Function at 0x412b50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557836
mov eax, dword fs:[0]
push eax
sub esp, 0x3c4
mov eax, dword [0x5adf10]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.004128c0
test eax, eax
je 0x412b8e
xor eax, eax
jmp 0x413043
push str.SoftwareMicrosoftWindows_NTCurrentVersionTime_ZonesChina_Standard_Time
lea ecx, [ebp - 0x3b4]
call fcn.00405fd0
lea eax, [ebp - 0x3b8]
push eax
push 0x20019
xor ebx, ebx
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x3b4]
push ebx
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x412d47
mov eax, dword [0x587910]
mov ecx, dword [str.China_Standard_Time]
mov edx, dword [0x58790c]
push 0xec
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x110], ecx
mov ecx, dword [0x587914]
mov dword [ebp - 0x10c], edx
mov edx, dword [0x587918]
lea eax, [ebp - 0xfc]
push ebx
push eax
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x100], edx
call fcn.005344b0
lea eax, [ebp - 0x110]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x412c23
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
sub eax, edx
inc eax
push eax
lea ecx, [ebp - 0x304]
push ecx
push eax
lea edx, [ebp - 0x110]
push edx
push ebx
push ebx
mov dword [ebp - 0x3c4], eax
call esi
mov edx, dword [ebp - 0x3b8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x3bc]
push eax
lea ecx, [ebp - 0x110]
push ecx
push ebx
push ebx
push 0x587a0c
push edx
mov dword [ebp - 0x3bc], 0x20
call edi
cmp eax, ebx
je 0x412cae
mov eax, dword [ebp - 0x3b8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3b4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x412d64
mov ecx, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x3c4]
push ecx
lea edx, [ebp - 0x3ac]
push edx
push eax
lea ecx, [ebp - 0x110]
push ecx
push ebx
push ebx
call esi
mov edx, dword [ebp - 0x3bc]
mov ecx, dword [ebp - 0x3c4]
push edx
lea eax, [ebp - 0x1fc]
push eax
push ecx
lea edx, [ebp - 0x110]
push edx
push ebx
push ebx
call esi
mov eax, dword [ebp - 0x3bc]
mov edx, dword [ebp - 0x3c4]
push eax
lea ecx, [ebp - 0x1a8]
push ecx
push edx
lea eax, [ebp - 0x110]
push eax
push ebx
push ebx
call esi
mov eax, dword [ebp - 0x3b8]
lea ecx, [ebp - 0x3c4]
push ecx
lea edx, [ebp - 0x110]
push edx
push ebx
push ebx
push 0x587a10
push eax
mov dword [ebp - 0x3bc], 0x20
call edi
cmp eax, ebx
je 0x412d79
mov ecx, dword [ebp - 0x3b8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x3b4]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41303e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x41303e
mov ecx, dword [ebp - 0x3bc]
mov eax, dword [ebp - 0x3c4]
push ecx
lea edx, [ebp - 0x358]
push edx
push eax
lea ecx, [ebp - 0x110]
push ecx
push ebx
push ebx
call esi
mov ecx, dword [ebp - 0x3b8]
lea edx, [ebp - 0x3d0]
push edx
lea eax, [ebp - 0x14c]
push eax
push ebx
push ebx
push 0x587a14
mov esi, 0x2c
push ecx
mov dword [ebp - 0x3d0], esi
call edi
cmp eax, ebx
jne 0x413026
cmp dword [ebp - 0x3d0], esi
ja 0x413026
mov edi, dword [ebp - 0x134]
mov eax, dword [ebp - 0x14c]
mov edx, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x140]
mov esi, dword [ebp - 0x138]
mov dword [ebp - 0x360], edi
mov edi, dword [ebp - 0x130]
mov dword [ebp - 0x318], edi
mov edi, dword [ebp - 0x12c]
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x368], edx
mov dword [ebp - 0x314], edi
mov edi, dword [ebp - 0x128]
mov dword [ebp - 0x1b8], edx
mov edx, dword [ebp - 0x134]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x3b8]
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x310], edi
mov edi, dword [ebp - 0x124]
mov dword [ebp - 0x1bc], ecx
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x1b0], edx
mov edx, dword [ebp - 0x128]
push eax
mov dword [ebp - 0x364], esi
mov dword [ebp - 0x30c], edi
mov dword [ebp - 0x308], ebx
mov dword [ebp - 0x35c], ebx
mov byte [ebp - 0x204], bl
mov dword [ebp - 0x1b4], esi
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edi
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x1ac], ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3cc]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [ebp - 0x11c]
push edx
push str.SeTimeZonePrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0x3cc]
mov edi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x120]
push eax
push ebx
push ecx
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x114], 2
call edi
lea esi, [ebp - 0x3c0]
call fcn.004129d0
mov edx, esi
push str.Windows_2000
push edx
mov byte [ebp - 4], 1
call fcn.00405af0
add esp, 8
test al, al
jne 0x412f9b
mov eax, esi
push str.Windows_2003
push eax
call fcn.00405af0
add esp, 8
test al, al
jne 0x412f9b
mov ecx, esi
push str.Windows_XP
push ecx
call fcn.00405af0
add esp, 8
test al, al
jne 0x412f9b
mov edx, esi
push 0x5879a4
push edx
call fcn.00413d10
add esp, 8
test al, al
je 0x412fd2
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x412fd2
push str.SetDynamicTimeZoneInformation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x412fcb
lea ecx, [ebp - 0x3b0]
push ecx
jmp 0x412fc3
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x412fd2
push str.SetTimeZoneInformation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x412fcb
lea edx, [ebp - 0x200]
push edx
call eax
mov dword [ebp - 0x3c8], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x3c8], ebx
jne 0x412ff7
lea ecx, [ebp - 0x3c0]
call fcn.00406410
lea ecx, [ebp - 0x3b4]
call fcn.00406410
mov eax, 2
jmp 0x413043
mov ecx, dword [ebp - 0x3cc]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x120]
push eax
push ebx
push ecx
mov dword [ebp - 0x114], ebx
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0x3c0]
call fcn.00406410
jmp 0x413033
mov edx, dword [ebp - 0x3b8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x3b4]
call fcn.00406410
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0052d75c
mov esp, ebp
pop ebp
ret