Function at 0x10009c70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100377e0
push eax
mov eax, 0x1780
mov dword fs:[0], esp
call fcn.10024c40
mov eax, dword [esp + 0x1794]
mov ecx, dword [eax]
push esi
push edi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x1770
call fcn.1000b730
mov esi, dword [esp + 8]
mov dword [esp + 0x1790], 0
mov ecx, 0x1003bb5d
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009ce5
test dl, dl
je 0x10009cde
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009ce5
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009cc2
xor eax, eax
or edi, 0xffffffff
jmp 0x10009cee
sbb eax, eax
mov edi, 0xffffffff
sbb eax, edi
xor edx, edx
test eax, eax
sete dl
mov eax, edx
test eax, eax
je 0x10009d30
mov ecx, dword [esp + 0x17a0]
xor eax, eax
mov word [ecx], ax
lea eax, [esi - 0x10]
mov dword [esp + 0x1790], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x10009e6d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x10009e6d
lea ecx, [esp + 0xc]
push ecx
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10009d84
mov eax, dword [esp + 0x17a0]
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x1790], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009d7a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
jmp 0x10009e6f
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10009dcc
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x17a0]
xor edx, edx
push ecx
mov word [eax], dx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
jmp 0x10009d0a
mov eax, 0x1b4e81b5
mul dword [esp + 0x10]
shr edx, 5
push ebx
xor esi, esi
push ebp
test edx, edx
jle 0x10009e30
mov ebp, dword [esp + 0x10]
lea edi, [esp + 0x20]
mov ecx, ebp
mov eax, edi
lea esp, [esp]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10009e10
test bl, bl
je 0x10009e0c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10009e10
add eax, 2
add ecx, 2
test bl, bl
jne 0x10009df0
xor eax, eax
jmp 0x10009e15
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
jne 0x10009e88
inc esi
add edi, 0x12c
cmp esi, edx
jl 0x10009de8
or edi, 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x17a8]
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009e6b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ebp
pop ebx
xor eax, eax
mov ecx, dword [esp + 0x1788]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x178c
ret 0xc
imul esi, esi, 0x12c
push 0x1003bb5f
push 0x1003bef0
lea esi, [esp + esi + 0x28]
push 0x32
push esi
call fcn.10023fef
push 0x1003bb5e
push 0x1003bef0
push 0xfa
add esi, 0x32
push esi
call fcn.10023fef
mov eax, dword [esp + 0x34]
add esp, 0x20
push 0x1770
lea edx, [esp + 0x24]
push edx
push 3
push 0
push str.hlpreg
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10009f1c
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x17a8]
xor ecx, ecx
push eax
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10009e5f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x17a8]
mov edx, 1
mov word [eax], dx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10009e5f