Function at 0x42ce31
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
push ebx
push esi
push edi
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 0x618], 0
mov dword [ebp - 0x61c], 0
lea eax, [ebp - 0x654]
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesSofTrackLocalAgentServiceBXUTable
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42ce8b
jmp 0x42d192
lea eax, [ebp - 0x3e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
xor eax, eax
mov ax, word [ebp - 0x3e6]
add eax, eax
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 0x3e8]
and ecx, 0xffff
mov edx, ecx
lea ecx, [ecx + ecx*8]
lea ecx, [edx + ecx*8]
lea ecx, [ecx + ecx*4]
add eax, ecx
xor ecx, ecx
mov cx, word [ebp - 0x3e2]
add eax, ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x3c4], 0
cmp dword [ebp - 0xc], 0
jne 0x42d185
mov byte [ebp - 0x614], 0
mov dword [ebp - 8], 0x226
mov dword [ebp - 0x10], 0x3a6
lea edi, [ebp - 0x3bc]
xor eax, eax
mov ecx, 0xe9
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x3bc]
push eax
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x614]
push eax
mov eax, dword [ebp - 0x3c4]
push eax
mov eax, dword [ebp - 0x654]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42d17a
lea eax, [ebp - 0x3bc]
mov dword [ebp - 0x3ec], eax
mov eax, dword [ebp - 0x3ec]
xor ecx, ecx
mov cx, word [eax + 2]
lea eax, [ecx*2]
lea eax, [eax + eax*2]
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 0x3ec]
xor edx, edx
mov dx, word [ecx]
mov ecx, edx
lea edx, [edx + edx*8]
lea ecx, [ecx + edx*8]
lea ecx, [ecx + ecx*4]
add eax, ecx
mov ecx, dword [ebp - 0x3ec]
xor edx, edx
mov dx, word [ecx + 6]
add eax, edx
mov dword [ebp - 0x3d4], eax
cmp dword [0x45e03c], 0
je 0x42cfc7
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3d4]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x3d4]
push eax
push str._r_nBXU_prload:_then__d__now__d__diff:__d
call fcn.00452380
add esp, 0x10
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x3d8], eax
cmp dword [ebp - 0x3d8], 1
jge 0x42cfed
mov dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 0x16d
jge 0x42d14b
push 0xd8
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
jne 0x42d050
cmp dword [0x45e03c], 0
je 0x42d03e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._r_nBUXTEX_PRLD_fail___d_
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x654]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x42d192
lea esi, [ebp - 0x3bc]
mov edi, dword [ebp - 0x3c0]
add edi, 4
mov ecx, 0x35
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x3c8], 0
je 0x42d086
mov eax, dword [ebp - 0x3c0]
mov ecx, dword [ebp - 0x3c8]
mov dword [ecx], eax
jmp 0x42d091
mov eax, dword [ebp - 0x3c0]
mov dword [0x462ed4], eax
mov dword [0x4620f8], 1
mov eax, dword [ebp - 0x3c0]
mov dword [ebp - 0x3c8], eax
cmp dword [0x45e03c], 0
je 0x42d146
lea eax, [ebp - 0x614]
push eax
push str._r_n__PLOAD___s_:
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x3c0]
add eax, 0x14
push eax
push str._r_n__USER_____:__s
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax + 0x94]
push eax
push str._r_n__ProductId:__d
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x3c0]
add eax, 0x98
push eax
push str._r_n__UsageType:__s
call fcn.00452380
add esp, 8
mov eax, dword [ebp - 0x3c0]
xor ecx, ecx
mov cx, word [eax + 4]
push ecx
mov eax, dword [ebp - 0x3c0]
xor ecx, ecx
mov cx, word [eax + 0xa]
push ecx
mov eax, dword [ebp - 0x3c0]
xor ecx, ecx
mov cx, word [eax + 6]
push ecx
push str._r_n__LastSeen_:__02d__02d__04d
call fcn.00452380
add esp, 0x10
jmp 0x42d17a
cmp dword [0x45e03c], 0
je 0x42d17a
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3d4]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x3d4]
push eax
push str._r_nBXU_Removed_expired_entry___d____d__d:_d
call fcn.00452380
add esp, 0x10
inc dword [ebp - 0x3c4]
jmp 0x42ceda
mov eax, dword [ebp - 0x654]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret