Function at 0x462350
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6b9240
push 0x60aa80
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x6d3438]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x38], ebx
test ebx, ebx
je 0x4623b0
mov dword [ebx], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0x1f4
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 0
mov eax, 0x200
call fcn.00608f50
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x4623ee
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
jmp 0x462428
mov eax, dword [ebp - 0x2c]
test esi, esi
je 0x46259a
lea ecx, [ebp - 0x24]
push ecx
push esi
lea ecx, [ebp - 0x20]
push ecx
push 0
push eax
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
cmp edi, 0xea
jne 0x462550
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x462469
push esi
call fcn.0060dd99
add esp, 4
mov dword [ebp - 0x28], 0
mov dword [ebp - 4], 1
mov edx, dword [ebp - 0x24]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x4624f7
cmp edx, ecx
sbb eax, eax
and eax, ecx
cmp eax, 0x400
ja 0x4624c4
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.00608f50
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x40], esi
test esi, esi
je 0x4624f9
mov dword [esi], 0xcccc
add esi, 8
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
jmp 0x462533
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.0060dd8e
add esp, 4
mov esi, eax
mov dword [ebp - 0x44], esi
test esi, esi
je 0x4624f9
mov dword [esi], 0xdddd
add esi, 8
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
jmp 0x462533
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x30]
jmp 0x462533
mov ecx, dword [ebp - 0x2c]
test esi, esi
je 0x46259a
lea edx, [ebp - 0x24]
push edx
push esi
lea edx, [ebp - 0x20]
push edx
push 0
push ecx
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
test edi, edi
jne 0x462582
cmp dword [ebp - 0x20], 3
je 0x462561
mov edi, 0xd
jmp 0x462582
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x24]
push esi
call fcn.00461c80
add esp, 0x14
mov edi, eax
test ebx, ebx
je 0x462582
mov eax, dword [ebp - 0x20]
mov dword [ebx], eax
add esi, 0xfffffff8
cmp dword [esi], 0xdddd
jne 0x462596
push esi
call fcn.0060dd99
add esp, 4
mov eax, edi
jmp 0x46259f
mov eax, 0xe
lea esp, [ebp - 0x60]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00608185
mov esp, ebp
pop ebp
ret 0x10