Function at 0x6c37a528
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x48
push 0x6c37a880
call fcn.6c371c7b
mov esi, dword [ebp + 8]
mov dword [ebp - 0x44], esi
xor edi, edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], edi
cmp esi, edi
jne 0x6c37a550
mov ebx, 0xc0000bbd
jmp 0x6c37a86b
push dword [esi + 0x38]
push 0x459
push 0x6c3727fc
call fcn.6c371c10
mov ebx, eax
cmp ebx, edi
jne 0x6c37a86b
push 0x7f
push 0x6c3a73e8
push dword [esi + 4]
call fcn.6c372eed
test eax, eax
jne 0x6c37a594
inc dword [esi + 0x20]
mov dword [esi], 0x80000004
mov dword [esi + 0x54], 2
jmp 0x6c37a743
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor ebx, ebx
mov edi, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
or ebx, eax
or edi, ecx
push ecx
push 1
lea eax, [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x6c37a866
mov ecx, dword [esi + 0x30]
mov eax, dword [esi + 0x34]
mov edx, ecx
or edx, eax
je 0x6c37a5e5
cmp eax, edi
jl 0x6c37a5e5
jg 0x6c37a5d7
cmp ecx, ebx
jbe 0x6c37a5e5
and dword [esi], 0
mov eax, dword [esi + 0x28]
mov dword [ebp - 0x30], eax
jmp 0x6c37a735
inc dword [esi + 0x20]
mov dword [ebp - 0x34], 1
wait
and dword [ebp - 4], 0
mov eax, dword [esi]
test eax, eax
je 0x6c37a604
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [esi], 0
wait
push 0xfffffffffffffffe
pop ebx
mov dword [ebp - 4], ebx
jmp 0x6c37a62d
xor eax, eax
cmp dword [ebp - 0x30], eax
je 0x6c37a63b
mov dword [esi], eax
jmp 0x6c37a6ee
cmp dword [esi + 0x54], eax
jne 0x6c37a6ee
mov dword [esi + 0x54], 1
lea eax, [ebp - 0x40]
push eax
push 0x80000002
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp - 0x30], eax
test eax, eax
jne 0x6c37a6ee
lea eax, [ebp - 0x3c]
push eax
push 0x20019
xor edi, edi
push edi
push dword [0x6c3a74a8]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x30], eax
cmp eax, edi
jne 0x6c37a6e5
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x54], 0x10
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
push dword [0x6c3a74ac]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x30], eax
cmp eax, edi
jne 0x6c37a6dc
cmp dword [ebp - 0x38], 1
jne 0x6c37a6dc
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll__wtof]
pop ecx
fcomp qword [0x6c37a878]
fnstsw ax
test ah, 1
jne 0x6c37a6dc
mov dword [esi + 0x54], 2
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x30], 0
jne 0x6c37a735
wait
mov dword [ebp - 4], 1
push esi
push 0x80000004
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp - 0x30], eax
wait
mov dword [ebp - 4], ebx
jmp 0x6c37a735
push 0
lea eax, [esi + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
xor edi, edi
cmp dword [esi], edi
je 0x6c37a7ec
cmp dword [esi + 0x3c], edi
jne 0x6c37a7ec
mov ecx, dword [esi + 0xc]
cmp ecx, edi
je 0x6c37a7a3
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x6c37a779
cmp eax, ecx
je 0x6c37a779
push eax
push 0x4c4
mov ebx, 0x6c3727fc
push ebx
call fcn.6c3750c2
jmp 0x6c37a77e
mov ebx, 0x6c3727fc
push dword [esi + 0x18]
push 0x4c6
push ebx
call fcn.6c3750c2
push dword [esi + 0xc]
push 0x4c7
push ebx
call fcn.6c3750c2
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
mov dword [esi + 0xc], edi
push 0x80000060
push esi
call fcn.6c379e9c
push 0x80000050
push esi
call fcn.6c379e9c
cmp dword [esi], 0x80000004
jne 0x6c37a7c5
xor eax, eax
jmp 0x6c37a7c8
mov eax, dword [esi + 4]
push esi
push eax
call fcn.6c378417
cmp dword [esi + 0xc], edi
je 0x6c37a7db
xor ebx, ebx
mov dword [esi + 0x28], edi
jmp 0x6c37a807
mov ebx, 0xc0000bc8
mov dword [esi + 0x1c], edi
mov dword [esi + 0x28], 0x800007d0
jmp 0x6c37a807
mov ebx, 0xc0000bc3
cmp dword [ebp - 0x30], 5
je 0x6c37a800
cmp dword [ebp - 0x30], 0xc0000bdb
jne 0x6c37a7e3
mov dword [esi + 0x28], 0xc0000bdb
cmp ebx, edi
je 0x6c37a849
cmp dword [ebp - 0x34], edi
je 0x6c37a84f
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x4c]
xor edi, edi
or eax, edx
or ecx, edi
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], ecx
cmp dword [esi + 0x28], 0xc0000bdb
je 0x6c37a84f
mov eax, dword [0x6c3a7440]
add dword [esi + 0x30], eax
mov eax, dword [0x6c3a7444]
adc dword [esi + 0x34], eax
jmp 0x6c37a84f
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
dec dword [esi + 0x20]
push dword [esi + 0x38]
push 0x4ff
push 0x6c3727fc
call fcn.6c371b8c
jmp 0x6c37a86b
mov ebx, 0xc0000bc3
mov eax, ebx
call fcn.6c371cc3
ret 4