Function at 0x68b7bc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x68bd67
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov eax, dword [0x6e310c]
call fcn.0040508c
push eax
mov eax, dword [0x6e3100]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x68bc8e
mov eax, dword [0x6e599c]
mov byte [eax], 1
mov eax, 4
call fcn.00402b48
mov esi, eax
mov eax, 4
call fcn.00402b48
mov ebx, eax
mov dword [esi], 1
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bd78
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68b89e
mov eax, dword [ebx]
test eax, eax
jbe 0x68b89e
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
cmp dword [ebp - 8], 0
je 0x68b891
mov eax, dword [ebp - 8]
call fcn.0040aab8
test al, al
je 0x68b891
mov eax, dword [edi + 0x334]
mov eax, dword [eax + 0x38]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
mov eax, dword [0x6e47a8]
mov edx, dword [ebp - 8]
call fcn.00404bf4
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bd84
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68b8f9
mov eax, dword [ebx]
test eax, eax
jbe 0x68b8e3
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
jmp 0x68b8eb
lea eax, [ebp - 8]
call fcn.00404ba0
mov edx, dword [0x6e4a44]
mov eax, dword [ebp - 8]
call fcn.004070b8
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bd90
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68b953
mov eax, dword [ebx]
test eax, eax
jbe 0x68b93e
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
jmp 0x68b946
lea eax, [ebp - 8]
call fcn.00404ba0
mov eax, dword [0x6e516c]
mov edx, dword [ebp - 8]
call fcn.00404bf4
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bda0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68b9ae
mov eax, dword [ebx]
test eax, eax
jbe 0x68b998
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
jmp 0x68b9a0
lea eax, [ebp - 8]
call fcn.00404ba0
mov edx, dword [0x6e3984]
mov eax, dword [ebp - 8]
call fcn.004070b8
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bdac
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68b9fe
mov eax, dword [ebx]
test eax, eax
jbe 0x68b9fe
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
mov eax, dword [0x6e5cc0]
mov edx, dword [ebp - 8]
call fcn.00404bf4
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bdbc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bbe1
mov eax, dword [ebx]
test eax, eax
jbe 0x68bbe1
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
mov eax, dword [ebp - 8]
call fcn.005f54b8
cmp al, 1
jne 0x68bbe1
mov eax, dword [0x6e3ca0]
mov byte [eax], 0
mov dword [esi], 1
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bdc8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bad7
mov eax, dword [ebx]
test eax, eax
jbe 0x68bad7
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
cmp dword [ebp - 8], 0
je 0x68bad7
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.004054bc
mov edx, dword [ebp - 0x10]
mov eax, dword [0x6e45f0]
mov eax, dword [eax]
call fcn.004aa944
mov eax, 0x6e30e4
mov edx, dword [ebp - 8]
call fcn.00404bf4
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bdd0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bb35
mov eax, dword [ebx]
test eax, eax
jbe 0x68bb35
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
cmp dword [ebp - 8], 0
je 0x68bb35
mov eax, dword [0x6e53c4]
mov eax, dword [eax]
mov eax, dword [eax + 0x98]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bdd8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bb85
mov eax, dword [ebx]
test eax, eax
jbe 0x68bb85
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
mov eax, dword [0x6e4174]
mov edx, dword [ebp - 8]
call fcn.00404bf4
lea eax, [ebp - 8]
mov edx, 0x400
call fcn.00405218
mov dword [ebx], 0x400
push ebx
lea eax, [ebp - 8]
call fcn.004050e4
push eax
push esi
push 0
push 0x68bde4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bbe1
mov eax, dword [ebx]
test eax, eax
jbe 0x68bbe1
mov edx, eax
dec edx
lea eax, [ebp - 8]
call fcn.00405218
mov eax, dword [ebp - 8]
call fcn.0040aab8
cmp al, 1
jne 0x68bbe1
mov eax, dword [0x6e42fc]
mov edx, dword [ebp - 8]
call fcn.00404bf4
mov dword [esi], 4
mov dword [ebx], 4
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0x68bdf4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bc1d
mov eax, dword [0x6e3b48]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [0x6e3b48]
mov eax, dword [eax]
call fcn.00600b14
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0x68be04
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bc41
mov eax, dword [0x6e3400]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0x68be14
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x68bc65
mov eax, dword [0x6e61a0]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov edx, 4
mov eax, esi
call fcn.00402b78
mov edx, 4
mov eax, ebx
call fcn.00402b78
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, dword [0x6e599c]
mov byte [eax], 0
push 0x68be2c
lea edx, [ebp - 0x18]
mov eax, dword [0x6e5e58]
call fcn.00409b74
push dword [ebp - 0x18]
push 0x68be60
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404f4c
mov edx, dword [ebp - 0x14]
mov ecx, 0x68be74
mov eax, 0x80000001
call fcn.005f4da0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jle 0x68bcda
mov eax, dword [0x6e3f58]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
push 0x68be2c
lea edx, [ebp - 0x20]
mov eax, dword [0x6e5e58]
call fcn.00409b74
push dword [ebp - 0x20]
push 0x68be60
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.00404f4c
mov edx, dword [ebp - 0x1c]
mov ecx, 0x68be84
mov eax, 0x80000001
call fcn.005f4da0
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jle 0x68bd3c
call fcn.0040c86c
fild dword [ebp - 0xc]
fcompp
fnstsw ax
sahf
je 0x68bd3c
mov eax, dword [0x6e3f58]
cmp dword [eax], 0
jle 0x68bd3c
mov eax, dword [0x6e3f58]
dec dword [eax]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x68bd6e
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404bc4
lea eax, [ebp - 0x10]
call fcn.004052d8
lea eax, [ebp - 8]
call fcn.00404ba0
ret