Function at 0x68ef9c26
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
mov eax, dword [0x68f6edd8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push esi
push edi
lea ecx, [ebp - 0x410]
push ecx
lea ecx, [ebp - 0x444]
push ecx
lea ecx, [ebp - 0x414]
push ecx
push 0
mov dword [ebp - 0x418], eax
add eax, 4
push 0x68f71598
push dword [eax]
mov dword [ebp - 0x410], 0x2c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x68ef9c86
cmp dword [ebp - 0x414], 3
jne 0x68ef9c86
test eax, eax
je 0x68ef9cad
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68ef9c96
call esi
jmp 0x68ef9ca2
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e3036
call fcn.68ef1014
mov eax, dword [ebp - 0x444]
lea edi, [ebx + 0x44]
lea esi, [ebp - 0x438]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x98]
lea esi, [ebp - 0x428]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebx], eax
mov eax, dword [ebp - 0x440]
push 0
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x418]
mov dword [ebx + 0x54], eax
mov eax, dword [ebp - 0x43c]
push str.Index
lea esi, [ebx + 0x4bc]
push esi
mov ecx, edi
mov dword [ebx + 0xa8], eax
call sym.GrooveUtil.DLL_public:_long_int___thiscall_GCRegistryKey::GetValue_unsigned_long_int___wchar_t_const___unsigned_long_int__const
test eax, eax
je 0x68ef9d0c
mov dword [esi], 0xbeefcafe
lea eax, [edi + 4]
push 0x68f715a0
push eax
lea esi, [ebp - 0x410]
lea edi, [ebp - 0x40c]
mov dword [ebp - 0x410], 0x200
call fcn.68ef9f5f
test eax, eax
je 0x68ef9d5b
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x68ef9d44
call esi
jmp 0x68ef9d50
call esi
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x2e6e3037
call fcn.68ef1014
push 0xffffffffffffffff
lea ecx, [ebp - 0x40c]
push ecx
lea eax, [ebx + 4]
push 0x20
push eax
mov dword [ebp - 0x414], eax
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
mov eax, dword [ebp - 0x418]
add esp, 0x10
push 0x68f715a8
add eax, 4
push eax
lea esi, [ebp - 0x410]
lea edi, [ebp - 0x40c]
mov dword [ebp - 0x410], 0x200
call fcn.68ef9f5f
test eax, eax
lea esi, [ebx + 0x58]
je 0x68ef9db0
and word [esi], 0
jmp 0x68ef9dc5
push 0xffffffffffffffff
lea eax, [ebp - 0x40c]
push eax
push 0x20
push esi
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
mov ecx, dword [ebp - 0x418]
push str.Display
lea eax, [ebx + 0xac]
push eax
call sym.GrooveUtil.DLL_public:_long_int___thiscall_GCRegistryKey::GetValue_class_GCStackStrBase___wchar_t_const__const
cmp word [ebx + 0x46], 0
jne 0x68ef9e17
xor eax, eax
lea edi, [ebx + 0x44]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
lea edi, [ebx + 0x98]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x20
push dword [ebp - 0x414]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
and dword [ebx + 0xa8], 0
and dword [ebx + 0x54], 0
push 0x20
push esi
call dword [sym.imp.MSVCR80.dll_wcsncpy_s]
add esp, 0x10
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.68f53fd7
leave
ret 4