Function at 0x452760
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 4]
mov edx, dword [esp + 8]
mov dword [ecx], eax
mov ecx, dword [esp + 0xc]
mov dword [edx], eax
mov edx, dword [esp + 0x10]
mov dword [ecx], eax
mov ecx, dword [esp + 0x14]
mov dword [edx], eax
mov dword [ecx], eax
ret
sub esp, 0x10
cmp dword [0x61e968], 0
jne 0x452771
call fcn.00452350
call fcn.004781a0
test eax, eax
je 0x45298b
cmp dword [0x61e974], 0
je 0x45298b
call fcn.004752d0
test eax, eax
jne 0x4527a4
add esp, 0x10
mov dword [esp + 0x18], 3
jmp 0x452290
lea edx, [esp + 4]
push edx
push 0x20019
push 0
push str.SOFTWARE360Safe_safemon
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x452987
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.IERpcProtect
push eax
call esi
test eax, eax
je 0x452815
cmp eax, 2
je 0x45280e
mov ecx, dword [esp + 0x18]
mov dword [ecx], 3
jmp 0x452826
mov eax, 1
jmp 0x452819
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
add eax, 3
mov dword [edx], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.MonitoringSpoofing
push eax
call esi
test eax, eax
je 0x45285f
cmp eax, 2
je 0x452858
mov ecx, dword [esp + 0x1c]
mov dword [ecx], 3
jmp 0x452870
mov eax, 1
jmp 0x452863
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x1c]
neg eax
sbb eax, eax
add eax, 3
mov dword [edx], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.NetPayDownload
push eax
call esi
test eax, eax
je 0x4528a9
cmp eax, 2
je 0x4528a2
mov ecx, dword [esp + 0x20]
mov dword [ecx], 3
jmp 0x4528ba
mov eax, 1
jmp 0x4528ad
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x20]
neg eax
sbb eax, eax
add eax, 3
mov dword [edx], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.NetPayHIPS
push eax
call esi
test eax, eax
je 0x4528f3
cmp eax, 2
je 0x4528ec
mov ecx, dword [esp + 0x24]
mov dword [ecx], 3
jmp 0x452904
mov eax, 1
jmp 0x4528f7
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x24]
neg eax
sbb eax, eax
add eax, 3
mov dword [edx], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.NetPayScan
push eax
call esi
test eax, eax
je 0x45293d
cmp eax, 2
je 0x452936
mov ecx, dword [esp + 0x28]
mov dword [ecx], 3
jmp 0x45294e
mov eax, 1
jmp 0x452941
mov eax, dword [esp + 4]
mov edx, dword [esp + 0x28]
neg eax
sbb eax, eax
add eax, 3
mov dword [edx], eax
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push str.NetPayProtectCount
push eax
call esi
mov edx, dword [esp + 8]
mov ecx, dword [esp + 0x2c]
neg eax
sbb eax, eax
not eax
and eax, dword [esp + 4]
push edx
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
add esp, 0x10
ret
add esp, 0x10
mov dword [esp + 0x18], 1
jmp 0x452290