Function at 0x461300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x63e088
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x28], 0x65a24c
mov ecx, 0x44
xor eax, eax
lea edi, [ebp - 0x18c]
push ebx
rep stosd dword es:[edi], eax
mov byte [ebp - 4], 1
mov byte [ebp - 0x7c], bl
call fcn.0060b449
push eax
call fcn.0060c28d
add esp, 8
call fcn.0060c29a
mov dword [ebp - 0x20], eax
fild dword [ebp - 0x20]
fmul qword [0x65b4b8]
call fcn.0060a154
mov ecx, 0x3e8
sub ecx, eax
mov eax, dword [0x6cdb00]
cmp eax, ebx
mov dword [ebp - 0x20], ecx
jne 0x461607
lea ecx, [ebp - 0x38]
call fcn.00524830
mov edx, dword [0x6fcacc]
mov ecx, dword [0x6fd75c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x14]
neg edx
push eax
push 1
sbb edx, edx
push ebx
add edx, 0x80000002
push ecx
push edx
mov byte [ebp - 4], 2
call edi
mov esi, eax
cmp esi, ebx
je 0x46147e
cmp esi, 2
je 0x46147a
mov eax, dword [0x6f7b78]
mov dword [ebp - 0x18], eax
mov eax, dword [0x6fcacc]
mov byte [ebp - 4], 3
cmp eax, ebx
mov eax, str.CURRENT_USER
jne 0x4613ee
mov eax, str.MACHINE
mov ecx, dword [0x6fd75c]
lea edx, [ebp - 0x18]
push ecx
push eax
push 0x6c9ce8
push edx
call fcn.0061fae1
mov eax, dword [ebp - 0x18]
add esp, 0x10
lea ecx, [ebp - 0x38]
push eax
call fcn.005248e0
cmp eax, ebx
je 0x461438
mov eax, dword [0x6fcacc]
mov edx, dword [0x6fd75c]
lea ecx, [ebp - 0x14]
neg eax
push ecx
push 1
sbb eax, eax
push ebx
add eax, 0x80000002
push edx
push eax
call edi
mov esi, eax
cmp esi, ebx
je 0x46146e
mov ecx, dword [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x38]
call fcn.005249b0
cmp eax, ebx
je 0x46146e
mov ecx, dword [0x6fcacc]
mov eax, dword [0x6fd75c]
lea edx, [ebp - 0x14]
neg ecx
push edx
push 1
sbb ecx, ecx
push ebx
add ecx, 0x80000002
push eax
push ecx
call edi
mov esi, eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00622d8a
cmp esi, ebx
jne 0x4614bb
mov ecx, dword [0x6fd3a0]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18c]
push edx
mov edx, dword [ebp - 0x14]
push eax
push ebx
push ebx
push ecx
push edx
mov dword [ebp - 0x1c], 0x110
call edi
cmp eax, ebx
je 0x4614af
mov byte [ebp - 0x18c], bl
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4614c1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [ebp - 0x18c], bl
jne 0x4615d3
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x1c], 0x110
call fcn.00524830
lea ecx, [ebp - 0x14]
push ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push ecx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call esi
cmp eax, ebx
je 0x461591
mov edx, dword [0x6f7b78]
mov dword [ebp - 0x18], edx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
lea eax, [ebp - 0x18]
push str.CURRENT_USER_s
push eax
mov byte [ebp - 4], 5
call fcn.0061fae1
mov ecx, dword [ebp - 0x18]
add esp, 0xc
push ecx
lea ecx, [ebp - 0x48]
call fcn.005248e0
cmp eax, ebx
je 0x461583
lea edx, [ebp - 0x14]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareClassesCLSIDE6871B76_C3C8_44DD_B947_ABFFE144860D
push 0x80000001
call esi
test eax, eax
jne 0x461583
mov edx, dword [0x6fd3a0]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18c]
push eax
mov eax, dword [ebp - 0x14]
push ecx
push ebx
push ebx
push edx
push eax
call edi
cmp eax, ebx
je 0x461579
mov byte [ebp - 0x18c], bl
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 4
call fcn.00622d8a
jmp 0x4615bf
mov ecx, dword [0x6fd3a0]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x18c]
push edx
mov edx, dword [ebp - 0x14]
push eax
push ebx
push ebx
push ecx
push edx
call edi
cmp eax, ebx
je 0x4615b5
mov byte [ebp - 0x18c], bl
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00524870
cmp byte [ebp - 0x18c], bl
je 0x4615fb
mov edx, dword [0x6fdfd0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [ebp - 0x18c]
push 0x110
push ecx
lea ecx, [ebp - 0x28]
call fcn.00451930
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
jmp 0x4617d1
lea ecx, [ebp - 0x38]
call fcn.00524830
mov eax, dword [0x6fd758]
lea edx, [ebp - 0x14]
push ebx
push edx
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push eax
mov al, byte [0x6fcae8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
xor ecx, ecx
cmp al, bl
setne cl
add ecx, 0x80000001
mov byte [ebp - 4], 6
push ecx
mov dword [ebp - 0x1c], 0x110
call esi
cmp eax, ebx
je 0x461768
mov edx, dword [0x6f7b78]
mov dword [ebp - 0x18], edx
mov al, byte [0x6fcae8]
mov byte [ebp - 4], 7
cmp al, bl
mov eax, str.MACHINE
jne 0x461671
mov eax, str.CURRENT_USER
mov ecx, dword [0x6fd758]
lea edx, [ebp - 0x18]
push ecx
push eax
push 0x6c9ce8
push edx
call fcn.0061fae1
mov eax, dword [ebp - 0x18]
add esp, 0x10
lea ecx, [ebp - 0x38]
push eax
call fcn.005248e0
cmp eax, ebx
je 0x4616eb
lea ecx, [ebp - 0x14]
mov edx, dword [0x6fd758]
