Function at 0x402abb
Capabilities:
Check for time delay via gettickcount
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1cdc
call fcn.004115a0
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x25c]
mov ecx, dword [eax + 0x4444]
test ecx, ecx
push edi
mov dword [ebp - 0xc], esi
jl 0x402ae9
cmp dword [ebp + 0x14], ecx
jg 0x40348a
mov ecx, dword [eax + 0x340c]
cmp ecx, 6
je 0x402af9
cmp ecx, 7
jne 0x402b11
mov ebx, dword [esi + 0x1d0]
lea ecx, [eax + 0x2001]
mov eax, dword [eax + 0x3420]
push ecx
call fcn.0040c627
mov eax, dword [esi + 0x25c]
cmp dword [eax + 0x3410], 0
je 0x402b6e
and dword [ebp - 0x20], 0
mov byte [ebp - 0x1cd8], 0
mov edi, 0xfff
jmp 0x402b51
lea eax, [ebp - 0x1cd8]
push eax
push dword [ebp + 0x10]
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
je 0x40348a
mov eax, dword [esi + 0x25c]
add eax, 0x2402
push eax
lea eax, [ebp - 0x1cd8]
push edi
push eax
lea ebx, [ebp - 0x20]
call fcn.0040581f
add esp, 0xc
test eax, eax
jne 0x402b32
xor edi, edi
push 0x3ff
lea eax, [ebp - 0x8af]
push edi
push eax
mov dword [ebp - 4], edi
mov byte [ebp - 0x8b0], 0
call sub.msvcrt.dll_memset
mov eax, dword [esi + 0x25c]
mov ecx, dword [esi + 0x2c]
add esp, 0xc
cmp ecx, dword [eax + 0x3408]
jl 0x402baa
mov dword [esi + 0x258], 1
cmp dword [esi + 0x258], edi
jne 0x40348a
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
call edi
sub eax, dword [esi + 0x254]
cmp eax, 0x32
jbe 0x402c2a
push dword [ebp + 0x10]
call sub.msvcrt.dll_strlen
cmp eax, 0x300
pop ecx
push 0xa
pop ebx
jae 0x402be6
call fcn.004062bc
push dword [ebp + 0x10]
jmp 0x402bf0
call fcn.004062bc
push 0x412535
push dword [esi + 0x2c]
push eax
lea eax, [ebp - 0x8b0]
push eax
call sub.msvcrt.dll_sprintf
add esp, 0x10
lea eax, [ebp - 0x8b0]
push eax
push 0
push 0x401
push dword [esi + 0x1c8]
call dword [sym.imp.USER32.dll_SendMessageA]
call fcn.00401d41
call edi
mov dword [esi + 0x254], eax
inc dword [esi + 0x260]
or dword [ebp - 0x40], 0xffffffff
push str.HKCUSoftwareClassesVirtualStoreMachineSOFTWARE
push dword [ebp + 0x10]
call sub.msvcrt.dll__mbsicmp
test eax, eax
pop ecx
pop ecx
push dword [0x41571c]
jne 0x402c64
call fcn.00401de0
or eax, 0x20019
push eax
push str.SoftwareClassesVirtualStoreMachineSOFTWARE
push 0x80000001
jmp 0x402c75
call fcn.00401de0
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
lea esi, [ebp - 4]
call fcn.0040ff4b
xor edi, edi
cmp eax, edi
jne 0x40347b
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xcd8]
push eax
push 1
push dword [ebp + 8]
mov dword [ebp - 0x74], 0x424
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
test eax, eax
jne 0x402d12
mov esi, 0x415b04
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x3c], edi
call fcn.0040dba3
test eax, eax
je 0x402d12
push str.GetSecurityDescriptorOwner
push dword [0x415b04]
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, edi
je 0x402d12
lea ecx, [ebp - 0x3c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0xcd8]
push ecx
call eax
cmp eax, edi
je 0x402d12
cmp dword [ebp - 0x14], edi
je 0x402d12
mov eax, dword [0x41571c]
cmp dword [eax + 0x4478], edi
je 0x402cff
add eax, 0x4480
jmp 0x402d01
xor eax, eax
push dword [ebp - 0x14]
push eax
push 0x41514c
call fcn.0040dbc3
mov dword [ebp - 0x40], eax
