Function at 0x436920
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x358
push ebx
push ebp
push esi
push edi
xor ebx, ebx
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x22c]
mov dword [esp + 0x228], ebx
mov byte [esp + 0x124], bl
rep stosd dword es:[edi], eax
mov ecx, 0x40
lea edi, [esp + 0x125]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x36c]
lea ecx, [esp + 0x124]
push eax
push str.SOFTWARESangforSSLRunApp_
push 0x446820
push ecx
xor ebp, ebp
mov dword [esp + 0x20], ebx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x2d]
add esp, 0x10
mov byte [esp + 0x1c], bl
lea edx, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x124]
push edx
push eax
push reloc.WS2_32.dll_bind
mov dword [esp + 0x20], 2
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, dword [esp + 0x370]
test eax, eax
jne 0x436ab0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push ebx
push str.Path
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x436a99
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x436a99
mov edx, dword [esp + 0x378]
mov eax, dword [esp + 0x374]
push edx
push eax
lea ecx, [esp + 0x24]
push esi
push ecx
call fcn.00436740
add esp, 0x10
cmp eax, 1
jne 0x436a99
mov edi, str.file:
or ecx, 0xffffffff
xor eax, eax
mov edx, dword [esi]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.file:
push edx
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x436a94
mov edi, 0x44f228
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
not ecx
dec ecx
push ecx
push 0x44f228
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x436a94
mov edx, dword [esi]
lea ecx, [esp + 0x228]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x436bb1
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebp, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, ebx
mov dword [esp + 0x10], ebx
jne 0x436c55
cmp dword [0x44f858], ebx
je 0x436c55
lea eax, [esp + 0x10]
lea ecx, [esp + 0x124]
push eax
push ecx
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x436c55
lea edx, [esp + 0x18]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push ebx
push str.Path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x436c4a
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x436c4a
mov eax, dword [esp + 0x378]
mov ecx, dword [esp + 0x374]
push eax
push ecx
lea edx, [esp + 0x24]
push esi
push edx
call fcn.00436740
add esp, 0x10
cmp eax, 1
jne 0x436c4a
mov edi, str.file:
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esi]
not ecx
dec ecx
push ecx
push str.file:
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x436c45
mov edi, 0x44f228
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esi]
push 0x44f228
push ecx
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x436c45
mov eax, dword [esi]
lea edx, [esp + 0x228]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x436c02
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x436c45
mov eax, dword [esi]
cmp eax, ebx
je 0x436bc2
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi], ebx
mov edi, dword [esp + 0x374]
mov eax, dword [edi]
cmp eax, ebx
je 0x436bda
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [edi], ebx
mov eax, dword [esp + 0x378]
mov eax, dword [eax]
cmp eax, ebx
je 0x436a99
push eax
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x37c]
add esp, 4
mov dword [ecx], ebx
jmp 0x436a99
mov eax, dword [esi]
cmp eax, ebx
je 0x436c13
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi], ebx
mov esi, dword [esp + 0x374]
mov eax, dword [esi]
cmp eax, ebx
je 0x436c2b
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi], ebx
mov esi, dword [esp + 0x378]
mov eax, dword [esi]
cmp eax, ebx
je 0x436c4a
push eax
call sub.MFC42.DLL_operatordelete
add esp, 4
mov dword [esi], ebx
jmp 0x436c4a
mov ebp, 1
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x358
ret