Function at 0x620624a3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 0x10]
and byte [esi], 0
xor ebx, ebx
push edi
push 0x620611d0
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 0x18], edi
je 0x62062636
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x62062692
cmp byte [eax], bl
je 0x62062692
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
call esi
mov edi, 0x62061118
push edi
mov ebx, eax
call esi
lea eax, [ebx + eax + 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
call ebx
test eax, eax
mov dword [ebp - 8], eax
je 0x6206254b
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push dword [ebp - 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push dword [ebp + 0xc]
call esi
push 0x6206110c
mov edi, eax
call esi
lea eax, [edi + eax + 1]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebx
mov edi, eax
test edi, edi
mov dword [ebp - 0x14], edi
je 0x6206259f
push 0x6206110c
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [ebp + 0xc]
push edi
call esi
lea edi, [eax + edi + 1]
cmp byte [edi], 0
je 0x62062634
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0x10], 0
jne 0x62062634
cmp dword [ebp - 4], 0
mov dword [ebp - 0x1c], 4
je 0x620625e9
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x620625e9
cmp dword [ebp + 0xc], 4
je 0x6206260d
cmp dword [ebp - 0xc], 0
je 0x62062628
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push edi
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x62062628
cmp dword [ebp + 0xc], 4
jne 0x62062628
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x20]
push dword [ebp + 8]
push dword [ebp - 0x18]
call fcn.620623cd
mov dword [ebp - 0x10], eax
push edi
call esi
lea edi, [edi + eax + 1]
cmp byte [edi], 0
jne 0x620625b8
xor ebx, ebx
cmp dword [ebp - 4], ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x62062646
push dword [ebp - 4]
call edi
cmp dword [ebp - 8], ebx
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
je 0x6206265e
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
cmp dword [ebp - 0xc], ebx
je 0x62062668
push dword [ebp - 0xc]
call edi
cmp dword [ebp - 0x14], ebx
je 0x6206267a
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
cmp dword [ebp - 0x18], ebx
pop edi
pop esi
pop ebx
je 0x6206268b
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x10]
leave
ret 0x14
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
push eax
push esi
mov dword [ebp - 0x10], 1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push eax
push dword [ebp + 8]
push edi
call fcn.620623cd
test eax, eax
jne 0x62062636
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push eax
push dword [ebp + 8]
push edi
call fcn.620623cd
test eax, eax
jne 0x62062636
push dword [ebp + 0x18]
lea eax, [ebp + 0x14]
push eax
push esi
push 0x409
push dword [ebp + 8]
push edi
call fcn.620623cd
test eax, eax
jne 0x62062636
mov dword [ebp - 0x10], ebx
jmp 0x62062636