Function at 0x4365a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1270
call fcn.005e00d0
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x126c], ecx
mov ecx, 0xf
mov esi, str.SoftwareMicroWorldeScan_For_WindowsMwMonitorExcludeFolders
lea edi, [ebp - 0xe3c]
rep movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsw word es:[edi], word [esi]
push 0x1c9
lea edx, [ebp - 0xdfd]
push ebx
push edx
mov dword [ebp - 0x1268], eax
mov dword [ebp - 0x1254], ebx
mov dword [ebp - 0x125c], ebx
movsb byte es:[edi], byte [esi]
call fcn.005dfd60
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x6b3ca0], eax
lea eax, [ebp - 0x1254]
push eax
push 0x20019
push ebx
lea ecx, [ebp - 0xe3c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x43697a
mov eax, dword [ebp - 0x1254]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x125c]
push edx
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x436664
mov ecx, dword [ebp - 0x1254]
push ecx
jmp 0x436974
mov esi, dword [ebp - 0x125c]
cmp esi, ebx
jbe 0x436969
push 0x40f
lea edx, [ebp - 0x124b]
push ebx
push edx
mov byte [ebp - 0x124c], bl
call fcn.005dfd60
add esp, 0xc
mov dword [ebp - 0x1264], ebx
cmp esi, ebx
jbe 0x436969
mov edi, 0x410
mov edx, dword [ebp - 0x1264]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1270]
push eax
mov eax, dword [ebp - 0x1254]
lea ecx, [ebp - 0x124c]
push ecx
push edx
push eax
mov byte [ebp - 0x124c], bl
mov dword [ebp - 0x1270], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x436969
cmp byte [ebp - 0x124c], bl
je 0x436950
push 0x40f
lea ecx, [ebp - 0x823]
push ebx
push ecx
mov dword [ebp - 0x1250], ebx
mov byte [ebp - 0x824], bl
call fcn.005dfd60
mov ecx, dword [ebp - 0x1254]
add esp, 0xc
lea edx, [ebp - 0x1250]
push edx
push 0x20019
push ebx
lea eax, [ebp - 0x124c]
push eax
push ecx
mov dword [ebp - 0x1258], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x436969
mov ecx, dword [ebp - 0x1250]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0x1258]
push edx
lea eax, [ebp - 0x824]
push eax
push ebx
push ebx
push str.ObjectName
push ecx
mov dword [ebp - 0x1258], edi
call esi
mov edx, dword [ebp - 0x1250]
test eax, eax
je 0x436776
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x436950
lea eax, [ebp - 0x1258]
push eax
lea ecx, [ebp - 0x1260]
push ecx
push ebx
push ebx
push str.ObjectType
push edx
mov dword [ebp - 0x1258], 4
call esi
test eax, eax
je 0x4367ae
mov eax, dword [ebp - 0x1250]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x436950
mov ecx, dword [ebp - 0x1250]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1250], ebx
cmp byte [ebp - 0x824], bl
je 0x436950
cmp dword [ebp - 0x1260], ebx
jbe 0x436950
push 0x40f
lea edx, [ebp - 0x413]
push ebx
push edx
mov byte [ebp - 0x414], bl
call fcn.005dfd60
add esp, 0xc
cmp byte [ebp - 0x824], 0x5c
je 0x436814
cmp byte [ebp - 0x823], 0x5c
je 0x436814
push 1
lea eax, [ebp - 0x824]
push eax
call fcn.00515650
mov al, byte [ebp - 0x1260]
test al, 1
je 0x43685a
push edi
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x824]
push edx
mov byte [ebp - 0x414], bl
call fcn.004e82a0
mov esi, dword [ebp - 0x1268]
add esp, 0xc
push 1
push 0x2c
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.004e5820
mov al, byte [ebp - 0x1260]
jmp 0x436860
mov esi, dword [ebp - 0x1268]
test al, 2
je 0x436950
test al, 4
je 0x436911
push 0x40f
lea ecx, [ebp - 0xc33]
push ebx
push ecx
mov byte [ebp - 0xc34], bl
call fcn.005dfd60
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0xc34]
push 0x60c800
push eax
call fcn.005dfb23
mov ecx, dword [ebp - 0x126c]
push ecx
lea edx, [ebp - 0xc34]
push edx
call fcn.00435470
add esp, 0x20
test eax, eax
jne 0x436950
push edi
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x824]
push ecx
call fcn.004e82a0
add esp, 0xc
cmp byte [ebp - 0x414], bl
je 0x436950
lea edx, [ebp - 0x414]
push edx
call fcn.004e24e0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0xc34]
push 0x61d74c
push ecx
call fcn.005dfb23
add esp, 0x10
push 1
push 0x2c
lea edx, [ebp - 0xc34]
push edx
jmp 0x43694a
push edi
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x824]
push ecx
call fcn.004e82a0
add esp, 0xc
cmp byte [ebp - 0x414], bl
je 0x436950
lea edx, [ebp - 0x414]
push edx
call fcn.004e24e0
add esp, 4
push 1
push 0x2c
lea eax, [ebp - 0x414]
push eax
push esi
call fcn.004e5820
mov eax, dword [ebp - 0x1264]
inc eax
mov dword [ebp - 0x1264], eax
cmp eax, dword [ebp - 0x125c]
jb 0x4366a0
mov eax, dword [ebp - 0x1254]
cmp eax, ebx
je 0x43697a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret