Function at 0x4022e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4388c1
mov eax, dword fs:[0]
push eax
sub esp, 0x134
mov eax, dword [0x4475e0]
xor eax, esp
mov dword [esp + 0x130], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4475e0]
xor eax, esp
push eax
lea eax, [esp + 0x148]
mov dword fs:[0], eax
xor ebp, ebp
xor ebx, ebx
mov dword [esp + 0x28], ebp
mov dword [esp + 0x150], ebx
call fcn.00408793
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x402344
push 0x80004005
call fcn.004011c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x20], eax
mov byte [esp + 0x150], 1
call fcn.00408793
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x402376
push 0x80004005
call fcn.004011c0
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x1c], eax
push 0x103
lea ecx, [esp + 0x41]
push ebx
mov byte [esp + 0x158], 2
push ecx
mov byte [esp + 0x48], bl
call fcn.00423db0
add esp, 0xc
lea edx, [esp + 0x24]
push edx
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SOFTWARE_bluch
push SysReAllocStringLen
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
jne 0x4023d8
mov ebp, dword [esp + 0x18]
mov dword [esp + 0x28], ebp
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x40]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push str.Exetoday
push ebp
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x402420
mov eax, dword [esp + 0x24]
cmp eax, 1
je 0x40240e
cmp eax, 2
jne 0x402420
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x4024c3
cmp byte [esp + eax + 0x3b], bl
je 0x40245a
push 0x43e678
lea ecx, [esp + 0x40]
push 0x104
push ecx
call fcn.0042216d
add esp, 0xc
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
lea eax, [esp + 0x40]
push eax
push 1
push ebx
push str.Exetoday
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x3c]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
cmp cl, bl
jne 0x402461
sub eax, edx
push eax
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x24]
call fcn.004016c0
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0x32]
movzx ecx, word [esp + 0x2e]
movzx edx, word [esp + 0x2c]
push eax
push ecx
push edx
lea eax, [esp + 0x2c]
push str._d_02d_02d
push eax
call fcn.00404d30
mov edi, dword [esp + 0x30]
xor eax, eax
add esp, 0x14
cmp edi, ebx
setne al
cmp eax, ebx
jne 0x4024c9
push 0x80004005
call fcn.004011c0
mov byte [esp + 0x3c], bl
jmp 0x40245a
mov esi, dword [esp + 0x20]
push edi
push esi
call fcn.004220cc
add esp, 8
cmp eax, ebx
setne al
cmp al, bl
je 0x402515
xor eax, eax
cmp esi, ebx
setne al
cmp eax, ebx
jne 0x4024f5
push 0x80004005
call fcn.004011c0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 1
push eax
push esi
push 1
push ebx
push str.Exetoday
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call fcn.00401c90
lea eax, [edi - 0x10]
mov byte [esp + 0x150], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402539
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [esi - 0x10]
mov byte [esp + 0x150], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40255c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
cmp ebp, ebx
je 0x402567
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [esp + 0x148]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, esp
call fcn.004217b1
add esp, 0x140
ret