Function at 0x47134a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10c
mov eax, 0x5317f8
call fcn.004fc737
cmp byte [ebp + 0xc], 1
mov edi, ecx
mov dword [ebp - 0xd4], edi
jne 0x471452
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0xb4], esp
push str.protection_status
call fcn.004b5b54
push 0x54a60c
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call fcn.004b6ff4
or dword [ebp - 4], 0xffffffff
mov edi, eax
call fcn.004b5dcd
push ebx
push ebx
lea eax, [ebp - 0xfc]
call fcn.004b6cbe
sub esp, 0x18
mov dword [ebp - 4], 3
mov esi, esp
mov dword [ebp - 0xb4], esp
push ebx
call fcn.004b5ad3
push str.mode
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 4
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 3
call fcn.004b5dcd
lea edi, [ebp - 0xb0]
call fcn.004b92b3
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.004b92d1
sub esp, 0x18
mov byte [ebp - 4], 6
lea edx, [ebp - 0x4c]
mov esi, esp
mov dword [ebp - 0xb4], esp
call fcn.004b5b80
push str.value
push dword [ebp - 0xd4]
mov byte [ebp - 4], 7
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 6
call fcn.004b5dcd
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.004051a5
lea esi, [ebp - 0xb0]
call fcn.004361ad
jmp 0x4719bf
push dword [ebp + 8]
lea eax, [ebp - 0xc4]
xor ebx, ebx
push eax
lea eax, [ebp - 0xb8]
push eax
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
xor edi, edi
mov dword [ebp - 0xc8], ebx
call fcn.00470a3f
add esp, 0xc
test al, al
je 0x4714af
mov eax, dword [ebp - 0xc0]
mov edi, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xb4], eax
lea eax, [ebp - 0xb8]
push eax
lea esi, [ebp - 0xc4]
call fcn.00470824
pop ecx
test al, al
je 0x4714fe
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xc8]
jl 0x4714ea
jg 0x4714de
cmp dword [ebp - 0xc4], edi
jbe 0x4714ea
mov edi, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
mov esi, dword [ebp - 0xb4]
add esi, dword [ebp - 0xb8]
mov dword [ebp - 0xb4], esi
jmp 0x471504
mov esi, dword [ebp - 0xb4]
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0047089d
pop ecx
pop ecx
test al, al
je 0x47154d
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xc8]
jl 0x471541
jg 0x471535
cmp dword [ebp - 0xc4], edi
jbe 0x471541
mov edi, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
add esi, dword [ebp - 0xb8]
mov dword [ebp - 0xb4], esi
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.0047052a
pop ecx
pop ecx
test al, al
je 0x471596
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xc8]
jl 0x47158a
jg 0x47157e
cmp dword [ebp - 0xc4], edi
jbe 0x47158a
mov edi, dword [ebp - 0xc4]
mov dword [ebp - 0xc8], eax
add esi, dword [ebp - 0xb8]
mov dword [ebp - 0xb4], esi
push ebx
push ebx
lea eax, [ebp - 0xfc]
call fcn.004b6cbe
mov dword [ebp - 4], 0xa
mov eax, dword [ebp - 0xc8]
mov ecx, edi
or ecx, eax
je 0x471684
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0xcc]
mov dword [ebp - 0xcc], edi
push eax
mov esi, str._Y__m__d
lea edi, [ebp - 0xb8]
call fcn.00404636
mov eax, dword [ebp - 0xb8]
cmp dword [eax - 0xc], ebx
je 0x47166c
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.0040526c
mov byte [ebp - 4], 0xc
push dword [ebp - 0xb8]
lea eax, [ebp - 0x4c]
call fcn.004043d1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0xd
call fcn.0040e90b
pop ecx
push ebx
push 1
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], 0xc
call fcn.00404e29
sub esp, 0x18
lea edx, [ebp - 0x30]
mov esi, esp
mov dword [ebp - 0xc0], esp
call fcn.004b5b80
push str.last_active
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0xe
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 0xc
call fcn.004b5dcd
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004051a5
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xb8]
add eax, 0xfffffff0
call fcn.00405521
mov esi, dword [ebp - 0xb4]
cmp esi, ebx
je 0x4716fb
mov eax, dword [0x590e04]
mov ecx, 0x590e04
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xb4], eax
