Function at 0x40ba80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x261c
call fcn.0042dad0
mov eax, dword [0x446824]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push 0x7fe
xor ebx, ebx
lea ecx, [ebp - 0xe0a]
xor eax, eax
push ebx
push ecx
mov dword [ebp - 0x261c], esi
mov word [ebp - 0xe0c], ax
call fcn.00423160
add esp, 0xc
push 0x4401f4
push 0x44c370
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40bedf
push edi
push 0x7fe
lea eax, [ebp - 0x260a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x260c], dx
call fcn.00423160
lea ecx, [ebp - 0x260c]
push ecx
mov ecx, str.lagsnameTow
call fcn.00410ba0
add esp, 0x10
lea edx, [ebp - 0x260c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x40bb3e
push 0x440234
lea eax, [ebp - 0xe0c]
push 0x400
push eax
call fcn.004205b2
add esp, 0xc
jmp 0x40bcd1
push 0x208
lea ecx, [ebp - 0x60c]
push ebx
push ecx
mov dword [ebp - 0x2610], ebx
call fcn.00423160
add esp, 0xc
lea edx, [ebp - 0x2610]
push edx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2614], 0x104
mov dword [ebp - 0x2618], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea eax, [ebp - 0x2614]
push eax
mov eax, dword [ebp - 0x2610]
lea ecx, [ebp - 0x60c]
push ecx
lea edx, [ebp - 0x2618]
push edx
push ebx
push str.lagsnameTow
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40bbcc
push 0x440234
lea ecx, [ebp - 0xe0c]
push 0x43fa88
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x40bcc1
push 0x3ff
lea edx, [ebp - 0x403]
push ebx
push edx
mov byte [ebp - 0x404], bl
call fcn.00423160
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x60c]
push eax
push ebx
push ebx
call edi
push ebx
push ebx
push eax
lea ecx, [ebp - 0x404]
push ecx
push 0xffffffffffffffff
lea edx, [ebp - 0x60c]
push edx
push ebx
push ebx
call edi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40bc18
sub eax, edx
lea ecx, [ebp - 0x404]
push ecx
mov edx, eax
call fcn.00416f30
push 0x7fe
lea eax, [ebp - 0x160a]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x160c], dx
call fcn.00423160
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40bc56
push ebx
push ebx
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x404]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x404]
lea esi, [ecx + 1]
jmp 0x40bc80
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40bc80
push eax
sub ecx, esi
lea edx, [ebp - 0x160c]
push edx
inc ecx
push ecx
lea eax, [ebp - 0x404]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x160c]
push ecx
lea edx, [ebp - 0xe0c]
push 0x43fa88
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [ebp - 0x261c]
mov eax, dword [ebp - 0x2610]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x7fe
lea edx, [ebp - 0x1e0a]
xor ecx, ecx
push ebx
push edx
mov word [ebp - 0x1e0c], cx
call fcn.00423160
lea eax, [ebp - 0x1e0c]
push eax
mov ecx, str.GOZHUO
call fcn.00410ba0
add esp, 0x10
lea ecx, [ebp - 0x1e0c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x40bd42
push 0x44c21c
push 0x440370
lea edx, [ebp - 0xe0c]
push edx
push str._s_s_s
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fcee
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x60c]
push ebx
push eax
mov dword [ebp - 0x2610], ebx
call fcn.00423160
add esp, 0xc
lea ecx, [ebp - 0x2610]
push ecx
push str.SYSTEMCurrentControlSetControlVersionForcorResourcesTimeZone
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x2618], 0x104
mov dword [ebp - 0x2614], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
lea edx, [ebp - 0x2618]
push edx
mov edx, dword [ebp - 0x2610]
lea eax, [ebp - 0x60c]
push eax
lea ecx, [ebp - 0x2614]
push ecx
push ebx
push str.GOZHUO
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40bdd0
push 0x440234
push 0x440370
lea eax, [ebp - 0xe0c]
push eax
push str._s_s_s
push esi
jmp 0x40bec8
push 0x3ff
lea ecx, [ebp - 0x403]
push ebx
push ecx
mov byte [ebp - 0x404], bl
call fcn.00423160
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
lea edx, [ebp - 0x60c]
push edx
push ebx
push ebx
call edi
push ebx
push ebx
push eax
lea eax, [ebp - 0x404]
push eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x60c]
push ecx
push ebx
push ebx
call edi
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40be20
sub eax, edx
lea edx, [ebp - 0x404]
push edx
mov edx, eax
call fcn.00416eb0
push 0x7fe
lea ecx, [ebp - 0x160a]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0x160c], ax
call fcn.00423160
lea eax, [ebp - 0x404]
add esp, 0x10
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x40be60
push ebx
sub eax, edx
push ebx
inc eax
push eax
lea edx, [ebp - 0x404]
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x404]
mov esi, eax
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
cmp al, bl
jne 0x40be87
push esi
sub ecx, edi
lea eax, [ebp - 0x160c]
push eax
inc ecx
push ecx
lea ecx, [ebp - 0x404]
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x261c]
lea edx, [ebp - 0x160c]
push edx
push 0x440370
lea eax, [ebp - 0xe0c]
push eax
push str._s_s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [ebp - 0x2610]
add esp, 0x14
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fcee
mov esp, ebp
pop ebp
ret