str.Check_Run_Environment_from_ludashi_failed
call fcn.0044e890
push str.Check_Run_Environment_from_360bizhi_begin
call fcn.0044e890
add esp, 8
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x638], esi
push 0x20219
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360wpapp.exe
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x640]
mov dword [ebp - 4], 4
call fcn.0040f4c0
mov esi, dword [ebp - 0x640]
test eax, eax
jne 0x462c24
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0x208
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x634]
push eax
push 0
push str.Path
push esi
call edi
test eax, eax
jne 0x462c24
mov eax, dword [ebp - 0x634]
cmp eax, 1
je 0x462c09
cmp eax, 2
jne 0x462c24
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x462c35
test al, 1
jne 0x462c24
shr eax, 1
cmp word [ebp + eax*2 - 0x422], 0
je 0x462c3e
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x462f62
jmp 0x462c99
xor eax, eax
mov word [ebp - 0x420], ax
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x462f6c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x62c]
call fcn.00406bc0
test al, al
jne 0x462cd1
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x462c80
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
jmp 0x462cc6
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
push 0x482aa0
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 6
call fcn.00406bc0
test al, al
jne 0x462cd1
push 0
push 0x482aa0
lea ecx, [ebp - 0x62c]
call fcn.00416a50
test esi, esi
je 0x462cd8
push esi
call ebx
mov ecx, dword [ebp - 0x644]
lea eax, [ebp - 0x62c]
push 8
push 0x49c088
push eax
lea eax, [ecx + 4]
mov dword [ebp - 4], 7
push eax
call fcn.00462610
mov edx, dword [ebp - 0x62c]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x462d23
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Check_Run_Environment_from_360bizhi_end
call fcn.0044e890
add esp, 4
test esi, esi
jne 0x462f30
push str.Check_Run_Environment_from_360bizhi_failed
call fcn.0044e890
push str.Check_Run_Environment_from_ldsgamecenter_begin
call fcn.0044e890
add esp, 8
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x638], esi
push 0x20219
push str.SOFTWARELDSGameCenter
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x640]
mov dword [ebp - 4], 8
call fcn.0040f4c0
mov esi, dword [ebp - 0x640]
test eax, eax
jne 0x462e79
lea eax, [ebp - 0x630]
mov dword [ebp - 0x630], 0x208
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x634]
push eax
push 0
push str.Setup_Path
push esi
call edi
mov edi, eax
test edi, edi
jne 0x462e03
mov eax, dword [ebp - 0x634]
cmp eax, 1
je 0x462dd6
cmp eax, 2
je 0x462dd6
mov edi, 0xd
jmp 0x462e03
mov eax, dword [ebp - 0x630]
test eax, eax
je 0x462df8
test al, 1
jne 0x462df1
shr eax, 1
cmp word [ebp + eax*2 - 0x62a], 0
je 0x462e01
mov edi, 0xd
jmp 0x462e03
xor eax, eax
mov word [ebp - 0x628], ax
xor edi, edi
test esi, esi
je 0x462e12
push esi
call ebx
xor esi, esi
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x63c], 0
test edi, edi
jne 0x462e79
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x462f76
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
lea eax, [ebp - 0x628]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x62c]
call fcn.00406bc0
test al, al
jne 0x462ec0
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x462e60
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
jmp 0x462eb5
call fcn.0040b4c0
mov ecx, eax
test ecx, ecx
je 0x462f80
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x62c], eax
push 0x482aa0
lea ecx, [ebp - 0x62c]
mov byte [ebp - 4], 0xa
call fcn.00406bc0
test al, al
jne 0x462ec0
push 0
push 0x482aa0
lea ecx, [ebp - 0x62c]
call fcn.00416a50
test esi, esi
je 0x462ec7
push esi
call ebx
mov ecx, dword [ebp - 0x644]
lea eax, [ebp - 0x62c]
push 8
push 0x4a4088
push eax
lea eax, [ecx + 4]
mov dword [ebp - 4], 0xb
push eax
call fcn.00462610
mov edx, dword [ebp - 0x62c]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x462f12
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push str.Check_Run_Environment_from_ldsgamecenter_end
call fcn.0044e890
add esp, 4
test esi, esi
jne 0x462f30
push str.Check_Run_Environment_from_ldsgamecenter_failed
call fcn.0044e890
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042c75e
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
push 0x80004005
call fcn.004068b0
int3