Function at 0x245ff80
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x24c2636
push eax
mov dword fs:[0], esp
sub esp, 0xfa0
push ebx
push ebp
mov ebp, ecx
xor ebx, ebx
cmp ebp, ebx
push esi
push edi
je 0x246031d
mov eax, dword [ebp]
cmp eax, ebx
je 0x245ffc7
mov ecx, dword [eax]
push eax
mov dword [ebp + 4], ecx
call fcn.024adc89
mov eax, dword [ebp + 4]
add esp, 4
cmp eax, ebx
jne 0x245ffb2
lea edx, [esp + 0x20]
push edx
push 0x24dccf4
push 0x80000001
mov dword [ebp], ebx
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ebx
mov dword [ebp + 0xc], ebx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.advapi32.dll_RegOpenKeyA]
test eax, eax
jne 0x246031d
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0x2c]
mov eax, ecx
inc ecx
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x3c]
push edx
lea ecx, [esp + 0x30]
push ecx
push ebx
lea edx, [esp + 0x40]
push edx
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x174]
push ecx
push eax
mov esi, 0x128
push edx
mov byte [esp + 0x180], bl
mov dword [esp + 0x50], 0x64
mov dword [esp + 0x48], ebx
mov dword [esp + 0x44], esi
call dword [sym.imp.advapi32.dll_RegEnumValueA]
test eax, eax
jne 0x2460321
cmp dword [esp + 0x28], 3
jne 0x245fff8
cmp dword [esp + 0x24], esi
jne 0x245fff8
mov edx, dword [esp + 0x56]
xor eax, eax
mov ecx, 0x37a
lea edi, [esp + 0x1c4]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x46]
mov ecx, 0x246
mov esi, 0x24db688
lea edi, [esp + 0x1c4]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x4a]
mov dword [esp + 0x1c4], eax
mov eax, dword [esp + 0x6e]
mov dword [esp + 0x1c8], ecx
mov ecx, dword [esp + 0x72]
mov dword [esp + 0x1cc], edx
mov edx, dword [esp + 0x76]
mov dword [esp + 0x240], eax
mov eax, dword [esp + 0x7a]
mov dword [esp + 0x244], ecx
mov dword [esp + 0x248], edx
mov dword [esp + 0x24c], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea edx, [esp + 0x10]
lea ecx, [esp + 0x7e]
mov dword [esp + 0xfb8], ebx
mov byte [esp + 0xe1], bl
call fcn.0247fc70
test eax, eax
je 0x2460308
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x2460286
cmp dword [esp + 0x10], ebx
je 0x2460286
push eax
push 0x24dae84
lea ecx, [esp + 0xae4]
push 0x64
push ecx
mov word [esp + 0xaec], bx
call fcn.024ae131
add esp, 0x10
mov word [esp + 0xba2], bx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
lea edx, [esp + 0x18]
lea ecx, [esp + 0xe2]
mov byte [esp + 0xfb8], 1
mov byte [esp + 0x145], bl
call fcn.0247fc70
test eax, eax
je 0x246028f
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x24602c1
cmp dword [esp + 0x18], ebx
je 0x24602c1
push eax
push 0x24dae84
lea edx, [esp + 0xbac]
push 0x64
push edx
mov word [esp + 0xbb4], bx
call fcn.024ae131
mov eax, dword [esp + 0x160]
mov ecx, dword [esp + 0x168]
mov edx, dword [esp + 0x16c]
push 0xdf0
mov word [esp + 0xc7e], bx
mov dword [esp + 0xc80], eax
mov dword [esp + 0xfa8], ecx
mov dword [esp + 0xfac], edx
mov dword [esp + 0xfb0], ebx
mov byte [esp + 0xfb4], bl
call fcn.024adc5e
add esp, 0x14
cmp eax, ebx
mov dword [ebp + 4], eax
je 0x24602ef
mov ecx, dword [ebp]
lea edx, [esp + 0x1c4]
test edx, edx
mov dword [eax], ecx
je 0x2460218
mov edi, dword [ebp + 4]
add edi, 4
mov ecx, 0x37a
lea esi, [esp + 0x1c4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp dword [ebp + 8], ebx
mov eax, dword [ebp + 4]
mov dword [ebp], eax
jne 0x2460226
mov dword [ebp + 8], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp]
inc edx
add eax, 4
mov dword [ebp + 4], ebx
mov dword [ebp + 0xc], edx
mov dword [esp + 0x34], eax
je 0x24602ef
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x2460259
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0xfb8], 0xffffffff
mov dword [esp + 0x10], ebx
je 0x245fff8
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x14], ebx
jmp 0x245fff8
mov dword [esp + 0x10], ebx
jmp 0x2460310
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x24602a8
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x246031d
push eax
call fcn.024ad03a
add esp, 4
xor eax, eax
jmp 0x2460331
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x24602d6
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x246031d
push eax
call fcn.024ad03a
add esp, 4
xor eax, eax
jmp 0x2460331
mov eax, dword [esp + 0x1c]
cmp eax, ebx
mov dword [esp + 0x18], ebx
je 0x2460308
push eax
call fcn.024ad03a
add esp, 4
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], ebx
cmp eax, ebx
je 0x246031d
push eax
call fcn.024ad03a
add esp, 4
xor eax, eax
jmp 0x2460331
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [esp + 0xfb0]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0xfac
ret