push esi
push 0x54df78
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0xf
call fcn.0042ee4a
sub esp, 0x10
mov esi, esp
mov dword [ebp - 0xc0], esp
push dword [ebp - 0xb4]
call fcn.004b5b54
push str.threat_block
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0x10
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 0xf
call fcn.004b5dcd
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xb4]
add eax, 0xfffffff0
call fcn.00405521
push 4
pop esi
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0xe0]
push eax
lea eax, [ebp - 0xd8]
push eax
xor eax, eax
cmp byte [ebp + 8], bl
push str.lastscantime
setne al
push str.SOFTWARE360TotalSecurityExamination
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xdc], esi
add eax, 0x80000001
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x47182d
cmp dword [ebp - 0xd8], esi
jne 0x47182d
cmp dword [ebp - 0xdc], esi
jne 0x47182d
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xcc]
push eax
mov esi, str._Y__m__d
lea edi, [ebp - 0xb4]
mov dword [ebp - 0xc8], ebx
call fcn.00404636
mov eax, dword [ebp - 0xb4]
cmp dword [eax - 0xc], ebx
je 0x47181b
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.0040526c
mov byte [ebp - 4], 0x12
push dword [ebp - 0xb4]
lea eax, [ebp - 0x4c]
call fcn.004043d1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 0x13
call fcn.0040e90b
pop ecx
push ebx
push 1
lea esi, [ebp - 0x4c]
mov byte [ebp - 4], 0x12
call fcn.00404e29
sub esp, 0x18
lea edx, [ebp - 0x30]
mov esi, esp
mov dword [ebp - 0xc0], esp
call fcn.004b5b80
push str.last_full_check
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0x14
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 0x12
call fcn.004b5dcd
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.004051a5
mov byte [ebp - 4], 0xa
mov eax, dword [ebp - 0xb4]
add eax, 0xfffffff0
call fcn.00405521
push ebx
push ebx
call fcn.0044f993
sub esp, 0x10
mov esi, esp
mov dword [ebp - 0xc0], esp
push eax
call fcn.004b5ad3
push str.mode
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0x15
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 0xa
call fcn.004b5dcd
lea ecx, [ebp - 0xd0]
call fcn.00471187
mov byte [ebp - 4], 0x16
mov eax, dword [ebp - 0xd0]
cmp dword [eax - 0xc], ebx
je 0x471910
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], 0xf
call fcn.0040526c
mov byte [ebp - 4], 0x17
push dword [ebp - 0xd0]
lea eax, [ebp - 0x118]
call fcn.004043d1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x118]
mov byte [ebp - 4], 0x18
call fcn.0040e90b
pop ecx
push ebx
push 1
lea esi, [ebp - 0x118]
mov byte [ebp - 4], 0x17
call fcn.00404e29
sub esp, 0x18
lea edx, [ebp - 0x30]
mov esi, esp
mov dword [ebp - 0xc0], esp
call fcn.004b5b80
push str.version
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 0x19
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 0x17
call fcn.004b5dcd
push ebx
push 1
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0x16
call fcn.004051a5
sub esp, 0x18
mov esi, esp
mov dword [ebp - 0xc0], esp
push str.protection_status
call fcn.004b5b54
push 0x54a60c
push dword [ebp - 0xd4]
mov byte [ebp - 4], 0x1a
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 0x16
call fcn.004b5dcd
lea edi, [ebp - 0x8c]
call fcn.004b92b3
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x68]
push eax
mov ecx, edi
mov byte [ebp - 4], 0x1b
call fcn.004b92d1
sub esp, 0x18
mov byte [ebp - 4], 0x1c
lea edx, [ebp - 0x68]
mov esi, esp
mov dword [ebp - 0xc0], esp
call fcn.004b5b80
push str.value
push dword [ebp - 0xd4]
mov byte [ebp - 4], 0x1d
call fcn.004b6ff4
mov edi, eax
mov byte [ebp - 4], 0x1c
call fcn.004b5dcd
push ebx
push 1
lea ecx, [ebp - 0x68]
call fcn.004051a5
lea esi, [ebp - 0x8c]
call fcn.004361ad
mov eax, dword [ebp - 0xd0]
add eax, 0xfffffff0
call fcn.00405521
or dword [ebp - 4], 0xffffffff
lea esi, [ebp - 0xfc]
call fcn.004b5d4a
mov al, 1
call fcn.004fc7ba
ret