Function at 0xe9e50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x11c1eb
mov eax, dword fs:[0]
push eax
sub esp, 0x90
mov eax, dword [0x13206c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x94], 0
add dword [0x134754], 2
mov dword [ebp - 0x84], 0x129c14
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], ax
mov dword [ebp - 0x68], 0x129c14
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], 7
mov word [ebp - 0x64], ax
mov dword [ebp - 0x90], eax
mov byte [ebp - 0x8c], al
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x65
mov dword [ebp - 4], eax
mov dword [ebp - 0x4c], 0x200
push 0x74
push 0x6f
push 0x4e
push 0x54
push 0x45
push 0x59
push 0x5c
push 0x65
push 0x72
push 0x61
push 0x77
push 0x74
push 0x66
push 0x6f
lea edx, [eax + 0x53]
lea ecx, [ebp - 0x44]
call fcn.000ea700
add esp, 0x138
xor ecx, ecx
mov dword [ebp - 0x2c], 0x129c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
inc dword [0x134754]
cmp ecx, eax
je 0xe9f87
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0xe9f7b
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.000d1370
push ecx
push 0x80000001
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x90]
call fcn.000cdc70
mov byte [ebp - 4], 1
dec dword [0x134754]
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0xe9fe6
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0xe9fdc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xea3d4
push edx
push ecx
call fcn.000f17bc
add esp, 8
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0xea024
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0xea01a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xea3d4
push edx
push ecx
call fcn.000f17bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x48], 0x129c14
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
push 7
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x44]
inc dword [0x134754]
push 0x12a4b8
call fcn.000d1370
mov byte [ebp - 4], 0
mov al, byte [ebp - 0x8c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x90], 0
test al, al
je 0xea0c7
cmp dword [ebp - 0x30], 8
lea ecx, [ebp - 0x98]
push ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x9c], 4
push ecx
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x98], 4
push ecx
lea eax, [ebp - 0x44]
cmovae eax, dword [ebp - 0x44]
push 0
push eax
push dword [ebp - 0x88]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x90], eax
mov al, byte [ebp - 0x8c]
dec dword [0x134754]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x48], 0x129c14
cmp edx, 8
jb 0xea114
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0xea104
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xea3d9
push edx
push ecx
call fcn.000f17bc
mov al, byte [ebp - 0x8c]
add esp, 8
mov esi, dword [ebp - 0x94]
test esi, esi
je 0xea151
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x90], 0
test al, al
je 0xea37d
push dword [ebp - 0x88]
call edi
mov esi, dword [ebp - 0x94]
xor al, al
mov byte [ebp - 0x8c], al
jmp 0xea37d
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x65
push 0x74
push 0x6f
push 0x4e
push 0x54
push 0x45
push 0x59
push 0x5c
push 0x65
push 0x72
push 0x61
push 0x77
push 0x74
push 0x66
push 0x6f
mov edx, 0x53
lea ecx, [ebp - 0x44]
call fcn.000ea700
add esp, 0x138
xor ecx, ecx
mov dword [ebp - 0x2c], 0x129c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], cx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
inc dword [0x134754]
cmp ecx, eax
je 0xea242
cmp dword [eax + 0x14], 8
mov ecx, eax
jb 0xea236
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.000d1370
push ecx
push 0x80000002
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 7
push eax
lea ecx, [ebp - 0x90]
call fcn.000cdc70
lea ecx, [ebp - 0x2c]
call fcn.000ced70
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x30]
cmp edx, 8
jb 0xea2a3
mov ecx, dword [ebp - 0x44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0xea299
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0xea3de
push edx
push ecx
call fcn.000f17bc
add esp, 8
xor eax, eax
mov dword [ebp - 0x2c], 0x129c14
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
push 7
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x28]
inc dword [0x134754]
push 0x12a4b8
call fcn.000d1370
cmp byte [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
je 0xea335
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x9c]
push ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x98], 4
push ecx
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x9c], 4
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push dword [ebp - 0x88]
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x2c]
call fcn.000ced70
mov al, byte [ebp - 0x8c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x90], 0
test al, al
je 0xea367
push dword [ebp - 0x88]
call edi
xor al, al
mov byte [ebp - 0x8c], al
mov esi, dword [ebp - 0x94]
mov ecx, 0x63
test esi, esi
cmove esi, ecx
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], 0
test al, al
je 0xea3a4
push dword [ebp - 0x88]
call edi
mov dword [ebp - 0x90], 0
mov byte [ebp - 0x8c], 0
lea ecx, [ebp - 0x68]
call fcn.000ced70
lea ecx, [ebp - 0x84]
call fcn.000ced70
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.000f1776
mov esp, ebp
pop ebp
ret
call fcn.000f75a6
call fcn.000f75a6
call fcn.000f75a6
int3