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x7c], ecx
lea edi, [ebp - 0x78]
stosd dword es:[edi], eax
mov dword [ebp - 0x38], ecx
lea edi, [ebp - 0x34]
stosd dword es:[edi], eax
lea eax, [ebp - 0x7c]
push eax
push ecx
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
push eax
push ecx
push ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
push ecx
push dword [ebp - 4]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004059ff
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebx + 0x25c]
mov eax, dword [esi + 0x342c]
cmp eax, 2
pop ecx
pop ecx
mov dword [ebp + 8], 1
jne 0x402de6
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
or ecx, edx
mov edx, dword [esi + 0x4450]
mov dword [ebp - 0x2c], edx
mov edx, dword [esi + 0x444c]
mov dword [ebp - 0x10], ecx
xor ecx, ecx
or ecx, edx
mov edx, dword [ebp - 0x2c]
xor edi, edi
or eax, edi
or edx, edi
cmp eax, edx
jb 0x402eaa
ja 0x402db6
cmp dword [ebp - 0x10], ecx
jb 0x402eaa
mov edx, dword [esi + 0x4458]
mov dword [ebp - 0x2c], edx
mov edx, dword [esi + 0x4454]
xor ecx, ecx
or ecx, edx
mov edx, dword [ebp - 0x2c]
xor edi, edi
or edx, edi
cmp eax, edx
jb 0x402eae
ja 0x402eaa
cmp dword [ebp - 0x10], ecx
jmp 0x402ea8
cmp eax, 1
jne 0x402eae
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004059ff
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebx + 0x25c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [esi + 0x3430]
cmp eax, 1
pop ecx
pop ecx
jne 0x402e2f
mov eax, dword [esi + 0x3434]
neg eax
jmp 0x402e63
cmp eax, 2
jne 0x402e3f
mov eax, dword [esi + 0x3434]
imul eax, eax, 0xffffffc4
jmp 0x402e63
cmp eax, 3
jne 0x402e52
mov eax, dword [esi + 0x3434]
imul eax, eax, 0xfffff1f0
jmp 0x402e63
cmp eax, 4
jne 0x402e6d
mov eax, dword [esi + 0x3434]
imul eax, eax, 0xfffeae80
push eax
lea edi, [ebp - 0x10]
call fcn.004053d0
pop ecx
mov edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
xor ecx, ecx
or ecx, edx
mov edx, dword [ebp - 0xc]
xor edi, edi
mov dword [ebp - 0x30], ecx
xor ecx, ecx
or ecx, dword [ebp - 0x10]
or eax, edi
or edx, edi
cmp eax, edx
jb 0x402eaa
ja 0x402e93
cmp dword [ebp - 0x30], ecx
jb 0x402eaa
mov edx, dword [ebp - 0x18]
xor edi, edi
xor ecx, ecx
or ecx, dword [ebp - 0x1c]
or edx, edi
cmp eax, edx
jb 0x402eae
ja 0x402eaa
cmp dword [ebp - 0x30], ecx
jbe 0x402eae
and dword [ebp + 8], 0
mov eax, dword [esi + 0x3438]
xor ecx, ecx
cmp eax, ecx
mov edi, 0x100
je 0x402f6b
mov esi, dword [ebp - 0x40]
cmp esi, ecx
jl 0x402ee0
cmp esi, dword [0x415158]
jge 0x402ee0
imul esi, esi, 0x524
add esi, dword [0x41514c]
jmp 0x402ee2
xor esi, esi
cmp esi, ecx
je 0x402f63
cmp dword [ebx + 0x2e8], ecx
mov dword [ebp - 0x18], ecx
jle 0x402f3a
mov eax, dword [ebp - 0x18]
lea ecx, [ebx + 0x2cc]
call fcn.00405cb3
mov dword [ebp - 0xc], eax
lea eax, [esi + 0x424]
push eax
push dword [ebp - 0xc]
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
je 0x402f4f
lea eax, [esi + 0x4a4]
push eax
push dword [ebp - 0xc]
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
je 0x402f4f
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebx + 0x2e8]
jl 0x402ef1
mov eax, dword [ebx + 0x25c]
cmp dword [eax + 0x3438], 1
jne 0x402f6b
and dword [ebp + 8], 0
jmp 0x402f6b
mov eax, dword [ebx + 0x25c]
cmp dword [eax + 0x3438], 2
jne 0x402f6b
jmp 0x40337d
cmp eax, 1
