Function at 0x423b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push edi
push esi
push ebx
sub esp, 0x754
lea eax, [esp + 0x484]
mov edx, str.cXM3t3L2M_258PJ2MXZxcze9u7D2M_J3uPE2t_e9unFx9rL3sPIw8bD3tP26ebj7TmIT17_LvmZ_s7zr6O6ampqSkpiamtQ
call fcn.004224a0
mov edi, eax
lea eax, [esp + 0x584]
mov edx, str.58vS7s_cw8nP5MvHzbPxA
call fcn.004224a0
mov ebx, eax
mov dword [esp + 0x748], 0x20
call fcn.00422e10
test eax, eax
je 0x423fb5
mov ecx, dword [esp + 0x748]
mov dword [esp + 0x14], 0x542830
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov edx, edi
lea esi, [esp + 0x70b]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ecx
mov ecx, ebx
call fcn.00405390
lea eax, [esp + 0x584]
mov edx, str.5MX6xcbGd_Jyc_Pzg
call fcn.004224a0
mov ebx, eax
mov dword [esp + 0x750], 0x27
call fcn.00422e10
test eax, eax
je 0x423f62
mov edi, dword [esp + 0x750]
mov dword [esp + 0x14], 0x542830
mov eax, reloc.OLEAUT32.dll_SysReAllocString
mov ecx, ebx
lea esi, [esp + 0x6d0]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
lea edx, [esp + 0x484]
call fcn.00405390
movsx eax, byte [esp + 0x70b]
test eax, eax
je 0x423bed
movsx eax, byte [esp + 0x6d0]
test eax, eax
jne 0x423bf7
mov ebx, 1
jmp 0x423db7
movsd xmm0, qword [0x53ee94]
movsd qword [esp + 0x700], xmm0
movzx esi, word [0x53ee9c]
mov word [esp + 0x708], si
mov al, byte [0x53ee9e]
mov byte [esp + 0x70a], al
pxor xmm0, xmm0
movaps xmmword [esp + 0x6c0], xmm0
lea eax, [esp + 0x42c]
call fcn.004252d0
lea eax, [esp + 0x42c]
mov edx, str.0420
mov ecx, 4
call fcn.00401c90
lea eax, [esp + 0x42c]
lea edx, [esp + 0x700]
mov ecx, 0xb
call fcn.00401c90
lea eax, [esp + 0x42c]
mov edx, str.0420
mov ecx, 4
call fcn.00401c90
lea edx, [esp + 0x70b]
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x423caa
mov eax, edx
add edx, ecx
call fcn.00425520
lea edx, [esp + 0x70b]
mov ecx, eax
lea eax, [esp + 0x42c]
call fcn.00401c90
lea eax, [esp + 0x6c0]
lea edx, [esp + 0x42c]
call fcn.00408c90
movzx edi, byte [esp + 0x6ca]
movzx esi, byte [esp + 0x6cb]
movzx ebx, byte [esp + 0x6cc]
movzx ecx, byte [esp + 0x6cd]
movzx edx, byte [esp + 0x6ce]
movzx eax, byte [esp + 0x6cf]
push eax
push edx
push ecx
push ebx
push esi
push edi
movzx eax, byte [esp + 0x6e1]
push eax
movzx edx, byte [esp + 0x6e4]
push edx
movzx ecx, byte [esp + 0x6e7]
push ecx
movzx ebx, byte [esp + 0x6ea]
push ebx
movzx esi, byte [esp + 0x6ed]
push esi
movzx edi, byte [esp + 0x6f0]
push edi
movzx eax, byte [esp + 0x6f3]
push eax
movzx edx, byte [esp + 0x6f6]
push edx
movzx ecx, byte [esp + 0x6f9]
push ecx
movzx ebx, byte [esp + 0x6fc]
push ebx
push str._.2X_.2X_.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X__.2X_.2X_.2X_.2X_.2X_.2X
lea esi, [esp + 0x6c8]
push esi
call dword [sym.imp.MSVCR80.dll_sprintf]
add esp, 0x48
lea edi, [esp + 0x684]
lea esi, [esp + 0x6d0]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x423da6
test dl, dl
je 0x423da2
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x423da6
add edi, 2
add esi, 2
test dl, dl
jne 0x423d86
xor eax, eax
jmp 0x423dab
sbb eax, eax
or eax, 1
mov ebx, eax
mov eax, 1
test ebx, ebx
cmovne ebx, eax
lea edi, [esp + 0x730]
lea esi, [esp + 0x734]
lea ecx, [esp + 0x738]
lea edx, [esp + 0x73c]
lea eax, [esp + 0x740]
push eax
push edx
push ecx
push esi
push edi
lea eax, [esp + 0x740]
push eax
push 0x53fa14
lea edx, [esp + 0x727]
push edx
call dword [sym.imp.MSVCR80.dll_sscanf]
add esp, 0x20
cmp eax, 6
jne 0x423e5c
movzx eax, byte [esp + 0x72c]
movzx edx, byte [esp + 0x730]
movzx ecx, byte [esp + 0x734]
mov byte [0x56e794], al
movzx eax, byte [esp + 0x738]
mov byte [0x56e795], dl
movzx edx, byte [esp + 0x73c]
