Function at 0x46ed50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x294
mov eax, dword [0x533014]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
mov dword [ebp - 4], 1
mov dword [ebp - 0x21c], 0x104
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.004ebd80
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 4]
push eax
push str.registtime
push str.SOFTWARE360SafeCoop
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x46f092
lea ecx, [ebp - 0x220]
push ecx
call fcn.0046ec10
add esp, 4
lea ecx, [ebp - 0x220]
call fcn.0047ef80
shl eax, 1
mov dword [ebp - 0x21c], eax
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x220]
call fcn.00418a50
test eax, eax
je 0x46f087
xor eax, eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x268], eax
mov dword [ebp - 0x264], eax
xor ecx, ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x248], ecx
mov dword [ebp - 0x244], ecx
lea edx, [ebp - 0x250]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x218]
mov dword [ebp - 0x284], eax
lea ecx, [ebp - 0x240]
call fcn.00444840
mov dword [ebp - 0x288], 0
jmp 0x46ee74
mov ecx, dword [ebp - 0x288]
add ecx, 1
mov dword [ebp - 0x288], ecx
mov edx, dword [ebp - 0x288]
cmp edx, dword [ebp - 0x21c]
jae 0x46eef5
mov eax, dword [ebp - 0x288]
movzx ecx, word [ebp + eax*2 - 0x218]
cmp ecx, 0x3a
jne 0x46eef0
xor edx, edx
mov eax, dword [ebp - 0x288]
mov word [ebp + eax*2 - 0x218], dx
mov ecx, dword [ebp - 0x284]
push ecx
call fcn.004f0085
add esp, 4
mov dword [ebp - 0x28c], eax
lea edx, [ebp - 0x28c]
push edx
lea ecx, [ebp - 0x240]
call fcn.0043c620
mov eax, dword [ebp - 0x288]
add eax, 1
cmp eax, dword [ebp - 0x21c]
jae 0x46eef0
mov ecx, dword [ebp - 0x288]
lea edx, [ebp + ecx*2 - 0x216]
mov dword [ebp - 0x284], edx
jmp 0x46ee65
mov eax, dword [ebp - 0x284]
push eax
call fcn.004f0085
add esp, 4
mov dword [ebp - 0x290], eax
lea ecx, [ebp - 0x290]
push ecx
lea ecx, [ebp - 0x240]
call fcn.0043c620
lea ecx, [ebp - 0x240]
call fcn.0043c600
cmp eax, 3
jae 0x46ef56
mov edx, dword [ebp - 8]
mov dword [ebp - 0x294], edx
lea ecx, [ebp - 0x240]
call fcn.00423490
lea ecx, [ebp - 0x220]
call fcn.004335b0
mov eax, dword [ebp - 0x294]
jmp 0x46f095
push 0
lea ecx, [ebp - 0x240]
call fcn.0048aac0
mov ax, word [eax]
mov word [ebp - 0x270], ax
push 1
lea ecx, [ebp - 0x240]
call fcn.0048aac0
mov cx, word [eax]
mov word [ebp - 0x26e], cx
push 2
lea ecx, [ebp - 0x240]
call fcn.0048aac0
mov dx, word [eax]
mov word [ebp - 0x26a], dx
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x270]
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov ecx, dword [ebp - 0x228]
sub ecx, dword [ebp - 0x260]
mov edx, dword [ebp - 0x224]
sbb edx, dword [ebp - 0x25c]
mov dword [ebp - 0x258], ecx
mov dword [ebp - 0x254], edx
xor eax, eax
mov dword [ebp - 0x280], eax
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x274], eax
push 0x10
push 0
lea ecx, [ebp - 0x280]
push ecx
call fcn.004ebd80
add esp, 0xc
lea edx, [ebp - 0x280]
push edx
lea eax, [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx ecx, word [ebp - 0x27a]
cmp ecx, 7
jg 0x46f075
movzx edx, word [ebp - 0x27a]
cmp edx, 7
jg 0x46f04c
movzx eax, word [ebp - 0x27e]
cmp eax, 1
jg 0x46f075
movzx ecx, word [ebp - 0x27a]
cmp ecx, 7
jg 0x46f07c
movzx edx, word [ebp - 0x27e]
cmp edx, 1
jne 0x46f07c
movzx eax, word [ebp - 0x280]
sub eax, 0x641
cmp eax, 1
jl 0x46f07c
mov dword [ebp - 8], 1
lea ecx, [ebp - 0x240]
call fcn.00423490
lea ecx, [ebp - 0x220]
call fcn.004335b0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004eabb3
mov esp, ebp
pop ebp
ret