Function at 0x4312ca
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x6beae3
call fcn.006b9c3c
sub esp, 0x120
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
mov esi, ecx
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], 3
mov byte [ebp - 4], 4
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov byte [ebp - 4], 5
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x70], 0xf
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x84], bl
mov byte [ebp - 4], 6
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x73b7ec
call fcn.004a63fc
mov byte [ebp - 4], 7
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x73bb00
call fcn.004a63fc
mov byte [ebp - 4], 8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
lea eax, [ebp + 8]
push eax
call fcn.004a6481
mov byte [ebp - 4], 9
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x6c]
call fcn.00460cfb
add esp, 0x48
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp + 8]
call fcn.004a638e
mov byte [ebp - 4], 6
push ebx
push 1
lea ecx, [ebp - 0x6c]
call fcn.004ab703
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 4], 0xb
push 1
sub esp, 0xc
mov dword [ebp - 0x40], esp
mov edx, 0x73bb04
mov ecx, esp
call fcn.004b201b
mov byte [ebp - 4], 0xc
mov byte [ebp - 4], 0xb
lea edx, [ebp + 8]
lea ecx, [ebp - 0x38]
call fcn.004b20a2
add esp, 0x10
xor eax, eax
lea edi, [ebp - 0xe4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
movaps xmm0, xmmword [0x746550]
movups xmmword [ebp - 0xd8], xmm0
movaps xmm0, xmmword [0x7463a0]
movups xmmword [ebp - 0xc8], xmm0
mov dword [ebp - 0xb8], 0x30
mov dword [ebp - 0xb4], 0x2e
mov dword [ebp - 0xb0], 0x24
mov ecx, ebx
push 0x7f
pop edi
mov dword [ebp - 0x44], ecx
cmp ecx, 0xb
jae 0x431437
push 0x43
pop eax
sub eax, dword [ebp + ecx*4 - 0xd8]
imul eax, eax, 0x3f
cdq
idiv edi
lea eax, [edi + edx]
cdq
idiv edi
mov byte [ebp + ecx - 0xe4], dl
inc ecx
jmp 0x43140f
mov byte [ebp - 0xd9], bl
lea eax, [ebp - 0xe4]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00411aae
mov byte [ebp - 4], 0xd
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0xac]
call fcn.00461060
mov byte [ebp - 4], 0xe
push eax
mov ecx, dword [ebp - 0x38]
call fcn.004a60cd
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xd
push ebx
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0xac]
call fcn.004ab703
mov byte [ebp - 4], 0xb
push ebx
push edi
lea ecx, [ebp - 0x6c]
call fcn.00411bc8
cmp dword [ebp - 0x1c], 0
jne 0x43151f
push ecx
lea ecx, [ebp - 0x128]
call fcn.0049ffaf
mov dword [ebp - 0x1c], eax
mov esi, ebx
mov dword [ebp - 0x48], esi
cmp esi, 0xd
jae 0x4314d2
mov ecx, dword [eax + esi*4 + 0x10]
sub ecx, 6
imul eax, ecx, 0x13
cdq
push 0x7f
pop ecx
idiv ecx
lea eax, [ecx + edx]
cdq
idiv ecx
mov eax, dword [ebp - 0x1c]
mov byte [eax + esi], dl
inc esi
jmp 0x4314ab
mov byte [eax + 0xd], bl
push eax
lea ecx, [ebp - 0x6c]
call fcn.00411aae
mov byte [ebp - 4], 0xf
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0xac]
call fcn.00461060
mov byte [ebp - 4], 0x10
push eax
mov ecx, dword [ebp - 0x38]
call fcn.004a638e
mov byte [ebp - 4], 0xf
push ebx
push edi
lea ecx, [ebp - 0xac]
call fcn.004ab703
mov byte [ebp - 4], 0xb
push ebx
push edi
lea ecx, [ebp - 0x6c]
call fcn.00411bc8
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x14], 8
jb 0x43152a
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x6c]
