Function at 0xb8bd0c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x260
mov eax, 0xbc89bb
call fcn.00bc132b
mov ecx, dword [ebp + 8]
xor ebx, ebx
mov eax, dword [ebp + 0xc]
mov edx, ebx
mov esi, ebx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x258], esi
mov dword [ebp - 4], ebx
mov edi, ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x264], edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x234], ebx
mov word [ebp - 0x218], bx
test ecx, ecx
je 0xbd3aac
test eax, eax
je 0xbd3aac
lea eax, [ebp - 0x248]
mov edx, 0x20019
push eax
mov ecx, 0xb268b0
call fcn.00bbfb00
mov ebx, eax
test ebx, ebx
js 0xb8c0db
mov eax, dword [ebp - 0x254]
xor ecx, ecx
mov esi, dword [ebp - 0x248]
push ecx
push ecx
push ecx
push ecx
mov dword [ebp - 0x258], esi
mov dword [eax], ecx
mov eax, dword [ebp - 0x23c]
push ecx
push ecx
mov dword [eax], ecx
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x244]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryInfoKeyW]
mov ebx, eax
test ebx, ebx
jne 0xbd38f5
mov eax, dword [ebp - 0x244]
push 4
pop ecx
mul ecx
lea ecx, [ebp - 0x224]
push edx
push eax
call fcn.00b8362f
mov ebx, eax
test ebx, ebx
js 0xb8c0db
push dword [ebp - 0x224]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov dword [ebp - 0x228], eax
test eax, eax
je 0xbd3909
push dword [ebp - 0x224]
push edi
push eax
call fcn.00bc259b
mov ecx, dword [ebp - 0x230]
lea eax, [ebp - 0x230]
add esp, 0xc
xor edx, edx
inc edx
push eax
call fcn.00b8ba06
mov ebx, eax
test ebx, ebx
js 0xbd3918
mov eax, dword [ebp - 0x230]
push 2
pop ecx
mul ecx
lea ecx, [ebp - 0x22c]
push edx
push eax
call fcn.00b8362f
mov ebx, eax
test ebx, ebx
js 0xbd3918
push dword [ebp - 0x22c]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemAlloc]
mov ecx, eax
mov dword [ebp - 0x238], ecx
test ecx, ecx
je 0xbd3913
xor edx, edx
mov dword [ebp - 0x250], edx
cmp dword [ebp - 0x244], edx
jbe 0xb8c0ae
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x25c], eax
xor eax, eax
push eax
push eax
push eax
push eax
mov word [ecx], ax
lea eax, [ebp - 0x25c]
push eax
push ecx
push edx
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
test ebx, ebx
jne 0xbd3a92
push dword [ebp - 0x238]
lea eax, [ebp - 0x218]
push 0xb268b0
push 0xb26910
push 0x104
push eax
call fcn.00b55e8f
mov ebx, eax
add esp, 0x14
test ebx, ebx
js 0xbd3918
lea eax, [ebp - 0x234]
push eax
push 0x20119
push 0
lea eax, [ebp - 0x218]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
mov dword [ebp - 0x224], ebx
test ebx, ebx
jg 0xbd3983
js 0xb8c08e
mov eax, dword [ebp - 0x234]
mov ecx, eax
mov dword [ebp - 0x260], ecx
test edi, edi
je 0xb8bf85
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov ebx, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push ebx
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [ebp - 0x234]
mov ebx, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x260]
mov edi, ecx
xor edx, edx
lea ecx, [ebp - 0x268]
mov dword [ebp - 0x264], edi
push ecx
lea ecx, [ebp - 0x240]
mov dword [ebp - 0x240], edx
push ecx
push edx
push 0x18
push 0xb268f0
push edx
push eax
mov dword [ebp - 0x268], 4
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0xb8c08e
lea eax, [ebp - 0x26c]
mov dword [ebp - 0x26c], 4
push eax
xor ecx, ecx
lea eax, [ebp - 0x24c]
push eax
push ecx
push 0x18
push 0xb2691c
push ecx
push dword [ebp - 0x234]
mov dword [ebp - 0x24c], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
