Function at 0x411040
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x5025bb
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
mov eax, dword [0x5466b0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
mov dword [esp + 0x1c], 0x54fee8
call edx
add eax, 0x10
mov dword [0x54feec], eax
xor esi, esi
mov dword [esp + 0x28], esi
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [0x54fef0], eax
mov ebx, 1
mov byte [esp + 0x28], bl
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [0x54fef4], eax
mov byte [esp + 0x28], 2
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [0x54fef8], eax
mov byte [esp + 0x28], 3
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [0x54fefc], eax
mov byte [esp + 0x28], 4
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [0x54ff00], eax
mov byte [esp + 0x28], 5
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [0x54ff04], eax
mov byte [esp + 0x28], 6
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
mov dword [0x54ff08], esi
mov dword [0x54ff0c], ebx
call edx
add eax, 0x10
mov dword [0x54ff14], eax
push 0x54ff18
mov byte [esp + 0x2c], 7
call fcn.0046776d
mov byte [esp + 0x28], 8
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
call edx
add eax, 0x10
mov dword [0x550034], eax
mov byte [esp + 0x28], 9
push 0x550038
call fcn.00417af0
push 0x550054
mov byte [esp + 0x2c], 0xa
call fcn.0040b540
mov byte [esp + 0x28], 0xb
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
mov dword [0x550094], ebx
mov dword [0x550098], esi
mov dword [0x55009c], esi
mov dword [0x5500a0], esi
mov dword [0x5500a4], esi
mov dword [0x5500b4], esi
call edx
add eax, 0x10
mov dword [0x5500b8], eax
mov byte [esp + 0x28], 0xc
mov eax, dword [0x54d210]
mov edx, dword [eax + 0xc]
mov ecx, 0x54d210
mov dword [0x5500bc], esi
call edx
add eax, 0x10
mov dword [0x5500c8], eax
mov byte [esp + 0x28], 0xd
mov eax, dword [0x55003c]
mov dword [0x54ff10], ebx
mov dword [eax + 0x2c], 0x414cf0
mov eax, 4
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x20]
push eax
push str.sunt_sample
push str.SOFTWARE360Safe_softmgr
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x411279
mov ecx, dword [esp + 0x10]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
imul edx, edx, 0x3e8
sub ecx, edx
sub ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [0x550050], ecx
jmp 0x4112a2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004ce0a6
add esp, 4
call fcn.004ce0b8
cdq
mov ecx, 0x3e8
idiv ecx
sub edx, ebx
neg edx
sbb edx, edx
inc edx
mov dword [0x550050], edx
push str.softmgr
mov ebx, 7
mov eax, 0x54fef0
call fcn.00408500
push str.360newstip
mov ebx, 0xa
mov eax, 0x54fef4
call fcn.00408500
mov eax, 0x54fee8
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x20
ret