jne 0x402f6b
mov dword [ebp + 8], ecx
xor esi, esi
cmp dword [ebp + 8], esi
je 0x40337f
mov edx, dword [ebp - 0x24]
cmp dword [ebp - 0x5c], edx
jbe 0x402f81
mov edx, dword [ebp - 0x5c]
cmp dword [ebp - 0x58], edx
jbe 0x402f89
mov edx, dword [ebp - 0x58]
add edx, edi
lea eax, [ebp - 0x54]
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x3c], edx
mov dword [ebp + 8], edx
call fcn.00405d07
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 0x70]
call fcn.00405d07
mov eax, dword [ebx + 0x25c]
or dword [ebp - 0x14], 0xffffffff
cmp dword [eax + 0x3404], 2
mov dword [ebp - 0xc], esi
jne 0x4030be
cmp dword [eax + 0x3414], esi
je 0x4030be
push dword [ebp + 0x10]
lea esi, [ebx + 0x264]
mov edi, esi
call fcn.00405d62
push dword [ebp + 0xc]
lea edi, [ebx + 0x278]
call fcn.00405d62
push 0xffffffffffffffff
push esi
xor eax, eax
mov ecx, ebx
call fcn.004027df
test eax, eax
jne 0x40302b
push 0xffffffffffffffff
push edi
mov ecx, ebx
call fcn.004027df
test eax, eax
je 0x4030be
push 0xffffffffffffffff
push dword [ebp + 0x10]
mov eax, 0x41512c
mov dword [ebp - 0xc], 1
call fcn.00405c10
mov dword [ebp - 0x14], eax
mov eax, dword [ebx + 0x25c]
cmp dword [eax + 0x3424], 0
je 0x4030be
lea esi, [ebp - 0xac]
call fcn.0040212a
mov eax, dword [ebp - 0x14]
or dword [ebp - 0x9c], 0xffffffff
or dword [ebp - 0x98], 0xffffffff
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x80], eax
mov eax, esi
push eax
mov eax, ebx
mov dword [ebp - 0x94], 0x63
call fcn.004079cd
mov ecx, dword [ebx + 0x25c]
cmp dword [ecx + 0x447c], 0
je 0x4030be
mov ecx, dword [ebx + 0x2c]
dec ecx
mov edi, eax
push ecx
mov eax, ebx
call fcn.004077b3
mov eax, dword [ebx + 0x25c]
mov ecx, dword [ebx + 0x2c]
cmp ecx, dword [eax + 0x3408]
jl 0x4030d9
mov dword [ebx + 0x258], 1
xor edi, edi
cmp dword [ebx + 0x258], edi
je 0x4030fb
lea esi, [ebp - 0x70]
call fcn.00405d3d
lea esi, [ebp - 0x54]
call fcn.00405d3d
cmp dword [ebp - 4], edi
jmp 0x40347f
cmp dword [eax + 0x3424], edi
je 0x403118
cmp dword [eax + 0x3428], edi
je 0x403118
cmp dword [eax + 0x3404], 2
je 0x403368
mov ecx, dword [ebp - 0x70]
cmp ecx, edi
jne 0x403124
mov ecx, 0x412535
mov eax, dword [ebp - 0x54]
cmp eax, edi
jne 0x403130
mov eax, 0x412535
lea edx, [ebp + 8]
push edx
push ecx
lea ecx, [ebp - 0x18]
push ecx
push edi
lea ecx, [ebp - 0x3c]
push ecx
push eax
push dword [ebp - 0x20]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x403368
mov eax, dword [ebx + 0x25c]
xor esi, esi
cmp dword [eax + 0x3404], 1
je 0x40322d
cmp dword [ebp - 0xc], edi
jne 0x40322d
cmp dword [eax + 0x3418], edi
je 0x40318d
push 0xffffffffffffffff
lea eax, [ebp - 0x54]
push eax
xor eax, eax
mov ecx, ebx
call fcn.004027df
test eax, eax
je 0x40318d
inc esi
mov eax, dword [ebx + 0x25c]
cmp dword [eax + 0x341c], edi
jne 0x4031af
mov eax, dword [eax + 0x340c]
cmp eax, 4
je 0x4031af
cmp eax, 5
jne 0x403230
push dword [ebp + 8]
lea eax, [ebp - 0x70]
push eax
xor eax, eax
mov ecx, ebx
call fcn.004027df
test eax, eax
je 0x4031c6
xor esi, esi
inc esi
cmp esi, edi
jne 0x403206
cmp dword [ebp - 0x18], 1
je 0x4031d6
cmp dword [ebp - 0x18], 2
jne 0x403206
mov ecx, dword [ebp + 8]
cmp ecx, edi
jbe 0x403206
mov eax, dword [ebp - 0x70]
cmp eax, edi
jne 0x4031e9
mov eax, 0x412535
cmp byte [eax + ecx - 1], 0
jne 0x403206