xor eax, eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x22c], eax
mov byte [ebp - 4], 2
cmp dword [ebp + 0x20], eax
jne 0xbd3999
cmp dword [ebp - 0x240], 0x3f
mov byte [ebp - 0x219], 0
je 0xb8c075
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x240], eax
je 0xb8c05d
mov ecx, dword [ebp - 0x24c]
xor eax, eax
inc eax
xor edx, edx
call fcn.00bc6210
and eax, dword [ebp + 0x18]
and edx, dword [ebp + 0x1c]
or eax, edx
jne 0xbd39bc
mov eax, dword [ebp + 0x10]
cmp dword [ebp - 0x240], eax
je 0xbd39c8
cmp dword [ebp + 0x20], 0
jne 0xbd39d4
mov al, byte [ebp - 0x219]
test al, al
jne 0xbd3a1f
mov byte [ebp - 4], 1
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x224]
test eax, eax
jne 0xbd3a4a
mov edx, dword [ebp - 0x250]
inc edx
mov dword [ebp - 0x250], edx
cmp edx, dword [ebp - 0x244]
jae 0xb8c0ae
mov ecx, dword [ebp - 0x238]
jmp 0xb8beb8
mov ecx, dword [ebp - 0x254]
mov eax, dword [ebp - 0x220]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x23c]
mov eax, dword [ebp - 0x228]
mov dword [ecx], eax
mov eax, dword [ebp - 0x238]
test eax, eax
je 0xb8c0db
push eax
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
mov byte [ebp - 4], 0
test edi, edi
je 0xb8c0ea
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0xb8c0f9
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, ebx
call fcn.00bc12da
ret 0x1c
jle 0xb8c0db
movzx ebx, bx
or ebx, 0x80070000
jmp 0xb8c0db
mov ebx, 0x8007000e
jmp 0xb8c0db
mov ebx, 0x8007000e
mov edx, dword [ebp - 0x220]
cmp dword [ebp - 0x228], 0
je 0xb8c0ca
xor eax, eax
mov dword [ebp - 0x23c], eax
test edx, edx
je 0xbd3972
mov ecx, dword [ebp - 0x228]
mov esi, dword [ebp - 0x220]
mov edx, dword [ecx + eax*4]
test edx, edx
je 0xbd3961
push edx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x228]
and dword [ecx + eax*4], 0
inc eax
mov dword [ebp - 0x23c], eax
cmp eax, esi
jb 0xbd3943
mov esi, dword [ebp - 0x258]
push dword [ebp - 0x228]
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
jmp 0xb8c0ca
movzx ebx, bx
or ebx, 0x80070000
mov dword [ebp - 0x224], ebx
test ebx, ebx
jmp 0xb8bf45
mov ecx, dword [ebp - 0x234]
lea eax, [ebp - 0x22c]
push eax
call fcn.00ce8467
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x224], eax
jmp 0xb8c015
mov byte [ebp - 0x219], 1
jmp 0xb8c04e
mov byte [ebp - 0x219], 1
jmp 0xb8c05d
mov eax, dword [ebp - 0x224]
test eax, eax
je 0xb8c067
mov ecx, dword [ebp + 0x20]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xbd3a0b
test dx, dx
je 0xbd3a07
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xbd3a0b
add eax, 4
add ecx, 4
test dx, dx
jne 0xbd39e5
xor eax, eax
jmp 0xbd3a10
sbb eax, eax
or eax, 1
test eax, eax
mov al, 1
je 0xb8c06d
jmp 0xb8c067
push dword [ebp - 0x238]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x228]
mov edx, dword [ebp - 0x220]
mov dword [ecx + edx*4], eax
test eax, eax
je 0xbd3a5f
inc edx
mov dword [ebp - 0x220], edx
jmp 0xb8c075
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xb8c08e
mov byte [ebp - 4], 1
mov ebx, 0x8007000e
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x224]
test eax, eax
je 0xbd391e
push eax
push 0
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
push eax
call dword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
jmp 0xbd3918
mov edx, dword [ebp - 0x220]
jle 0xbd391e
movzx ebx, bx
or ebx, 0x80070000
jmp 0xbd391e
mov ebx, 0x80070057
jmp 0xbd391e