Function at 0x629e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x65c1eb
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x67206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x94], 0
add dword [0x674754], 2
mov dword [ebp - 0x84], 0x669c14
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
mov dword [ebp - 0x68], 0x669c14
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x8c], al
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x70
push 0x61
push 0x43
push 0x46
push 0x6e
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], 0x200
push 0x75
push 0x59
push 0x6e
push 0x61
push 0x75
push 0x58
push 0x5c
push 0x65
push 0x72
push 0x61
push 0x77
push 0x74
push 0x66
push 0x6f
lea edx, [eax + 0x53]
lea ecx, [ebp - 0x44]
call fcn.0062a700
add esp, 0x138
xor ecx, ecx
mov dword [ebp - 0x2c], 0x669c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
inc dword [0x674754]
cmp ecx, eax
je 0x629f8b
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x629f7f
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00611370
push ecx
push 0x80000001
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x90]
call fcn.0060dc70
mov byte [ebp - 4], 1
dec dword [0x674754]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x629fea
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x629fe0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x62a3d8
push edx
push ecx
call fcn.006317bc
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x62a028
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x62a01e
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x62a3d8
push edx
push ecx
call fcn.006317bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0x669c14
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
push 7
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
inc dword [0x674754]
push 0x66a4b8
call fcn.00611370
mov byte [ebp - 4], 0
mov al, byte [ebp - 0x8c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x90], 0
test al, al
je 0x62a0cb
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x9c], 4
push ecx
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x98], 4
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push 0
push eax
push dword [ebp - 0x88]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x90], eax
mov al, byte [ebp - 0x8c]
dec dword [0x674754]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x48], 0x669c14
cmp edx, 8
jb 0x62a118
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x62a108
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x62a3dd
push edx
push ecx
call fcn.006317bc
mov al, byte [ebp - 0x8c]
add esp, 8
mov esi, dword [ebp - 0x94]
test esi, esi
je 0x62a155
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x90], 0
test al, al
je 0x62a381
push dword [ebp - 0x88]
call edi
mov esi, dword [ebp - 0x94]
xor al, al
mov byte [ebp - 0x8c], al
jmp 0x62a381
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x70
push 0x61
push 0x43
push 0x46
push 0x6e
push 0x75
push 0x59
push 0x6e
push 0x61
push 0x75
push 0x58
push 0x5c
push 0x65
push 0x72
push 0x61
push 0x77
push 0x74
push 0x66
push 0x6f
mov edx, 0x53
lea ecx, [ebp - 0x44]
call fcn.0062a700
add esp, 0x138
xor ecx, ecx
mov dword [ebp - 0x2c], 0x669c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
inc dword [0x674754]
cmp ecx, eax
je 0x62a246
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0x62a23a
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.00611370
push ecx
push 0x80000002
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x90]
call fcn.0060dc70
lea ecx, [ebp - 0x2c]
call fcn.0060ed70
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0x62a2a7
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x62a29d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x62a3e2
push edx
push ecx
call fcn.006317bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x2c], 0x669c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 7
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
inc dword [0x674754]
push 0x66a4b8
call fcn.00611370
cmp byte [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
je 0x62a339
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x98], 4
push ecx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x9c], 4
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push dword [ebp - 0x88]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x2c]
call fcn.0060ed70
mov al, byte [ebp - 0x8c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x90], 0
test al, al
je 0x62a36b
push dword [ebp - 0x88]
call edi
xor al, al
mov byte [ebp - 0x8c], al
mov esi, dword [ebp - 0x94]
mov ecx, 0x63
test esi, esi
cmove esi, ecx
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0
test al, al
je 0x62a3a8
push dword [ebp - 0x88]
call edi
mov dword [ebp - 0x90], 0
mov byte [ebp - 0x8c], 0
lea ecx, [ebp - 0x68]
call fcn.0060ed70
lea ecx, [ebp - 0x84]
call fcn.0060ed70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00631776
mov esp, ebp
pop ebp
ret
call fcn.006375a6
call fcn.006375a6
call fcn.006375a6
int3