Function at 0x461100
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5e4c9d
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push esi
push edi
mov eax, dword [0x663000]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0
push eax
mov eax, dword [ebp + 0xc]
push 0x20019
push 0
mov dword [ebp - 0x20], 0
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x461839
mov ebx, dword [ebp - 0x20]
xor esi, esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x24], 0x3e8
push 0x7d2
mov byte [ebp - 4], 1
call fcn.005bc026
mov edi, eax
add esp, 4
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push edi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
mov dword [ebp - 0x38], esi
test eax, eax
jne 0x461802
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov word [edi + eax*2], cx
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov ecx, dword [ebx - 0x10]
lea esi, [ebx - 0x10]
mov eax, dword [ecx]
call dword [eax + 0x10]
cmp dword [esi + 0xc], 0
mov ecx, eax
lea eax, [esi + 0xc]
jl 0x4611e7
cmp ecx, dword [esi]
jne 0x4611e7
lock inc dword [eax]
jmp 0x461241
mov eax, dword [ecx]
lea edx, [esi + 4]
push 2
push dword [edx]
mov dword [ebp - 0x30], edx
call dword [eax]
mov esi, eax
test esi, esi
je 0x46186b
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax]
mov dword [esi + 4], ecx
mov ecx, dword [eax]
lea eax, [esi + 0x10]
inc ecx
add ecx, ecx
je 0x461241
test eax, eax
je 0x461231
push ecx
test ebx, ebx
je 0x461226
push ebx
push eax
call fcn.005b31a0
add esp, 0xc
jmp 0x461241
push 0
push eax
call fcn.005b3720
add esp, 0xc
call fcn.005b68e9
mov dword [eax], 0x16
call fcn.005b680f
lea eax, [esi + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 2
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x46125d
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x461273
call fcn.0040cfd9
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x461857
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0x6373dc
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.0040d850
test al, al
jne 0x4612a0
push 0x6373dc
lea ecx, [ebp - 0x18]
call fcn.004105e0
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x10]
call fcn.00451190
mov byte [ebp - 4], 2
or eax, 0xffffffff
mov edx, dword [ebp - 0x18]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4612cf
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x4612ec
mov eax, dword [ebp - 0x10]
mov esi, edi
sub esi, eax
mov dword [ebp - 0x28], edi
sar esi, 1
xor edx, edx
mov dword [ebp - 0x1c], edx
mov ebx, dword [eax - 0xc]
mov dword [ebp - 0x2c], ebx
jmp 0x46132a
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4612f1
mov eax, dword [ebp - 0x10]
mov esi, edi
sub esi, eax
mov dword [ebp - 0x28], edi
sub ecx, edx
sar esi, 1
sar ecx, 1
mov ebx, dword [eax - 0xc]
mov dword [ebp - 0x2c], ebx
js 0x461861
push ecx
push edi
call fcn.005b9721
mov edx, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
add esp, 8
mov ecx, SysReAllocString
sub ecx, edx
cmp ecx, ebx
jl 0x461861
add ebx, edx
js 0x461861
mov ecx, dword [eax - 8]
mov edx, 1
sub edx, dword [eax - 4]
sub ecx, ebx
or ecx, edx
jge 0x46135e
push ebx
lea ecx, [ebp - 0x10]
call fcn.0040208a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp esi, ecx
lea esi, [eax + esi*2]
jbe 0x46136b
mov esi, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
lea ecx, [eax + ecx*2]
add edx, edx
je 0x4613a8
test ecx, ecx
je 0x461395
push edx
test esi, esi
je 0x46138a
push esi
push ecx
call fcn.005b31a0
add esp, 0xc
jmp 0x4613a5
push 0
push ecx
call fcn.005b3720
add esp, 0xc
call fcn.005b68e9
mov dword [eax], 0x16
call fcn.005b680f
mov eax, dword [ebp - 0x10]
cmp ebx, dword [eax - 8]
jg 0x461861
mov dword [eax - 0xc], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov word [eax + ebx*2], cx
call fcn.0040cfd9
mov ecx, eax
test ecx, ecx
je 0x461857
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 5
call fcn.0040cfd9
test eax, eax
je 0x461857
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0x6373e0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 6
call fcn.0040d850
test al, al
jne 0x461417
push 0x6373e0
lea ecx, [ebp - 0x18]
call fcn.0040d9f0
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
mov byte [ebp - 4], 7
push eax
lea edx, [ebp - 0x10]
mov ecx, ebx
call fcn.00460d30
mov byte [ebp - 4], 5
add esp, 8
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x461452
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040cfd9
mov ecx, eax
test ecx, ecx
je 0x461857
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 8
call fcn.0040cfd9
test eax, eax
je 0x461857
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push str.DisplayVersion
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 9
call fcn.0040d850
test al, al
jne 0x4614ac
push str.DisplayVersion
lea ecx, [ebp - 0x18]
call fcn.0040d9f0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lea edx, [ebp - 0x10]
call fcn.00460d30
mov byte [ebp - 4], 8
add esp, 8
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4614e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040cfd9
mov ecx, eax
test ecx, ecx
je 0x461857
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 0xb
call fcn.0040cfd9
test eax, eax
je 0x461857
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push str.Publisher
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xc
call fcn.0040d850
test al, al
jne 0x46153e
push str.Publisher
lea ecx, [ebp - 0x18]
call fcn.0040d9f0
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x18]
mov ecx, ebx
push eax
lea edx, [ebp - 0x10]
call fcn.00460d30
mov byte [ebp - 4], 0xb
add esp, 8
mov edx, dword [ebp - 0x18]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x461576
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.0040cfd9
test eax, eax
je 0x461857
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push 0x632dd0
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0xe
call fcn.0040d850
test al, al
jne 0x4615b2
push 0x632dd0
lea ecx, [ebp - 0x18]
call fcn.0040d9f0
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xb
push eax
push 0x20019
push 0
push dword [ebp - 0x10]
mov dword [ebp - 0x30], 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x18]
test eax, eax
jne 0x461615
mov ebx, dword [ebp - 0x30]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x461603
cmp dword [ebp - 0x3c], 4
je 0x46160a
mov dword [ebp - 0x34], 0
test ebx, ebx
je 0x461615
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x46162d
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1c]
cmp dword [esi - 0xc], 0
je 0x461773
push 0x10
call fcn.00465805
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x461699
call fcn.0040cfd9
mov ecx, eax
test ecx, ecx
je 0x461857
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
call fcn.0040cfd9
mov ecx, eax
test ecx, ecx
je 0x461857
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx + 4], eax
call fcn.0040cfd9
mov ecx, eax
test ecx, ecx
je 0x461857
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx + 0xc], eax
jmp 0x46169b
xor ebx, ebx
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.004106c0
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebx + 4]
call fcn.004106c0
mov eax, dword [ebp - 0x34]
lea ecx, [ebx + 0xc]
mov dword [ebx + 8], eax
lea eax, [ebp - 0x28]
push eax
call fcn.004106c0
mov edx, dword [ebp - 0x14]
cmp dword [edx + 0x10], 0
mov eax, dword [edx + 4]
mov dword [ebp - 0x30], eax
jne 0x461749
mov eax, dword [edx + 0x14]
mov ecx, 0xc
mul ecx
mov ecx, eax
test edx, edx
ja 0x46184d
jb 0x4616f2
cmp ecx, 0xffffffff
ja 0x46184d
not eax
cmp eax, 8
jb 0x46184d
add ecx, 8
push ecx
call fcn.005bc026
add esp, 4
test eax, eax
je 0x46184d
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0xc]
mov dword [eax], ecx
mov dword [edx + 0xc], eax
mov edx, dword [edx + 0x14]
lea ecx, [edx*2 - 1]
add ecx, edx
add edx, 0xffffffff
lea ecx, [eax + ecx*4]
js 0x461746
mov esi, dword [ebp - 0x14]
mov eax, dword [esi + 0x10]
mov dword [ecx], eax
mov dword [esi + 0x10], ecx
sub ecx, 0xc
sub edx, 1
jns 0x461733
mov esi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
mov ecx, dword [edx + 0x10]
mov eax, dword [ecx]
mov dword [ecx + 8], ebx
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0x30]
mov dword [ecx + 4], eax
mov dword [ecx], 0
inc dword [edx + 8]
mov eax, dword [edx + 4]
test eax, eax
je 0x46176e
mov dword [eax], ecx
jmp 0x461770
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov byte [ebp - 4], 8
or eax, 0xffffffff
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], 0x3e8
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x461799
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 5
or eax, 0xffffffff
mov edx, dword [ebp - 0x2c]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4617b8
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 2
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x4617d4
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
or eax, 0xffffffff
mov edx, dword [ebp - 0x10]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x38]
test eax, eax
jg 0x461197
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x461197
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x461814
push ebx
call esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
push edi
mov dword [ebp - 0x50], 0
call fcn.005b98d1
add esp, 4
mov byte [ebp - 4], 0
push 0
call fcn.005b98d1
add esp, 4
test ebx, ebx
je 0x461839
push ebx
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push 0x8007000e
call fcn.0040238e
push 0x80004005
call fcn.0040238e
push 0x80070057
call fcn.0040238e
call fcn.00402258
int3