Function at 0x435ded
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
lea ecx, [ebp - 4]
mov dword [ebp - 8], ebx
call fcn.00404190
lea eax, [edi + 0x24]
mov ecx, edi
push eax
call fcn.00436720
mov ecx, edi
call fcn.004366a4
mov ecx, edi
mov dword [edi + 4], eax
call fcn.0043611e
mov ecx, edi
mov dword [edi + 8], eax
call fcn.00436370
mov dword [edi + 0xc], eax
cmp dword [ebp - 8], ebx
je 0x435e3c
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0x20219
push ebx
push str.SOFTWAREkingsoftAntivirusSetup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
call fcn.004041c0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 8], ebx
je 0x435ed3
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x61684c
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], 1
je 0x435e8c
cmp dword [ebp - 0x10], 2
jne 0x435ed3
lea ecx, [ebp - 4]
call fcn.004041c0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.004047c0
mov ebx, eax
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x61684c
push dword [ebp - 8]
call esi
test eax, eax
jne 0x435ec9
mov eax, dword [ebp - 0xc]
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2], cx
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0040e311
push dword [ebp - 4]
mov ebx, dword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
call ebx
pop ecx
lea ecx, [ebp - 4]
mov dword [edi + 0x10], eax
call fcn.004041c0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], ecx
je 0x435f5f
lea eax, [ebp - 0xc]
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push str.tid1
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], 1
je 0x435f14
cmp dword [ebp - 0x10], 2
jne 0x435f5f
lea ecx, [ebp - 4]
call fcn.004041c0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.tid1
push dword [ebp - 8]
call esi
test eax, eax
jne 0x435f55
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0040e311
push dword [ebp - 4]
call ebx
pop ecx
lea ecx, [ebp - 4]
mov dword [edi + 0x14], eax
call fcn.004041c0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], ecx
je 0x435fe5
lea eax, [ebp - 0xc]
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push str.tid2
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], 1
je 0x435f9a
cmp dword [ebp - 0x10], 2
jne 0x435fe5
lea ecx, [ebp - 4]
call fcn.004041c0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.tid2
push dword [ebp - 8]
call esi
test eax, eax
jne 0x435fdb
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0040e311
push dword [ebp - 4]
call ebx
pop ecx
lea ecx, [ebp - 4]
mov dword [edi + 0x18], eax
call fcn.004041c0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], ecx
je 0x43606b
lea eax, [ebp - 0xc]
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push str.tod1
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], 1
je 0x436020
cmp dword [ebp - 0x10], 2
jne 0x43606b
lea ecx, [ebp - 4]
call fcn.004041c0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.tod1
push dword [ebp - 8]
call esi
test eax, eax
jne 0x436061
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0040e311
push dword [ebp - 4]
call ebx
pop ecx
lea ecx, [ebp - 4]
mov dword [edi + 0x1c], eax
call fcn.004041c0
xor ecx, ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], ecx
je 0x4360f1
lea eax, [ebp - 0xc]
push eax
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push str.tod2
push dword [ebp - 8]
call esi
cmp dword [ebp - 0x10], 1
je 0x4360a6
cmp dword [ebp - 0x10], 2
jne 0x4360f1
lea ecx, [ebp - 4]
call fcn.004041c0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
shr eax, 1
inc eax
push eax
call fcn.004047c0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0x14], eax
push ecx
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push str.tod2
push dword [ebp - 8]
call esi
test eax, eax
jne 0x4360e7
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
shr eax, 1
xor edx, edx
mov word [ecx + eax*2], dx
push 0xffffffffffffffff
lea ecx, [ebp - 4]
call fcn.0040e311
mov esi, dword [ebp - 4]
push esi
call ebx
pop ecx
lea ecx, [esi - 0x10]
mov dword [edi + 0x20], eax
call fcn.004023e0
cmp dword [ebp - 8], 0
pop edi
pop esi
pop ebx
je 0x436115
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
leave
ret