test ebx, ebx
mov byte [0x56e796], cl
movzx ecx, byte [esp + 0x740]
mov byte [0x56e797], al
mov byte [0x56e798], dl
mov byte [0x56e799], cl
je 0x423f55
lea eax, [esp + 0x6b0]
push eax
call dword [sym.imp.MSVCR80.dll__ftime64]
fild qword [esp + 0x6b4]
fsub qword [0x53f030]
movzx eax, word [esp + 0x6bc]
mov dword [esp + 0x6fc], eax
fild dword [esp + 0x6fc]
fmul qword [0x53f038]
faddp st(1)
fmul qword [0x53f040]
fnstcw word [esp + 0x24]
movzx eax, word [esp + 0x24]
or eax, 0xc00
mov dword [esp + 0x2c], eax
fldcw word [esp + 0x2c]
fistp qword [esp + 0x6fc]
fldcw word [esp + 0x24]
mov edx, dword [esp + 0x6fc]
push edx
call dword [sym.imp.MSVCR80.dll_srand]
add esp, 8
call dword [sym.imp.MSVCR80.dll_rand]
cmp eax, 1
jg 0x423edf
mov ebx, 1
jmp 0x423ee7
call dword [sym.imp.MSVCR80.dll_rand]
mov ebx, eax
call dword [sym.imp.MSVCR80.dll_rand]
cmp eax, 1
jg 0x423ef9
mov eax, 1
jmp 0x423eff
call dword [sym.imp.MSVCR80.dll_rand]
mov byte [0x56e795], al
mov edx, eax
mov byte [0x56e799], bl
shr edx, 8
mov byte [0x56e794], dl
mov dword [esp + 0xc], str.58vS7s_cw8nP5MvHzbPxA
mov eax, ebx
shr eax, 0x18
mov byte [0x56e796], al
mov dword [esp + 0x10], str.5MX6xcbGd_Jyc_Pzg
mov ecx, ebx
shr ecx, 0x10
mov byte [0x56e797], cl
mov eax, ebx
shr eax, 8
xor edx, edx
mov ecx, str.cXM3t3L2M_258PJ2MXZxcze9u7D2M_J3uPE2t_e9unFx9rL3sPIw8bD3tP26ebj7TmIT17_LvmZ_s7zr6O6ampqSkpiamtQ
mov byte [0x56e798], al
mov eax, 0x56e794
call fcn.004061c0
add esp, 0x754
pop ebx
pop esi
pop edi
mov esp, ebp
pop ebp
ret
mov byte [esp + 0x6d0], 0
lea edi, [esp + 0x484]
lea esi, [esp + 0x22c]
mov dword [esp + 0x20], ebx
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x424002
sub ebx, edi
push ebx
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebx
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x423f7c
mov byte [esp + 0x70b], 0
lea esi, [esp + 0x2c]
mov dword [esp + 0x20], ebx
push 0x5428fc
push edi
call dword [sym.imp.MSVCR80.dll_strstr]
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x4240b5
sub ebx, edi
push ebx
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
push 0
push 0x542830
add esi, ebx
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0x18
lea edi, [ebx + edi + 1]
jmp 0x423fc5
mov ebx, dword [esp + 0x20]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x42402c
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x744]
push eax
push ecx
push 0
lea esi, [esp + 0x238]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4240a8
lea edx, [esp + 0x6d0]
lea eax, [esp + 0x750]
push eax
xor ecx, ecx
push edx
push ecx
push ecx
push ebx
push dword [esp + 0x758]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push dword [esp + 0x744]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x423bd5
mov byte [esp + 0x6d0], 0
jmp 0x423bd5
mov ebx, dword [esp + 0x20]
mov edx, edi
mov ecx, edx
and edx, 0xfffffff0
pxor xmm0, xmm0
pcmpeqb xmm0, xmmword [edx]
pmovmskb eax, xmm0
and ecx, 0xf
shr eax, cl
bsf eax, eax
jne 0x4240df
mov eax, edx
add edx, ecx
call fcn.00425520
inc eax
push eax
push edi
push esi
call dword [sym.imp.MSVCR80.dll_memmove]
add esp, 0xc
call fcn.00401b70
mov edx, 0x20119
mov ecx, 0x20019
test eax, eax
cmovne ecx, edx
lea eax, [esp + 0x6ac]
push eax
push ecx
push 0
lea esi, [esp + 0x38]
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424158
lea edx, [esp + 0x70b]
lea eax, [esp + 0x748]
push eax
xor ecx, ecx
push edx
push ecx
push ecx
push ebx
push dword [esp + 0x6c0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
push dword [esp + 0x6ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x423b79
mov byte [esp + 0x70b], 0
jmp 0x423b79