Function at 0x6c377d33
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c
push 0x6c377fa8
call fcn.6c371338
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov eax, dword [ebp + 0x10]
cmp word [eax], si
jne 0x6c377d59
xor eax, eax
jmp 0x6c377f9f
mov edi, dword [ebp + 0xc]
cmp dword [edi], esi
jne 0x6c377d84
push 0x20000
push 0x4bc
push 0x6c37276c
call fcn.6c375051
mov dword [edi], eax
cmp eax, esi
jne 0x6c377d84
mov eax, 0xc0000bbb
jmp 0x6c377f9f
mov dword [ebp - 4], esi
mov eax, dword [edi]
cmp eax, esi
je 0x6c377d9d
push eax
push esi
push dword [0x6c3a7058]
call dword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x6c377d9f
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x44]
push eax
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
call ebx
lea eax, [ebp - 0x20]
push eax
push dword [edi]
lea eax, [ebp - 0x28]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x4c]
push eax
call ebx
xor eax, eax
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x44]
xor esi, esi
or eax, edx
or ecx, esi
xor edx, edx
mov esi, dword [ebp - 0x48]
mov edi, dword [ebp - 0x4c]
xor ebx, ebx
or edx, edi
or esi, ebx
sub edx, eax
sbb esi, ecx
add dword [ebp - 0x3c], edx
adc dword [ebp - 0x38], esi
xor ecx, ecx
mov edi, dword [ebp + 0xc]
cmp dword [ebp - 0x1c], ecx
jne 0x6c377eef
cmp dword [ebp - 0x20], ecx
jbe 0x6c377eef
mov eax, dword [edi]
cmp word [eax], 0x50
jne 0x6c377eef
cmp word [eax + 2], 0x45
jne 0x6c377eef
cmp word [eax + 4], 0x52
jne 0x6c377eef
cmp word [eax + 6], 0x46
jne 0x6c377eef
cmp dword [ebp + 0x14], ecx
je 0x6c377ee5
cmp eax, ecx
je 0x6c377e55
push eax
push ecx
push dword [0x6c3a7058]
call dword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x6c377e57
xor eax, eax
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov esi, dword [edi]
add esi, dword [ebp - 0x20]
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 0x28]
push eax
push 0
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x6c377eed
cmp dword [ebp - 0x2c], ebx
jbe 0x6c377eed
cmp word [esi], 0x50
jne 0x6c377eed
cmp word [esi + 2], 0x45
jne 0x6c377eed
cmp word [esi + 4], 0x52
jne 0x6c377eed
cmp word [esi + 6], 0x46
jne 0x6c377eed
mov eax, dword [edi]
mov ecx, dword [esi + 0x14]
sub ecx, dword [esi + 0x18]
add dword [eax + 0x14], ecx
mov edi, dword [edi]
mov eax, dword [esi + 0x1c]
add dword [edi + 0x1c], eax
mov ecx, dword [esi + 0x18]
lea edx, [ecx + esi]
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x24], esi
mov eax, esi
sub eax, ecx
add eax, dword [esi + 0x14]
cmp edx, eax
jae 0x6c377edd
mov ecx, dword [edx]
mov esi, dword [ebp - 0x24]
mov dword [esi], ecx
add dword [ebp - 0x24], 4
add edx, 4
mov dword [ebp - 0x30], edx
jmp 0x6c377ec6
and dword [ebp - 0x1c], ebx
jmp 0x6c377f95
mov dword [ebp - 0x1c], ecx
jmp 0x6c377f95
xor ecx, ecx
cmp dword [ebp - 0x1c], 0xea
jne 0x6c377f95
mov eax, dword [ebp - 0x38]
cmp eax, dword [0x6c3a7074]
jl 0x6c377f1d
jg 0x6c377f14
mov eax, dword [ebp - 0x3c]
cmp eax, dword [0x6c3a7070]
jbe 0x6c377f1d
mov dword [ebp - 0x1c], 0xc0000bfe
jmp 0x6c377f95
mov ebx, dword [ebp - 0x20]
mov eax, dword [edi]
cmp eax, ecx
je 0x6c377f36
push eax
push ecx
push dword [0x6c3a7058]
call dword [sym.imp.KERNEL32.dll_HeapSize]
jmp 0x6c377f38
xor eax, eax
mov dword [ebp - 0x20], eax
push dword [edi]
push 0x4fb
mov esi, 0x6c37276c
push esi
call fcn.6c3750c2
and dword [edi], 0
mov eax, dword [ebp - 0x20]
add eax, eax
mov dword [ebp - 0x20], eax
cmp eax, ebx
ja 0x6c377f65
mov dword [ebp - 0x1c], 0xc0000bbb
jmp 0x6c377f95
push eax
push 0x506
push esi
call fcn.6c375051
mov dword [edi], eax
test eax, eax
je 0x6c377f5c
xor esi, esi
jmp 0x6c377d87
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1c]
call fcn.6c37137d
ret 0x10