Function at 0x4084c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov eax, dword [esp + 0x114]
mov ecx, dword [esp + 0x118]
push ebx
push ebp
push esi
push edi
push 9
push str.softwaremicrosoftwindows_ntcurrentversionperflib
lea edx, [esp + 0x28]
push str._s_03x
mov dword [eax], 0
push edx
mov dword [esp + 0x28], 3
mov dword [esp + 0x20], 0x100
mov dword [ecx], 0
call fcn.00414780
add esp, 0x10
lea eax, [esp + 0x14]
lea ecx, [esp + 0x20]
push eax
push 0x20019
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40853a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push 0
push eax
push 0
push str.Counters
push ecx
call esi
test eax, eax
je 0x408576
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.00414f90
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4085a1
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1c]
push ebp
push eax
push 0
push str.Counters
push ecx
call esi
test eax, eax
je 0x4085df
push ebp
call fcn.00414ef0
mov edx, dword [esp + 0x18]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov byte [esp + 0x20], 0
mov al, byte [ebp]
test al, al
mov dword [esp + 0x1c], 0
mov ebx, ebp
je 0x4086e3
cmp ebx, ebp
jbe 0x408623
lea esi, [ebx - 2]
xor eax, eax
mov al, byte [esi]
push eax
call fcn.00414720
add esp, 4
test eax, eax
je 0x408623
dec esi
xor ecx, ecx
mov cl, byte [esi]
push ecx
call fcn.00414720
add esp, 4
test eax, eax
jne 0x408611
push str.System
push ebx
call fcn.00414c40
add esp, 8
test eax, eax
jne 0x408681
lea esi, [ebx - 2]
xor edx, edx
mov dl, byte [esi]
push edx
call fcn.00414720
add esp, 4
test eax, eax
je 0x40865b
dec esi
xor eax, eax
mov al, byte [esi]
push eax
call fcn.00414720
add esp, 4
test eax, eax
jne 0x408649
lea edi, [esi + 1]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x20]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4086c7
push str.__Registry_Quota_In_Use
push ebx
call fcn.00414c40
add esp, 8
test eax, eax
jne 0x4086c7
lea esi, [ebx - 2]
xor ecx, ecx
mov cl, byte [esi]
push ecx
call fcn.00414720
add esp, 4
test eax, eax
je 0x4086b9
dec esi
xor edx, edx
mov dl, byte [esi]
push edx
call fcn.00414720
add esp, 4
test eax, eax
jne 0x4086a7
inc esi
push esi
call fcn.004145a0
add esp, 4
mov dword [esp + 0x1c], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ebx + ecx + 1]
lea ebx, [ebx + ecx + 1]
test al, al
jne 0x4085f9
push ebp
call fcn.00414ef0
mov al, byte [esp + 0x24]
add esp, 4
test al, al
jne 0x40870c
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
push 0x19000
mov dword [esp + 0x14], 0x19000
call fcn.00414f90
mov esi, eax
add esp, 4
test esi, esi
jne 0x40873f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov ecx, dword [esp + 0x10]
xor eax, eax
mov edx, ecx
mov edi, esi
shr ecx, 2
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 3
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, ebx
rep stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x18]
push eax
push esi
push ecx
lea edx, [esp + 0x2c]
push 0
push edx
push 0x80000004
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0x10]
test eax, eax
jne 0x4087a7
test ecx, ecx
jbe 0x4087a7
cmp word [esi], 0x50
jne 0x4087a7
cmp word [esi + 2], 0x45
jne 0x4087a7
cmp word [esi + 4], 0x52
jne 0x4087a7
cmp word [esi + 6], 0x46
je 0x408809
cmp eax, 0xea
jne 0x4087e5
add ecx, 0xc800
push ecx
push esi
mov dword [esp + 0x18], ecx
call fcn.00415a60
mov ecx, dword [esp + 0x18]
mov esi, eax
mov edx, ecx
xor eax, eax
mov edi, esi
add esp, 8
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x80000004
and ecx, ebx
rep stosb byte es:[edi], al
call ebp
jmp 0x40875f
push esi
call fcn.00414ef0
mov eax, dword [esp + 0x18]
add esp, 4
push eax
call ebp
push 0x80000004
call ebp
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
mov edi, dword [esi + 0x18]
xor eax, eax
add edi, esi
mov esi, dword [edi + 8]
mov ecx, dword [edi + 0x20]
add esi, edi
test ecx, ecx
jbe 0x40882f
mov edx, dword [esp + 0x1c]
mov ebx, dword [esi + 4]
cmp ebx, edx
je 0x40882f
add esi, 0x28
inc eax
cmp eax, ecx
jb 0x40881c
dec ecx
cmp eax, ecx
jae 0x408848
cmp eax, 0xffffffff
je 0x408848
inc eax
push eax
push edi
call fcn.00408490
add esp, 8
mov ebx, eax
jmp 0x40884a
xor ebx, ebx
push esi
push edi
call fcn.00408470
add esp, 8
mov esi, eax
test ebx, ebx
je 0x408866
push ebx
push edi
call fcn.00408470
add esp, 8
jmp 0x40886a
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x128]
mov eax, dword [eax]
push 0x80000004
mov dword [ecx], eax
mov eax, dword [esp + 0x128]
mov edx, dword [esi]
mov dword [eax], edx
call ebp
mov ecx, dword [esp + 0x14]
push ecx
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret