Function at 0x408480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x118]
push ebx
push ebp
push esi
push edi
push 9
push str.softwaremicrosoftwindows_ntcurrentversionperflib
lea edx, [esp + 0x28]
push str._s_03x
mov dword [eax], 0
push edx
mov dword [esp + 0x28], 3
mov dword [esp + 0x20], 0x100
mov dword [ecx], 0
call fcn.00413640
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4084fa
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0
push eax
push 0
push str.Counters
push ecx
call esi
test eax, eax
je 0x408536
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00413e50
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x408561
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push ebp
push eax
push 0
push str.Counters
push ecx
call esi
test eax, eax
je 0x40859f
push ebp
call fcn.00413db0
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov byte [esp + 0x20], 0
mov al, byte [ebp]
test al, al
mov dword [esp + 0x1c], 0
mov ebx, ebp
je 0x4086a3
cmp ebx, ebp
jbe 0x4085e3
lea esi, [ebx - 2]
xor eax, eax
mov al, byte [esi]
push eax
call fcn.004135e0
add esp, 4
test eax, eax
je 0x4085e3
dec esi
xor ecx, ecx
mov cl, byte [esi]
push ecx
call fcn.004135e0
add esp, 4
test eax, eax
jne 0x4085d1
push str.System
push ebx
call fcn.00413b00
add esp, 8
test eax, eax
jne 0x408641
lea esi, [ebx - 2]
xor edx, edx
mov dl, byte [esi]
push edx
call fcn.004135e0
add esp, 4
test eax, eax
je 0x40861b
dec esi
xor eax, eax
mov al, byte [esi]
push eax
call fcn.004135e0
add esp, 4
test eax, eax
jne 0x408609
lea edi, [esi + 1]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x408687
push str.__Registry_Quota_In_Use
push ebx
call fcn.00413b00
add esp, 8
test eax, eax
jne 0x408687
lea esi, [ebx - 2]
xor ecx, ecx
mov cl, byte [esi]
push ecx
call fcn.004135e0
add esp, 4
test eax, eax
je 0x408679
dec esi
xor edx, edx
mov dl, byte [esi]
push edx
call fcn.004135e0
add esp, 4
test eax, eax
jne 0x408667
inc esi
push esi
call fcn.00413460
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ebx + ecx + 1]
lea ebx, [ebx + ecx + 1]
test al, al
jne 0x4085b9
push ebp
call fcn.00413db0
mov al, byte [esp + 0x24]
add esp, 4
test al, al
jne 0x4086cc
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
push 0x19000
mov dword [esp + 0x14], 0x19000
call fcn.00413e50
mov esi, eax
add esp, 4
test esi, esi
jne 0x4086ff
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 3
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, ebx
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push esi
push ecx
lea edx, [esp + 0x2c]
push 0
push edx
push 0x80000004
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x408767
test ecx, ecx
jbe 0x408767
cmp word [esi], 0x50
jne 0x408767
cmp word [esi + 2], 0x45
jne 0x408767
cmp word [esi + 4], 0x52
jne 0x408767
cmp word [esi + 6], 0x46
je 0x4087c9
cmp eax, 0xea
jne 0x4087a5
add ecx, 0xc800
push ecx
push esi
mov dword [esp + 0x18], ecx
call fcn.00414920
mov ecx, dword [esp + 0x18]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 8
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x80000004
and ecx, ebx
rep stosb byte es:[edi], al
call ebp
jmp 0x40871f
push esi
call fcn.00413db0
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call ebp
push 0x80000004
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov edi, dword [esi + 0x18]
xor eax, eax
add edi, esi
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0x20]
add esi, edi
test ecx, ecx
jbe 0x4087ef
mov edx, dword [esp + 0x1c]
mov ebx, dword [esi + 4]
cmp ebx, edx
je 0x4087ef
add esi, 0x28
inc eax
cmp eax, ecx
jb 0x4087dc
dec ecx
cmp eax, ecx
jae 0x408808
cmp eax, 0xffffffff
je 0x408808
inc eax
push eax
push edi
call fcn.00408450
add esp, 8
mov ebx, eax
jmp 0x40880a
xor ebx, ebx
push esi
push edi
call fcn.00408430
add esp, 8
mov esi, eax
test ebx, ebx
je 0x408826
push ebx
push edi
call fcn.00408430
add esp, 8
jmp 0x40882a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x128]
mov eax, dword [eax]
push 0x80000004
mov dword [ecx], eax
mov eax, dword [esp + 0x128]
mov edx, dword [esi]
mov dword [eax], edx
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret