Function at 0x4069e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 8], 1
mov dword [ebp - 0x258], 0x41748c
mov eax, dword [ebp - 0x25c]
movzx eax, word [eax + 0x29]
imul eax, eax, 0x1af
add eax, 0x1c
mov ecx, dword [ebp - 0x25c]
mov dword [ecx + 0x21], eax
call sym.NPROTECT.EXE__NPSystemGetWindowsType_0
cmp eax, 2
jne 0x406a4f
mov eax, dword [ebp - 0x25c]
cmp dword [eax + 0x22c], 0
je 0x406a45
mov dword [ebp - 0x258], str.x:RECYCLERNPROTECT
jmp 0x406a4f
mov dword [ebp - 0x258], str.x:RECYCLEDNPROTECT
push str.Rules
mov eax, dword [ebp - 0x25c]
movsx eax, byte [eax]
push eax
push str.SoftwareSymantecNorton_UtilitiesNorton_Protection
push str._sDrive__c:_s
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x254]
push eax
push 1
push 0
lea eax, [ebp - 0x10c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406b08
mov dword [ebp - 0x250], 0x104
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.DirName
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x254]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x406b06
push dword [ebp - 0x258]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x25c]
mov al, byte [eax]
mov byte [ebp - 0x10c], al
jmp 0x406b29
push dword [ebp - 0x258]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x25c]
mov al, byte [eax]
mov byte [ebp - 0x10c], al
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x25c]
add eax, 0x3d
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x25c]
add eax, 0x3d
push eax
call dword [0x420598]
push 2
mov eax, dword [ebp - 0x25c]
add eax, 0x3d
push eax
call dword [0x4205a8]
push str.NPROTECT.LOG
lea eax, [ebp - 0x10c]
push eax
call dword [0x4205bc]
mov eax, dword [ebp - 0x25c]
and dword [eax + 0x25], 0
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x406bb3
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x22c]
mov dword [eax + 0x25], ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov eax, dword [eax + 9]
and eax, 2
test eax, eax
je 0x406be1
mov eax, dword [ebp - 0x25c]
cmp dword [eax + 0x25], 0
jne 0x406be1
mov eax, dword [ebp - 0x25c]
and dword [eax + 0x39], 0
push 1
pop eax
jmp 0x406c6e
mov eax, dword [ebp - 0x25c]
mov eax, dword [eax + 9]
and eax, 1
test eax, eax
je 0x406c24
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x25c]
mov ecx, dword [ecx + 0x25]
mov dword [eax + 0x21], ecx
mov eax, dword [ebp - 0x25c]
mov eax, dword [eax + 0x25]
sub eax, 0x1c
xor edx, edx
mov ecx, 0x1af
div ecx
mov ecx, dword [ebp - 0x25c]
mov word [ecx + 0x29], ax
jmp 0x406c53
mov eax, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x25c]
mov eax, dword [eax + 0x25]
cmp eax, dword [ecx + 0x21]
jbe 0x406c53
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x25c]
push dword [eax + 0x25]
mov ecx, dword [ebp - 0x25c]
call fcn.00406579
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x25c]
push dword [eax + 0x21]
mov ecx, dword [ebp - 0x25c]
call fcn.00406704
leave
ret