Function at 0x7de1b14b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
cmp dword [ebp + 8], esi
je 0x7de1b344
cmp dword [ebp + 0xc], esi
je 0x7de1b344
mov edi, dword [ebp + 0x10]
lea eax, [edi - 0x125]
cmp eax, 0x7ffffed2
ja 0x7de1b344
push ebx
push dword [ebp + 8]
call fcn.7de1aeda
push 4
push 0x1000
lea edi, [edi + edi + 0x10]
push edi
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], edi
call fcn.7dd71833
mov ebx, eax
cmp ebx, esi
jne 0x7de1b1c9
mov dword [ebp + 0xc], 0x8007000e
jmp 0x7de1b306
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x7de1b1d2
mov dword [eax], esi
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov word [ecx], ax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x28], 0x7de1b358
cmp dword [ebp - 8], esi
jne 0x7de1b1fe
mov dword [ebp - 0x28], 0x7de1b350
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ntdll.dll_NtOpenKey]
cmp eax, esi
jge 0x7de1b225
or eax, 0x10000000
mov dword [ebp + 0xc], eax
jmp 0x7de1b306
cmp dword [ebp - 8], esi
jne 0x7de1b231
mov eax, 0x7de1b360
jmp 0x7de1b23d
mov eax, 0x7de1b368
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0xc]
push ecx
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
push ebx
push 2
push eax
push dword [ebp - 4]
call edi
test eax, eax
jl 0x7de1b2ff
cmp dword [ebx + 4], 1
jne 0x7de1b2ff
lea esi, [ebx + 0xc]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.7dd73da0
mov dword [ebp + 0xc], eax
test eax, eax
jge 0x7de1b28b
push eax
push 0x7de1b380
push 0
call fcn.7de1ae08
add esp, 0xc
jmp 0x7de1b2fb
cmp dword [ebp - 8], 0
je 0x7de1b2be
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push ebx
push 2
push 0x7de1b370
push dword [ebp - 4]
call edi
test eax, eax
jl 0x7de1b2be
cmp dword [ebx + 4], 4
jne 0x7de1b2be
xor eax, eax
cmp byte [esi], al
sete al
mov dword [ebp - 0x10], eax
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push ebx
push 2
push 0x7de1b378
push dword [ebp - 4]
call edi
test eax, eax
jl 0x7de1b2f7
cmp dword [ebx + 4], 1
jne 0x7de1b2f7
cmp word [esi], 0x31
jne 0x7de1b2f7
push dword [ebp + 8]
call fcn.7de1af6c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
and dword [ebp + 0xc], 0
xor esi, esi
jmp 0x7de1b306
mov dword [ebp + 0xc], 0x80070490
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x7de1b312
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
cmp eax, esi
je 0x7de1b31e
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp - 4], esi
je 0x7de1b32e
push dword [ebp - 4]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x7de1b33e
push 0x8000
push esi
push ebx
call fcn.7dd7184b
mov eax, dword [ebp + 0xc]
pop ebx
jmp 0x7de1b349
mov eax, 0x80070057
pop edi
pop esi
leave
ret 0x14