Function at 0x61245e23
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x61253ebc]
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push edi
push 0x80
push 0x612543e0
push 4
push dword [0x612543d0]
mov dword [ebp - 4], eax
call esi
push 3
pop edi
push edi
push 0x61254aa8
push 0x37
push dword [0x612543d0]
call esi
push edi
push 0x61254950
push 0x38
push dword [0x612543d0]
call esi
push edi
push 0x61254978
push 0x39
push dword [0x612543d0]
call esi
push edi
push 0x61254710
push 0x3a
push dword [0x612543d0]
call esi
push edi
push 0x61254718
push 0x3b
push dword [0x612543d0]
call esi
push edi
push 0x61254960
push 0x3c
push dword [0x612543d0]
call esi
push edi
push 0x61254980
push 0x3d
push dword [0x612543d0]
call esi
push edi
push 0x61254958
push 0x3e
push dword [0x612543d0]
call esi
xor ebx, ebx
cmp word [0x61254aa8], 0x48
jne 0x61245f2e
cmp word [0x61254950], 0x68
jne 0x61245f2e
cmp word [0x61254978], 0x4d
jne 0x61245f2e
cmp word [0x61254710], 0x6d
jne 0x61245f2e
cmp word [0x61254718], 0x73
jne 0x61245f2e
cmp word [0x61254960], 0x74
jne 0x61245f2e
cmp word [0x61254980], 0x64
jne 0x61245f2e
cmp word [0x61254958], 0x79
mov dword [0x61254988], ebx
je 0x61245f38
mov dword [0x61254988], 1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [0x61254ab0], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [0x6125496c], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push ebx
push 0x612415f0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x61245fc6
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x61241de8
push dword [ebp - 0x210]
mov word [ebp - 0x20c], bx
mov dword [ebp - 0x214], 0x208
call esi
push dword [ebp - 0x210]
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.6124b12d
cmp eax, ebx
mov dword [0x61254720], eax
jne 0x61245fd0
mov eax, dword [0x6125496c]
mov dword [0x61254720], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push ebx
push 0x6124164c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x6124603c
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x61241dd8
push dword [ebp - 0x210]
mov word [ebp - 0x20c], bx
mov dword [ebp - 0x214], 0x208
call esi
push dword [ebp - 0x210]
call edi
lea eax, [ebp - 0x20c]
push eax
call fcn.6124b12d
cmp eax, ebx
mov dword [0x61254724], eax
jne 0x61246046
mov eax, dword [0x61254ab0]
mov dword [0x61254724], eax
push dword [0x61254ab0]
call fcn.61245dc5
mov dword [0x612544e0], eax
cmp eax, ebx
mov eax, dword [0x61254ab0]
je 0x61246076
mov ecx, eax
and cx, 0x3ff
cmp cx, 0xd
mov dword [0x612543cc], 1
jne 0x6124607c
mov dword [0x612543cc], ebx
and ax, 0x3ff
sub ax, 0xd
neg ax
push 0x61241dc8
sbb eax, eax
inc eax
mov dword [0x61254708], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
neg eax
pop edi
mov dword [0x61254970], eax
xor eax, eax
pop esi
inc eax
pop ebx
call fcn.6124ff04
leave
ret