Function at 0xe2568
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0xe2570
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0xe2a17
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 1
xor eax, eax
push ebp
push 0xe29e5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0xe29d4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x2a9118]
mov eax, dword [eax]
add eax, 0x20019
push eax
push 0
push 0
push 0
push 0xe2a28
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0xe29b2
mov eax, 0x400
call fcn.00019220
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0xe29ab
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0xe2a58
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.000189b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe2662
cmp dword [ebp - 0xc], 1
jne 0xe267a
cmp dword [ebp - 0x18], 0
jbe 0xe267a
mov eax, dword [ebp - 0x14]
call fcn.00018994
cmp eax, dword [ebp - 0x18]
jbe 0xe267a
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x14]
call fcn.0001899c
mov edx, dword [ebp - 0x24]
mov eax, 0x2a6eb0
call fcn.00013c90
jmp 0xe267a
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0002b100
mov edx, dword [ebp - 0x28]
mov eax, 0x2a6eb0
call fcn.00013c90
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0xe2a64
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.000189b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe26d8
cmp dword [ebp - 0xc], 1
jne 0xe26f0
cmp dword [ebp - 0x18], 0
jbe 0xe26f0
mov eax, dword [ebp - 0x14]
call fcn.00018994
cmp eax, dword [ebp - 0x18]
jbe 0xe26f0
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
call fcn.0001899c
mov edx, dword [ebp - 0x2c]
mov eax, 0x2a6ea4
call fcn.00013c90
jmp 0xe26f0
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 4]
call fcn.0002b100
mov edx, dword [ebp - 0x30]
mov eax, 0x2a6ea4
call fcn.00013c90
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0xe2a70
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.000189b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe274e
cmp dword [ebp - 0xc], 1
jne 0xe2766
cmp dword [ebp - 0x18], 0
jbe 0xe2766
mov eax, dword [ebp - 0x14]
call fcn.00018994
cmp eax, dword [ebp - 0x18]
jbe 0xe2766
lea edx, [ebp - 0x34]
mov eax, dword [ebp - 0x14]
call fcn.0001899c
mov edx, dword [ebp - 0x34]
mov eax, 0x2a6eb4
call fcn.00013c90
jmp 0xe2766
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0002b100
mov edx, dword [ebp - 0x38]
mov eax, 0x2a6eb4
call fcn.00013c90
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0xe2a84
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.000189b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe27c4
cmp dword [ebp - 0xc], 1
jne 0xe27dc
cmp dword [ebp - 0x18], 0
jbe 0xe27dc
mov eax, dword [ebp - 0x14]
call fcn.00018994
cmp eax, dword [ebp - 0x18]
jbe 0xe27dc
lea edx, [ebp - 0x3c]
mov eax, dword [ebp - 0x14]
call fcn.0001899c
mov edx, dword [ebp - 0x3c]
mov eax, 0x2a6eac
call fcn.00013c90
jmp 0xe27dc
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.0002b100
mov edx, dword [ebp - 0x40]
mov eax, 0x2a6eac
call fcn.00013c90
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0xe2a94
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe2907
cmp dword [ebp - 0xc], 4
jne 0xe291f
cmp dword [ebp - 0x18], 4
jne 0xe291f
mov eax, dword [ebp - 0x20]
mov ecx, 0x15180
xor edx, edx
div ecx
mov dword [ebp - 0x1c], eax
imul eax, dword [ebp - 0x1c], 0x15180
mov ebx, dword [ebp - 0x20]
sub ebx, eax
mov eax, ebx
mov ecx, 0xe10
xor edx, edx
div ecx
mov edi, eax
imul eax, edi, 0xe10
sub ebx, eax
mov eax, ebx
mov ecx, 0x3c
xor edx, edx
div ecx
mov esi, eax
imul eax, esi, 0x3c
sub ebx, eax
mov cx, 1
mov dx, 1
mov ax, 0x7b2
call fcn.0002cbc4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 0x48], eax
fild qword [ebp - 0x4c]
faddp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x44]
call fcn.0002f270
push dword [ebp - 0x44]
lea edx, [ebp - 0x50]
mov eax, 0xe2aa0
call fcn.00031d88
push dword [ebp - 0x50]
lea edx, [ebp - 0x54]
mov eax, edi
call fcn.0002c174
push dword [ebp - 0x54]
lea edx, [ebp - 0x58]
mov eax, 0xe2aa4
call fcn.00031d88
push dword [ebp - 0x58]
lea edx, [ebp - 0x5c]
mov eax, esi
call fcn.0002c174
push dword [ebp - 0x5c]
lea edx, [ebp - 0x60]
mov eax, 0xe2aa4
call fcn.00031d88
push dword [ebp - 0x60]
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.0002c174
push dword [ebp - 0x64]
mov eax, 0x2a6ea8
mov edx, 7
call fcn.00013f8c
jmp 0xe291f
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
call fcn.0002b100
mov edx, dword [ebp - 0x68]
mov eax, 0x2a6ea8
call fcn.00013c90
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
mov ecx, 0xe2aa8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
call fcn.000189b4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0xe297d
cmp dword [ebp - 0xc], 1
jne 0xe2995
cmp dword [ebp - 0x18], 0
jbe 0xe2995
mov eax, dword [ebp - 0x14]
call fcn.00018994
cmp eax, dword [ebp - 0x18]
jbe 0xe2995
lea edx, [ebp - 0x6c]
mov eax, dword [ebp - 0x14]
call fcn.0001899c
mov edx, dword [ebp - 0x6c]
mov eax, 0x2a6eb8
call fcn.00013c90
jmp 0xe2995
lea edx, [ebp - 0x70]
mov eax, dword [ebp - 4]
call fcn.0002b100
mov edx, dword [ebp - 0x70]
mov eax, 0x2a6eb8
call fcn.00013c90
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe29b2
lea eax, [ebp - 0x14]
call fcn.00019230
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xe29db
cmp dword [ebp - 8], 0
je 0xe29ce
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 8], eax
ret