Function at 0x10009a00
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10035548
push eax
mov eax, 0x1780
mov dword fs:[0], esp
call fcn.10022b00
mov eax, dword [esp + 0x1794]
mov ecx, dword [eax]
push esi
push edi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x1770
call fcn.1000b480
mov esi, dword [esp + 8]
mov dword [esp + 0x1790], 0
mov ecx, 0x100380eb
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009a75
test dl, dl
je 0x10009a6e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009a75
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009a52
xor eax, eax
or edi, 0xffffffff
jmp 0x10009a7e
sbb eax, eax
mov edi, 0xffffffff
sbb eax, edi
xor edx, edx
test eax, eax
sete dl
mov eax, edx
test eax, eax
je 0x10009ac0
mov ecx, dword [esp + 0x17a0]
xor eax, eax
mov word [ecx], ax
lea eax, [esi - 0x10]
mov dword [esp + 0x1790], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x10009bfd
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x10009bfd
lea ecx, [esp + 0xc]
push ecx
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10009b14
mov eax, dword [esp + 0x17a0]
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x1790], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009b0a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
jmp 0x10009bff
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10009b5c
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x17a0]
xor edx, edx
push ecx
mov word [eax], dx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
jmp 0x10009a9a
mov eax, 0x1b4e81b5
mul dword [esp + 0x10]
shr edx, 5
push ebx
xor esi, esi
push ebp
test edx, edx
jle 0x10009bc0
mov ebp, dword [esp + 0x10]
lea edi, [esp + 0x20]
mov ecx, ebp
mov eax, edi
lea esp, [esp]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10009ba0
test bl, bl
je 0x10009b9c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10009ba0
add eax, 2
add ecx, 2
test bl, bl
jne 0x10009b80
xor eax, eax
jmp 0x10009ba5
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
jne 0x10009c18
inc esi
add edi, 0x12c
cmp esi, edx
jl 0x10009b78
or edi, 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x17a8]
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009bfb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ebp
pop ebx
xor eax, eax
mov ecx, dword [esp + 0x1788]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x178c
ret 0xc
imul esi, esi, 0x12c
push 0x100380f6
push 0x10038490
lea esi, [esp + esi + 0x28]
push 0x32
push esi
call fcn.100226c5
push 0x100380f5
push 0x10038490
push 0xfa
add esi, 0x32
push esi
call fcn.100226c5
mov eax, dword [esp + 0x34]
add esp, 0x20
push 0x1770
lea edx, [esp + 0x24]
push edx
push 3
push 0
push str.hlpreg
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10009cac
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x17a8]
xor ecx, ecx
push eax
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10009bef
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x17a8]
mov edx, 1
mov word [eax], dx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10009bef