Function at 0x510e6c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xf
push 0
push 0
dec ecx
jne 0x510e74
push ebx
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x51125b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov dword [ebp - 0x28], eax
mov edx, 0x80000002
mov eax, dword [ebp - 0x28]
call fcn.00437e7c
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 8
call fcn.00403968
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x58]
lea eax, [ebp - 0x3c]
mov edx, 0x511278
call fcn.00406b80
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
call fcn.00438008
test al, al
je 0x511238
mov edx, 0x5112d8
mov eax, dword [ebp - 0x28]
call fcn.00438694
test al, al
je 0x511017
xor eax, eax
push ebp
push 0x510f59
push dword fs:[eax]
mov dword fs:[eax], esp
push 8
lea ecx, [ebp - 0x24]
mov edx, 0x5112d8
mov eax, dword [ebp - 0x28]
call fcn.00438554
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_FileTimeToSystemTime
lea eax, [ebp - 0x38]
call fcn.00410e08
mov eax, dword [ebp - 0xc]
fstp qword [eax + 0x70]
wait
mov eax, dword [ebp - 0xc]
push dword [eax + 0x74]
push dword [eax + 0x70]
lea eax, [ebp - 4]
xor edx, edx
call fcn.00411b8c
mov eax, dword [ebp - 0xc]
add eax, 0x78
mov edx, dword [ebp - 4]
call fcn.004066ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x510fb0
mov eax, dword [ebp - 0xc]
push dword [eax + 0x74]
push dword [eax + 0x70]
call fcn.004350b8
cmp ax, 0x76b
jne 0x511064
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403f80
mov eax, dword [ebp - 0x48]
push eax
push 0x5113bc
mov eax, dword [ebp - 0xc]
push dword [eax + 0x34]
push 0x51140c
push dword [ebp - 0x20]
push dword [ebp - 0x24]
lea eax, [ebp - 0x50]
call fcn.0040d888
push dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 4
call fcn.00406c64
mov eax, dword [ebp - 0x4c]
mov ecx, 0x51137c
pop edx
call fcn.0050cdb8
jmp 0x511064
lea edx, [ebp - 0x54]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403f80
mov eax, dword [ebp - 0x54]
push eax
push 0x511440
mov eax, dword [ebp - 0xc]
push dword [eax + 0x34]
push 0x51140c
push dword [ebp - 0x20]
push dword [ebp - 0x24]
lea eax, [ebp - 0x5c]
call fcn.0040d888
push dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.00406c64
mov eax, dword [ebp - 0x58]
mov ecx, 0x51137c
pop edx
call fcn.0050cdb8
lea ecx, [ebp - 0x60]
mov edx, 0x511490
mov eax, dword [ebp - 0x28]
call fcn.00438410
mov edx, dword [ebp - 0x60]
mov eax, dword [ebp - 0xc]
add eax, 0x5c
call fcn.004066ac
lea ecx, [ebp - 0x64]
mov edx, 0x5114b8
mov eax, dword [ebp - 0x28]
call fcn.00438410
mov edx, dword [ebp - 0x64]
mov eax, dword [ebp - 0xc]
add eax, 0x7c
call fcn.004066ac
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x7c], 0
jne 0x5110c7
lea ecx, [ebp - 0x68]
mov edx, 0x5114dc
mov eax, dword [ebp - 0x28]
call fcn.00438410
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0xc]
add eax, 0x7c
call fcn.004066ac
lea ecx, [ebp - 0x6c]
mov edx, 0x5114f8
mov eax, dword [ebp - 0x28]
call fcn.00438410
mov edx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0xc]
add eax, 0x84
call fcn.004066ac
lea ecx, [ebp - 0x70]
mov edx, 0x51151c
mov eax, dword [ebp - 0x28]
call fcn.00438410
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0xc]
add eax, 0x8c
call fcn.004066ac
lea ecx, [ebp - 0x74]
mov edx, 0x51154c
mov eax, dword [ebp - 0x28]
call fcn.00438410
mov edx, dword [ebp - 0x74]
mov eax, dword [ebp - 0xc]
add eax, 0x90
call fcn.004066ac
mov edx, 0x511574
mov eax, dword [ebp - 0x28]
call fcn.00438694
test al, al
je 0x511158
lea ecx, [ebp - 0x78]
mov edx, 0x511574
mov eax, dword [ebp - 0x28]
call fcn.00438410
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0xc]
add eax, 0x88
call fcn.004066ac
mov edx, 0x51159c
mov eax, dword [ebp - 0x28]
call fcn.00438694
test al, al
je 0x511238
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x5115b8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov eax, dword [ebp - 0x14]
call fcn.00403350
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x511231
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0x5115b8
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00510dfc
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x511214
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x51121b
mov eax, dword [ebp - 0x1c]
call fcn.004040a8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x511262
lea eax, [ebp - 0x78]
mov edx, 0x10
call fcn.004066a4
lea eax, [ebp - 4]
call fcn.0040669c
ret