dec ecx
push ecx
lea eax, [ebp - 0x70]
push eax
xor eax, eax
mov ecx, ebx
call fcn.004027df
test eax, eax
je 0x403206
xor esi, esi
inc esi
mov eax, dword [ebx + 0x25c]
cmp dword [eax + 0x4448], edi
je 0x403230
cmp esi, edi
jne 0x403230
push dword [ebp + 8]
lea eax, [ebp - 0x70]
push eax
xor eax, eax
inc eax
mov ecx, ebx
call fcn.004027df
test eax, eax
je 0x403230
xor esi, esi
inc esi
mov eax, dword [ebx + 0x25c]
cmp dword [eax + 0x4464], edi
je 0x403253
mov ecx, dword [ebp + 8]
cmp ecx, dword [eax + 0x445c]
jb 0x403251
cmp ecx, dword [eax + 0x4460]
jbe 0x403253
xor esi, esi
cmp dword [eax + 0x4468], edi
je 0x40326d
mov ecx, dword [ebp - 0x18]
xor edx, edx
inc edx
shl edx, cl
test dword [eax + 0x446c], edx
jne 0x40326d
xor esi, esi
mov ecx, dword [ebx + 0x2c]
cmp ecx, dword [eax + 0x3408]
jl 0x403282
mov dword [ebx + 0x258], 1
cmp dword [ebx + 0x258], edi
jne 0x4030e3
cmp esi, edi
je 0x403352
lea esi, [ebp - 0xac]
call fcn.0040212a
cmp dword [ebp - 0x54], edi
mov eax, 0x412535
je 0x4032ae
mov eax, dword [ebp - 0x54]
push 0xffffffffffffffff
push eax
mov esi, 0x41512c
mov eax, esi
call fcn.00405c10
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x70]
cmp eax, edi
jne 0x4032cf
mov eax, 0x412535
push dword [ebp + 8]
push eax
mov eax, esi
call fcn.00405c10
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
jne 0x403320
push eax
push dword [ebp + 0x10]
mov eax, esi
call fcn.00405c10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xa0], eax
lea eax, [ebp - 0xac]
push eax
mov eax, ebx
call fcn.004079cd
mov ecx, dword [ebx + 0x25c]
cmp dword [ecx + 0x447c], edi
je 0x403352
mov ecx, dword [ebx + 0x2c]
dec ecx
mov edi, eax
push ecx
mov eax, ebx
call fcn.004077b3
xor edi, edi
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov dword [ebp + 8], eax
call fcn.00401d41
jmp 0x403118
lea esi, [ebp - 0x70]
call fcn.00405d3d
lea esi, [ebp - 0x54]
call fcn.00405d3d
mov edi, 0x100
xor esi, esi
push 0x3ff
lea eax, [ebp - 0x4af]
push esi
push eax
mov dword [ebp + 0xc], esi
mov byte [ebp - 0x4b0], 0
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x4b0]
push eax
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x4c], esi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x44], edi
jmp 0x40345f
call fcn.00401d41
cmp dword [ebx + 0x258], 0
jne 0x403473
push dword [ebp + 0x10]
lea edi, [ebp - 0x54]
call fcn.00405d62
push 0x412870
or eax, 0xffffffff
call fcn.00405dba
lea eax, [ebp - 0x4b0]
push eax
or eax, 0xffffffff
call fcn.00405dba
mov edi, dword [ebp - 0x54]
test edi, edi
mov eax, 0x412535
je 0x403412
mov eax, edi
push str.HKCRVirtualStoreMACHINESOFTWAREClassesVirtualStoreMACHINE
push eax
call sub.msvcrt.dll__stricmp
test eax, eax
pop ecx
pop ecx
je 0x403445
test edi, edi
mov eax, 0x412535
je 0x40342e
mov eax, edi
mov ecx, dword [ebp + 0x14]
inc ecx
push ecx
push eax
lea eax, [ebp - 0x4b0]
push eax
push dword [ebp - 4]
mov ecx, ebx
call fcn.00402abb
inc dword [ebp + 0xc]
lea eax, [ebp - 0x30]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x4b0]
push eax
push dword [ebp + 0xc]
push dword [ebp - 4]
mov dword [ebp + 8], 0x3ff
call esi
test eax, eax
je 0x4033cb
lea esi, [ebp - 0x54]
call fcn.00405d3d
cmp dword [ebp - 4], 0
je 0x40348a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 0x10