Function at 0x4364d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
call fcn.004368c0
mov esi, eax
test esi, esi
je 0x4364eb
mov ecx, esi
call fcn.00433140
cmp byte [0x645e10], 0
jne 0x436508
lea eax, [ebp - 0x14]
push eax
call fcn.00436280
push dword [ebp - 0x10]
call fcn.00546a09
add esp, 8
cmp dword [0x645e08], 0
mov ebx, dword [ebp + 0x10]
je 0x436533
push 0x54ca88
mov ecx, ebx
call fcn.00423cc0
test eax, eax
jne 0x436533
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x645e08]
mov dword [ecx], eax
jmp 0x436888
cmp dword [0x645e0c], 0
je 0x43655b
push str.local
mov ecx, ebx
call fcn.00423cc0
test eax, eax
jne 0x43655b
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x645e0c]
mov dword [ecx], eax
jmp 0x436888
lea eax, [ebp - 0x10]
mov ecx, 0x5aa220
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
call fcn.0042b990
mov edx, dword [ebp - 8]
mov ecx, dword [0x5aa228]
mov edi, dword [0x5aa224]
test edx, edx
je 0x43658d
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], edx
jmp 0x4365a8
test ecx, ecx
je 0x43659f
lea eax, [ecx - 1]
imul eax, edi
add eax, dword [0x5aa220]
jmp 0x4365a1
xor eax, eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0x5aa220
mov edx, dword [eax]
mov dword [ebp - 4], edx
mov edx, dword [eax + 4]
mov dword [ebp - 8], edx
mov edx, dword [eax + 8]
test ecx, ecx
je 0x4365d5
lea eax, [ecx - 1]
imul eax, edi
add eax, dword [0x5aa220]
jmp 0x4365d7
xor eax, eax
test edx, edx
jne 0x436880
cmp dword [ebp - 8], eax
jne 0x436880
cmp dword [ebp - 4], 0x5aa220
jne 0x436880
push 0x54c33c
call fcn.00420de0
add esp, 4
cmp dword [ebx], eax
jb 0x436624
push eax
push 0x54c33c
push dword [ebx + 8]
call fcn.00420e30
add esp, 0xc
test eax, eax
sete al
test al, al
jne 0x4367c1
push 0x54c338
mov ecx, ebx
call fcn.00436930
test al, al
jne 0x4367c1
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones_
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
call fcn.00420de0
add esp, 4
lea ecx, [ebp - 0x28]
push eax
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones_
call fcn.0040e2d0
push dword [ebx]
lea ecx, [ebp - 0x28]
push dword [ebx + 8]
call fcn.0040e240
mov eax, dword [ebp - 0x20]
mov edi, 0x5b3158
test eax, eax
mov dword [ebp - 0x10], 0
mov ecx, edi
mov dword [ebp - 0xc], 0x2c
cmovne ecx, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4366df
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00421450
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x38]
add esp, 8
mov dword [edi], 1
mov dword [edi + 4], 0
call fcn.004213a0
lea ecx, [ebp - 0x28]
call fcn.004213a0
jmp 0x436898
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x54cad0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4366ad
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0xac
call fcn.005469cd
push 0xac
push 0
push eax
mov dword [ebp - 8], eax
call sub.VCRUNTIME140.dll_memset
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
push 0x24
mov dword [edx], ecx
mov ecx, dword [ebp - 0x5c]
mov dword [edx + 0xa8], ecx
mov eax, dword [ebp - 0x48]
mov dword [edx + 0x98], eax
mov eax, dword [ebp - 0x44]
mov dword [edx + 0x9c], eax
mov eax, dword [ebp - 0x40]
mov dword [edx + 0xa0], eax
mov eax, dword [ebp - 0x3c]
mov dword [edx + 0xa4], eax
mov eax, dword [ebp - 0x60]
mov dword [edx + 0x54], eax
mov eax, dword [ebp - 0x58]
mov dword [edx + 0x44], eax
mov eax, dword [ebp - 0x54]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 0x50]
mov dword [edx + 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [edx + 0x50], eax
call fcn.005469cd
mov edx, eax
add esp, 0x14
test edx, edx
je 0x43679d
mov ecx, dword [ebx + 8]
test ecx, ecx
mov eax, dword [ebp - 8]
cmovne edi, ecx
mov ecx, edx
push eax
push edi
call fcn.004361d0
mov ecx, eax
jmp 0x43679f
xor ecx, ecx
mov eax, dword [ebp + 0xc]
push eax
push ebx
mov dword [eax], ecx
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x5aa220
call fcn.0042fcb0
lea ecx, [ebp - 0x28]
call fcn.004213a0
jmp 0x436888
mov eax, dword [ebx + 8]
test eax, eax
je 0x4367d5
push eax
call fcn.00420bd0
add esp, 4
mov edi, eax
jmp 0x4367d7
xor edi, edi
cmp dword [ebx], 3
jne 0x4367e3
mov dword [ebp - 8], edi
xor edi, edi
jmp 0x4367fc
mov eax, 0x51eb851f
imul edi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov dword [ebp - 8], eax
imul eax, eax, 0x64
sub edi, eax
push 0xac
call fcn.005469cd
push 0xac
push 0
push eax
mov dword [ebp - 4], eax
call sub.VCRUNTIME140.dll_memset
mov ecx, dword [ebp - 8]
neg edi
mov eax, dword [ebp - 4]
shl ecx, 4
sub ecx, dword [ebp - 8]
shl ecx, 2
sub edi, ecx
push 0x24
mov dword [eax], edi
call fcn.005469cd
add esp, 0x14
mov dword [ebp - 0x10], eax
test eax, eax
je 0x436867
mov ecx, dword [ebx + 8]
mov edi, 0x5b3158
test ecx, ecx
cmovne edi, ecx
mov ecx, dword [ebp - 4]
push edi
mov dword [eax + 0x20], ecx
call fcn.00420de0
push eax
push edi
mov edi, dword [ebp - 0x10]
push 0x20
push edi
call fcn.00420d60
add esp, 0x14
jmp 0x436869
xor edi, edi
mov eax, dword [ebp + 0xc]
mov ecx, 0x5aa220
push eax
push ebx
mov dword [eax], edi
lea eax, [ebp - 0x38]
push eax
call fcn.0042fcb0
jmp 0x436888
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx + 0x14]
mov dword [eax], ecx
mov edi, dword [ebp + 8]
mov dword [edi + 4], 0
mov dword [edi], 0
test esi, esi
je 0x4368a3
mov ecx, esi
call fcn.00433150
push 0
call fcn.00546a09
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret