Function at 0x3506036f
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
push 0x350a06a8
call fcn.3505bbe0
xor ebx, ebx
mov dword [ebp - 0x28], ebx
push 0x350ac7b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
jne 0x350603b4
cmp dword [0x350ac808], ebx
je 0x350607f2
push ebx
push dword [0x350ac810]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x350607f2
mov dword [ebp - 0x2c], ebx
or dword [0x350ac7b4], 0xffffffff
mov dword [0x350ac7a0], 2
mov dword [0x350ac7a4], ebx
mov dword [0x350ac7a8], 3
xor eax, eax
inc eax
mov dword [0x350ac7ac], eax
mov dword [0x350ac7b0], ebx
mov dword [0x350ac78c], 0x20000000
mov dword [0x350ac790], eax
mov dword [0x350ac794], eax
mov dword [0x350ac798], eax
mov dword [0x350ac79c], 0xa00000
cmp dword [0x350ac808], ebx
je 0x3506076e
push dword [0x350ac810]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 1
push dword [0x350ac810]
push 7
push ebx
push dword [0x350ac808]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov dword [ebp - 0x30], 2
mov edi, 0x35008e08
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x350604d5
cmp dword [ebp - 0x24], 1
je 0x35060470
cmp dword [ebp - 0x24], 2
jne 0x350604c0
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x350604c0
lea eax, [ecx + 1]
call fcn.3505bc40
mov dword [ebp - 0x18], esp
mov eax, esp
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push edi
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x350604bb
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
mov byte [ecx + edx], bl
cmp dword [ebp - 0x24], 1
je 0x350604b6
cmp dword [ebp - 0x24], 2
jne 0x350604bb
cmp dword [ebp - 0x20], ebx
jne 0x350604c0
dec dword [ebp - 0x30]
jne 0x3506044a
cmp eax, ebx
jne 0x350604d5
cmp dword [ebp - 0x24], 1
je 0x350604d0
cmp dword [ebp - 0x24], 2
jne 0x350604d5
cmp dword [ebp - 0x20], ebx
jne 0x350604d8
mov dword [ebp - 0x2c], ebx
push 4
pop edi
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac7b4
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008df8
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x3506050a
cmp dword [ebp - 0x24], edi
jne 0x3506050a
cmp dword [ebp - 0x20], ebx
jne 0x35060511
or dword [0x350ac7b4], 0xffffffff
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac7a0
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008dec
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x3506054f
cmp dword [ebp - 0x24], edi
jne 0x3506054f
cmp dword [ebp - 0x20], ebx
je 0x3506054f
mov eax, dword [0x350ac7a0]
cmp eax, 1
jl 0x3506054f
cmp eax, 7
jle 0x35060559
mov dword [0x350ac7a0], 2
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac7a4
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008ddc
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x35060588
cmp dword [ebp - 0x24], edi
jne 0x35060588
cmp dword [ebp - 0x20], ebx
jne 0x3506058e
mov dword [0x350ac7a4], ebx
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac7a8
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008dd0
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x350605bd
cmp dword [ebp - 0x24], edi
jne 0x350605bd
cmp dword [ebp - 0x20], ebx
jne 0x350605c7
mov dword [0x350ac7a8], 3
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac7ac
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008dc4
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x350605f6
cmp dword [ebp - 0x24], edi
jne 0x350605f6
cmp dword [ebp - 0x20], ebx
jne 0x35060600
mov dword [0x350ac7ac], 1
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac7b0
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008db8
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x3506062f
cmp dword [ebp - 0x24], edi
jne 0x3506062f
cmp dword [ebp - 0x20], ebx
jne 0x35060635
mov dword [0x350ac7b0], ebx
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac78c
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008da8
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x35060664
cmp dword [ebp - 0x24], edi
jne 0x35060664
cmp dword [ebp - 0x20], ebx
jne 0x3506066e
mov dword [0x350ac78c], 0x20000000
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac790
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008d98
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x3506069d
cmp dword [ebp - 0x24], edi
jne 0x3506069d
cmp dword [ebp - 0x20], ebx
jne 0x350606a7
mov dword [0x350ac790], 1
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac794
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008d8c
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x350606df
cmp dword [ebp - 0x24], edi
jne 0x350606df
cmp dword [ebp - 0x20], ebx
je 0x350606df
cmp dword [0x350ac794], 1
jle 0x350606e9
mov dword [0x350ac794], 1
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac798
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008d78
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x35060718
cmp dword [ebp - 0x24], edi
jne 0x35060718
cmp dword [ebp - 0x20], ebx
jne 0x35060722
mov dword [0x350ac798], 1
mov dword [ebp - 0x20], edi
lea eax, [ebp - 0x20]
push eax
push 0x350ac79c
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x35008d68
push dword [0x350ac808]
call esi
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x35060764
cmp dword [ebp - 0x24], edi
jne 0x35060764
cmp dword [ebp - 0x20], ebx
je 0x35060764
mov eax, dword [0x350ac79c]
cmp eax, 0x80000
jb 0x35060764
cmp eax, 0x8000000
jbe 0x3506076e
mov dword [0x350ac79c], 0xa00000
mov esi, dword [0x350ac804]
push 0x1c
call fcn.3505faca
cmp eax, ebx
je 0x35060788
mov ecx, eax
call fcn.35067ed2
jmp 0x3506078a
xor eax, eax
mov ecx, eax
mov dword [0x350ac804], ecx
cmp ecx, ebx
jne 0x3506079f
mov dword [ebp - 0x28], 0x8007000e
jmp 0x350607b4
push dword [ebp - 0x2c]
call fcn.35067f34
mov dword [ebp - 0x28], eax
cmp eax, ebx
jge 0x350607d3
mov ecx, dword [0x350ac804]
cmp ecx, ebx
je 0x350607c4
mov eax, dword [ecx]
push ecx
call dword [eax + 4]
mov dword [0x350ac804], ebx
cmp esi, ebx
je 0x350607dd
mov dword [0x350ac804], esi
mov dword [ebp - 0x28], ebx
jmp 0x350607dd
cmp esi, ebx
je 0x350607dd
mov eax, dword [esi]
push esi
call dword [eax + 4]
cmp dword [ebp + 8], ebx
jne 0x350607f2
mov eax, dword [0x350ac814]
cmp eax, ebx
je 0x350607f2
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov dword [ebp - 4], 0xfffffffe
call fcn.3506080c
mov eax, dword [ebp - 0x28]
lea esp, [ebp - 0x40]
call fcn.3505bc28
ret 4