Function at 0x63b2fb
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x6e90a0
call fcn.00401167
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x24], 1
call fcn.004378c8
xor ebx, ebx
mov dword [ebp - 0x20], 0x104
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.004378c8
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 1
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov edi, eax
test edi, edi
js 0x63b58a
push 0x4478d0
push 0x6fe614
lea eax, [ebp + 8]
push eax
call fcn.0063b0e9
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0063b099
mov ecx, dword [ebp + 8]
mov byte [ebp - 4], 1
lea ecx, [ecx - 0x10]
call fcn.0040119b
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1c]
call fcn.0063b15f
lea eax, [ebp - 0x14]
mov edi, 0x80004005
push eax
push 0x20019
push ebx
push dword [ebp - 0x1c]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x63b418
push dword [ebp - 0x20]
lea ecx, [ebp - 0x10]
call fcn.004a65f4
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x63b5c8
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0063b99d
lea ecx, [ebp - 0x10]
push ebx
test esi, esi
jne 0x63b3fd
call fcn.0063b22e
mov esi, dword [ebp - 0x10]
mov edi, dword [esi - 0xc]
neg edi
sbb edi, edi
and edi, 0x7fffbffb
add edi, 0x80004005
jmp 0x63b40a
push 0x48b5b4
call fcn.004a6559
mov esi, dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x14], ebx
jmp 0x63b41b
mov esi, dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.004a66ec
test edi, edi
jns 0x63b4d4
lea ecx, [ebp + 8]
call fcn.004378c8
push 0x63b5d8
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.004ae2b0
push dword [ebp - 0x18]
lea ecx, [ebp + 8]
call fcn.0063b15f
push 0x47e024
lea ecx, [ebp + 8]
call fcn.0063b15f
push 0x4478d8
lea ecx, [ebp + 8]
call fcn.0063b15f
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push edi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x63b50c
mov eax, 0x104
lea ecx, [ebp - 0x10]
push eax
mov dword [ebp - 0x20], eax
call fcn.004a65f4
lea ecx, [ebp - 0x20]
push ecx
push eax
lea eax, [ebp - 0x24]
push eax
push ebx
push 0x63b5c8
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.0063b99d
lea ecx, [ebp - 0x10]
push ebx
test esi, esi
jne 0x63b500
call fcn.0063b22e
lea ecx, [edi - 0x10]
call fcn.0040119b
mov edi, dword [ebp + 0xc]
mov esi, 0x433200
push 0x63b5e8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x10]
mov edi, ebx
push esi
mov dword [ebp + 8], edi
call fcn.0064437d
pop ecx
pop ecx
test eax, eax
jne 0x63b526
mov esi, 0x63b624
jmp 0x63b554
push 0x48b5b4
call fcn.004a6559
jmp 0x63b4cc
cmp dword [ebp - 0x28], 0
je 0x63b4cc
lea ecx, [edi - 0x10]
mov dword [ebp + 8], 0x80004005
call fcn.0040119b
mov edi, dword [ebp + 8]
jmp 0x63b58d
push 0x63b5f4
push esi
call fcn.0064437d
pop ecx
pop ecx
test eax, eax
jne 0x63b53e
mov esi, 0x63b614
jmp 0x63b554
push 0x63b5fc
push esi
call fcn.0064437d
pop ecx
pop ecx
test eax, eax
jne 0x63b559
mov esi, 0x63b604
mov eax, dword [ebp + 0xc]
jmp 0x63b566
mov eax, dword [ebp + 0xc]
cmp dword [esi - 0xc], ebx
jne 0x63b56f
mov esi, 0x63b634
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
mov ecx, 0x433200
mov eax, dword [eax + ebx*4]
cmp eax, dword [ecx + ebx*4]
jne 0x63b58a
mov eax, dword [ebp + 0xc]
inc ebx
cmp ebx, 4
jne 0x63b574
mov edi, 0x80004005
mov esi, dword [ebp - 0x10]
cmp dword [ebp - 0x18], 0
je 0x63b59c
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x14], 0
je 0x63b5ab
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0040119b
lea ecx, [esi - 0x10]
call fcn.0040119b
mov eax, edi
call fcn.004026a3
ret 8