Function at 0x451dc0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4e0
mov eax, dword [0x4a80a0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x400
lea eax, [ebp - 0x4d4]
mov edi, ecx
push 0
push eax
call fcn.004644a0
movdqu xmm0, xmmword [0x49e944]
movzx eax, word [0x49e974]
lea edx, [ebp - 0x38]
mov word [ebp - 8], ax
add esp, 0xc
movdqu xmmword [ebp - 0x38], xmm0
movzx eax, byte [0x49e976]
mov ecx, edx
movdqu xmm0, xmmword [0x49e954]
mov byte [ebp - 6], al
movzx eax, word [0x49e9a8]
movdqu xmmword [ebp - 0x28], xmm0
mov word [ebp - 0x3c], ax
movdqu xmm0, xmmword [0x49e964]
movzx eax, byte [0x49e9aa]
mov byte [ebp - 0x3a], al
movdqu xmmword [ebp - 0x18], xmm0
movzx eax, word [0x49e9dc]
movdqu xmm0, xmmword [0x49e978]
mov word [ebp - 0x70], ax
movzx eax, byte [0x49e9de]
movdqu xmmword [ebp - 0x6c], xmm0
mov byte [ebp - 0x6e], al
movdqu xmm0, xmmword [0x49e988]
movzx eax, word [0x49ea10]
mov word [ebp - 0xa4], ax
movdqu xmmword [ebp - 0x5c], xmm0
movzx eax, byte [0x49ea12]
movdqu xmm0, xmmword [0x49e998]
mov byte [ebp - 0xa2], al
movdqu xmmword [ebp - 0x4c], xmm0
movdqu xmm0, xmmword [0x49e9ac]
movdqu xmmword [ebp - 0xa0], xmm0
movdqu xmm0, xmmword [0x49e9bc]
movdqu xmmword [ebp - 0x90], xmm0
movdqu xmm0, xmmword [0x49e9cc]
movdqu xmmword [ebp - 0x80], xmm0
movdqu xmm0, xmmword [0x49e9e0]
movdqu xmmword [ebp - 0xd4], xmm0
movdqu xmm0, xmmword [0x49e9f0]
movdqu xmmword [ebp - 0xc4], xmm0
movdqu xmm0, xmmword [0x49ea00]
movdqu xmmword [ebp - 0xb4], xmm0
call fcn.00447390
lea edx, [ebp - 0x6c]
mov ecx, edx
call fcn.00447390
lea edx, [ebp - 0xa0]
mov ecx, edx
call fcn.00447390
lea edx, [ebp - 0xd4]
mov ecx, edx
call fcn.00447390
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4dc], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0x38]
mov dword [ebp - 0x4e0], 0
push eax
push 0x80000002
mov dword [ebp - 0x4d8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x451fb4
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x4d8]
push eax
push 0
push str.Path
push dword [ebp - 0x4e0]
call ebx
push dword [ebp - 0x4e0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
test al, al
je 0x451fb4
push str.2003
push 0x400
push edi
call fcn.00461408
add esp, 0xc
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4dc], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0x6c]
mov dword [ebp - 0x4e0], 0
push eax
push 0x80000002
mov dword [ebp - 0x4d8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x452063
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x4d8]
push eax
push 0
push str.Path
push dword [ebp - 0x4e0]
call ebx
push dword [ebp - 0x4e0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
test al, al
je 0x452063
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x452033
sub ecx, edx
je 0x452050
push str.__2007
push 0x400
push edi
call fcn.004613a5
jmp 0x452060
push str.2007
push 0x400
push edi
call fcn.00461408
add esp, 0xc
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4dc], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x4e0], 0
push eax
push 0x80000002
mov dword [ebp - 0x4d8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x452115
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x4d8]
push eax
push 0
push str.Path
push dword [ebp - 0x4e0]
call ebx
push dword [ebp - 0x4e0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
test al, al
je 0x452115
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4520e5
sub ecx, edx
je 0x452102
push str.__2010
push 0x400
push edi
call fcn.004613a5
jmp 0x452112
push str.2010
push 0x400
push edi
call fcn.00461408
add esp, 0xc
lea eax, [ebp - 0x4e0]
mov dword [ebp - 0x4dc], 0x400
push eax
push 0x20019
push 0
lea eax, [ebp - 0xd4]
mov dword [ebp - 0x4e0], 0
push eax
push 0x80000002
mov dword [ebp - 0x4d8], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4521e2
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4d4]
push eax
lea eax, [ebp - 0x4d8]
push eax
push 0
push str.Path
push dword [ebp - 0x4e0]
call ebx
push dword [ebp - 0x4e0]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
test al, al
je 0x4521e2
mov ecx, edi
lea edx, [ecx + 1]
jmp 0x4521a0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4521a0
sub ecx, edx
je 0x4521cf
push str.__2013
push 0x400
push edi
call fcn.004613a5
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046125f
mov esp, ebp
pop ebp
ret
push str.2013
push 0x400
push edi
call fcn.00461408
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046125f
mov esp, ebp
pop ebp
ret