push ebx
push ecx
mov cl, byte [0x6fcae8]
xor eax, eax
push ebx
cmp cl, bl
push 0xf003f
push ebx
setne al
push ebx
push ebx
add eax, 0x80000001
push edx
push eax
call esi
test eax, eax
jne 0x4616eb
mov eax, dword [0x6fd3a0]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18c]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push ebx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x461750
jmp 0x46174a
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x38]
push eax
call fcn.005249b0
cmp eax, ebx
je 0x46175a
lea ecx, [ebp - 0x14]
mov edx, dword [0x6fd758]
push ebx
push ecx
mov cl, byte [0x6fcae8]
xor eax, eax
push ebx
cmp cl, bl
push 0xf003f
push ebx
setne al
push ebx
push ebx
add eax, 0x80000001
push edx
push eax
call esi
test eax, eax
jne 0x46175a
mov eax, dword [0x6fd3a0]
lea ecx, [ebp - 0x1c]
lea edx, [ebp - 0x18c]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
push ebx
push ebx
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x461750
mov byte [ebp - 0x18c], bl
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.00622d8a
jmp 0x46179a
mov edx, dword [0x6fd3a0]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x18c]
push eax
mov eax, dword [ebp - 0x14]
push ecx
push ebx
push ebx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x461790
mov byte [ebp - 0x18c], bl
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x18c], bl
je 0x4617ca
mov edx, dword [0x6fdfd0]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea edx, [ebp - 0x18c]
push 0x110
push edx
lea ecx, [ebp - 0x28]
call fcn.00451930
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.00524870
mov eax, dword [0x6cdb00]
lea esi, [ebp - 0x18c]
cmp eax, ebx
je 0x461820
mov eax, dword [0x6fd3a4]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x46180e
cmp cl, bl
je 0x46180a
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x46180e
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4617ea
xor eax, eax
jmp 0x461813
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4619e9
jmp 0x4619d5
mov eax, dword [0x6fd3b0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x461849
cmp cl, bl
je 0x461845
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x461849
add eax, 2
add esi, 2
cmp cl, bl
jne 0x461825
xor eax, eax
jmp 0x46184e
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4619d5
mov eax, dword [0x6fd3ac]
lea esi, [ebp - 0x18c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x461885
cmp cl, bl
je 0x461881
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x461885
add eax, 2
add esi, 2
cmp cl, bl
jne 0x461861
xor eax, eax
jmp 0x46188a
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4619d5
mov eax, dword [0x6fd3a8]
lea esi, [ebp - 0x18c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4618c1
cmp cl, bl
je 0x4618bd
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4618c1
add eax, 2
add esi, 2
cmp cl, bl
jne 0x46189d
xor eax, eax
jmp 0x4618c6
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x4619d5
mov eax, dword [0x6fd3a4]
lea esi, [ebp - 0x18c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4618fd
cmp cl, bl
je 0x4618f9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4618fd
add eax, 2
add esi, 2
cmp cl, bl
jne 0x4618d9
xor eax, eax
jmp 0x461902
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
jne 0x4619e9
mov ecx, dword [0x6fd498]
lea eax, [ebp - 0x18]
push eax
push 1
push ebx
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x461978
mov ecx, dword [0x6fd4a8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x7c]
push edx
mov edx, dword [ebp - 0x18]
push eax
push ebx
push ebx
mov esi, 0x32
push ecx
push edx
mov dword [ebp - 0x1c], esi
call edi
test eax, eax
je 0x46196c
mov edx, dword [0x6fd4a8]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x7c]
push eax
mov eax, dword [0x6fcafc]
push ecx
push ebx
push ebx
push edx
push eax
mov dword [ebp - 0x1c], esi
call edi
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x46199d
mov ecx, dword [0x6fd4a8]
lea edx, [ebp - 0x1c]
lea eax, [ebp - 0x7c]
push edx
mov edx, dword [0x6fcafc]
push eax
push ebx
push ebx
push ecx
push edx
mov dword [ebp - 0x1c], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edi, [ebp - 0x7c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x17
jne 0x4619c9
mov cl, byte [ebp - 0x77]
mov al, 0x2d
cmp cl, al
jne 0x4619c9
cmp byte [ebp - 0x71], al
jne 0x4619c9
mov cl, byte [ebp - 0x6b]
cmp cl, al
mov eax, 6
je 0x4619cc
mov eax, dword [ebp - 0x24]
inc eax
cmp eax, 7
mov dword [ebp - 0x24], eax
jbe 0x4619fa
mov eax, dword [ebp - 0x20]
push ebx
push eax
push 0x1c
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp - 0x24], 7
jae 0x4619e9
mov eax, dword [ebp - 0x20]
push ebx
push eax
push 0x1d
jmp 0x4619dc