call fcn.004a63fc
mov byte [ebp - 4], 0x11
push ecx
lea ecx, [ebp - 0x6c]
call fcn.00422b9b
pop ecx
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xb
push ebx
push edi
lea ecx, [ebp - 0x6c]
call fcn.004ab703
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x40], esp
push 0x73b808
call fcn.004a63fc
mov byte [ebp - 4], 0x12
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x73b7ec
mov edx, dword [ebp - 0x38]
call fcn.004b1f44
mov byte [ebp - 4], 0x13
sub esp, 0x14
mov ecx, esp
mov dword [ebp - 0x88], esp
lea eax, [ebp + 8]
push eax
call fcn.004a6481
mov byte [ebp - 4], 0x14
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xac]
call fcn.00460cfb
add esp, 0x48
mov byte [ebp - 4], 0x15
push eax
lea ecx, [ebp + 8]
call fcn.004a638e
mov byte [ebp - 4], 0xb
push ebx
push edi
lea ecx, [ebp - 0xac]
call fcn.004ab703
lea eax, [ebp + 8]
cmp dword [ebp + 0x1c], 8
cmovae eax, dword [ebp + 8]
lea ecx, [ebp - 0x24]
push ecx
push 0x2011b
push ebx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x431665
push 0x73a9e8
mov ecx, esi
call fcn.00411aae
mov dword [ebp - 0x28], edi
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x38]
call fcn.004a9f73
mov byte [ebp - 4], 5
push ebx
push edi
lea ecx, [ebp - 0x84]
call fcn.00411bc8
mov byte [ebp - 4], 4
test ebx, ebx
je 0x431627
mov ecx, ebx
call fcn.0040f5b8
mov byte [ebp - 4], 2
push ebx
push edi
lea ecx, [ebp + 8]
call fcn.004ab703
mov byte [ebp - 4], 1
push ebx
push 1
lea ecx, [ebp + 0x20]
call fcn.004ab703
mov byte [ebp - 4], bl
push ebx
push 1
lea ecx, [ebp + 0x38]
call fcn.004ab703
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x3c], ebx
xorps xmm0, xmm0
movlpd qword [ebp - 0x54], xmm0
mov eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
jne 0x4316b6
mov dword [ebp - 0x18], 0x100000
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae eax, dword [ebp + 0x20]
lea ecx, [ebp - 0x18]
push ecx
push ebx
lea ecx, [ebp - 0x20]
push ecx
push ebx
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4316b3
push 0x73a9e8
mov ecx, esi
call fcn.00411aae
jmp 0x4315f8
mov eax, dword [ebp - 0x20]
cmp eax, 4
jb 0x43171a
cmp eax, 5
jbe 0x4316fe
cmp eax, 0xb
jne 0x43171a
lea eax, [ebp + 0x38]
cmp dword [ebp + 0x4c], 8
cmovae eax, dword [ebp + 0x38]
push eax
call fcn.006965e4
pop ecx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push 8
lea ecx, [ebp - 0x54]
lea eax, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae eax, dword [ebp + 0x20]
push ecx
push dword [ebp - 0x20]
push ebx
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x431758
lea eax, [ebp + 0x38]
cmp dword [ebp + 0x4c], 8
cmovae eax, dword [ebp + 0x38]
push eax
call fcn.006965ba
pop ecx
mov dword [ebp - 0x3c], eax
push 4
lea ecx, [ebp - 0x3c]
jmp 0x4316e2
lea eax, [ebp + 0x38]
cmp dword [ebp + 0x4c], 8
cmovae eax, dword [ebp + 0x38]
lea edi, [ebp + 0x38]
cmovae edi, dword [ebp + 0x38]
lea esi, [ebp + 0x20]
cmp dword [ebp + 0x34], 8
cmovae esi, dword [ebp + 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea eax, [eax*2 + 1]
push eax
push edi
push dword [ebp - 0x20]
push ebx
push esi
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edi, edi
inc edi
mov dword [ebp - 0x18], eax
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x24]
call esi
mov eax, 0x73a9b8
mov ecx, 0x73a9e8
cmp dword [ebp - 0x18], 0
cmovne eax, ecx
push eax
mov esi, dword [ebp - 0x2c]
jmp 0x4316a7