Function at 0x99add0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb12010
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 0x390
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 0x390], ebx
mov dword [ebp - 0x38c], ebx
mov ecx, 0x13
mov esi, str.SYSTEMCurrentControlSetControlClass4D36E97D_E325_11CE_BFC1_08002BE10318
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov byte [ebp - 0x178], bl
push 0x103
push ebx
lea eax, [ebp - 0x177]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x388], bl
push 0x103
push ebx
lea ecx, [ebp - 0x387]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x394], ebx
mov dword [ebp - 4], ebx
push 0x80000002
lea eax, [ebp - 0x390]
lea ecx, [ebx + 9]
lea edx, [ebp - 0x70]
call fcn.0097f000
add esp, 4
cmp eax, ebx
je 0x99ae90
mov dword [ebp - 4], 0xfffffffe
jmp 0x99b080
mov edi, 0x104
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x99aea0
mov byte [ebp - 0x178], bl
mov dword [ebp - 0x39c], edi
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x39c]
push edx
lea eax, [ebp - 0x178]
push eax
mov ecx, dword [ebp - 0x394]
push ecx
mov edx, dword [ebp - 0x390]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
jne 0x99aff7
mov eax, dword [ebp - 0x390]
push eax
lea eax, [ebp - 0x38c]
mov ecx, 1
lea edx, [ebp - 0x178]
call fcn.0097f000
add esp, 4
cmp eax, ebx
jne 0x99b038
mov byte [ebp - 0x280], bl
push 0x103
push ebx
lea ecx, [ebp - 0x27f]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x398], edi
lea edx, [ebp - 0x398]
push edx
lea eax, [ebp - 0x280]
push eax
push ebx
push ebx
push str.DriverDesc
mov ecx, dword [ebp - 0x38c]
push ecx
call esi
cmp eax, ebx
jne 0x99af84
push ebx
push str.bitdefender
lea edx, [ebp - 0x280]
push edx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x99af84
lea eax, [ebp - 0x178]
push eax
lea ecx, [ebp - 0x70]
push ecx
push 0xaac2e4
lea edx, [ebp - 0x388]
push edx
call fcn.00a78f30
lea eax, [ebp - 0x38c]
push eax
jmp 0x99afef
mov byte [ebp - 0x280], bl
mov dword [ebp - 0x398], edi
lea ecx, [ebp - 0x398]
push ecx
lea edx, [ebp - 0x280]
push edx
push ebx
push ebx
push str.ProviderName
mov eax, dword [ebp - 0x38c]
push eax
call esi
cmp eax, ebx
jne 0x99b029
push ebx
push str.bitdefender
lea ecx, [ebp - 0x280]
push ecx
call fcn.0095c8c0
add esp, 0xc
cmp eax, 0xffffffff
je 0x99b029
lea edx, [ebp - 0x178]
push edx
lea eax, [ebp - 0x70]
push eax
push 0xaac2e4
lea ecx, [ebp - 0x388]
push ecx
call fcn.00a78f30
lea edx, [ebp - 0x38c]
push edx
call fcn.009851c0
add esp, 0x14
lea eax, [ebp - 0x390]
push eax
call fcn.009851c0
add esp, 4
cmp byte [ebp - 0x388], bl
je 0x99b05b
push 0x80000002
xor eax, eax
lea edi, [ebp - 0x388]
call fcn.0095fbe0
mov dword [ebp - 4], 0xfffffffe
jmp 0x99b082
lea ecx, [ebp - 0x38c]
push ecx
call fcn.009851c0
add esp, 4
inc dword [ebp - 0x394]
jmp 0x99aea0
mov dword [ebp - 4], 0xfffffffe
lea edx, [ebp - 0x38c]
push edx
call fcn.009851c0
add esp, 4
lea eax, [ebp - 0x390]
push eax
call fcn.009851c0
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret