Function at 0x10004110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x28], ebx
push edi
inc di
test di, 0x3f60
xor di, 0x5177
sub edi, esi
pop edi
jbe 0x10004149
push eax
mov eax, 0xd36b3e14
pop eax
ja 0x10004149
mov dh, 0x86
cmp eax, 0x880643d5
aad 0xe5
jge 0x10004196
cmp edi, dword [esi + 0x40b9]
add byte [ebx], dh
ror byte [ebp - 0x13243], 0xff
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x133]
mov byte [ebp - 0x134], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x134]
push eax
push 0x1000938c
push 0x10009384
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
jo 0x1000418d
nop
nop
nop
jno 0x1000418d
push eax
inc ebx
js 0x1000418d
cwde
sub dword [ebp - 0x7a7207ab], ecx
int3
lea edx, [ebp - 8]
lea eax, [ebp - 0x134]
push edx
push 1
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004363
push bx
push edi
test bx, di
or edi, 0x7a4d
cmp bh, 0x72
cmp edi, ebx
pop edi
pop bx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 4]
lea edx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push edx
mov edx, dword [ebp - 8]
push eax
push 0
push ecx
push edx
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x10004363
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [esi]
xor eax, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jbe 0x10004209
mov bx, bx
mov esi, esi
ja 0x10004209
invalid
lea edx, [ebp - 4]
lea eax, [ebp - 0x24]
push edx
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push ecx
push 0
push edx
push eax
mov dword [ebp - 4], 6
call ebx
test eax, eax
jne 0x10004363
mov cx, word [esi + 4]
mov edi, dword [ebp + 0x1c]
xor cx, word [ebp - 0x24]
xor ecx, dword [ebp - 0x24]
mov word [edi], cx
mov dx, word [esi + 6]
xor dx, word [ebp - 0x22]
mov word [edi + 2], dx
mov ax, word [esi + 8]
xor ax, word [ebp - 0x20]
mov word [edi + 4], ax
jbe 0x10004275
mov dx, dx
ja 0x10004275
jae 0x10004238
mov al, byte [0xfff6906c]
and eax, 0xa0633c25
dec dword [ebx]
sbb edi, dword [esi]
lea ecx, [ebp - 4]
lea edx, [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 0x20]
lea eax, [ebp - 0xc]
push edx
mov edx, dword [ebp - 8]
push eax
push 0
push ecx
push edx
mov dword [ebp - 4], 6
call ebx
test eax, eax
jne 0x10004366
mov cx, word [esi + 0xa]
mov eax, dword [ebp + 0x24]
xor cx, word [ebp - 0x1c]
mov word [eax], cx
mov dx, word [esi + 0xc]
xor dx, word [ebp - 0x1a]
mov word [eax + 2], dx
mov cx, word [esi + 0xe]
xor cx, word [ebp - 0x18]
mov word [eax + 4], cx
jle 0x100042e7
mov bx, bx
xchg si, si
xchg dl, dl
jg 0x100042e7
lahf
fdivr qword [ecx + 0x14]
pushfd
call 0xea6c76a
call 0xd96858a9
pop es
fimul word [ebp + 0x458dfc55]
in al, dx
lea edx, [ebp - 4]
lea eax, [ebp - 0x14]
push edx
mov edx, dword [ebp + 0x28]
lea ecx, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push ecx
push 0
push edx
push eax
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x10004366
push ebx
push ecx
add bx, si
test dh, bh
add bx, si
sub cx, 0x1ca2
xor cl, 0x3a
and ebx, eax
and ch, 0x7b
or ecx, 0x7a91
mov bl, dl
pop ecx
pop ebx
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 0x2c]
xor ecx, eax
mov dword [edx], ecx
pushal
dec ax
cmp ebx, eax
cmp bx, 0x52e6
dec eax
xor bl, al
popal
mov dword [ebp - 0x28], 1
jb 0x10004363
mov cx, cx
nop
nop
nop
nop
jae 0x10004363
out dx, eax
sbb ecx, dword [ebx - 0x73f0e383]
sbb al, byte [eax]
add byte [eax], al
mov edi, dword [ebp + 0x1c]
jl 0x10004386
push di
pop di
jge 0x10004386
mov dword [0xcf269eb8], eax
inc ebx
or eax, 0xac9075ef
mov esi, 0xd394884b
mov eax, dword [ebp - 8]
test eax, eax
je 0x10004394
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
push edx
push ax
cmp dh, 0xe
cmp dh, 0xe
pop ax
pop edx
pop ecx
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1000441d
push edx
push ax
push bx
xor dh, 0x61
and dl, cl
inc edx
test cl, dh
test al, 0x79
xor al, bl
cmp dh, 0x50
or bx, ax
pop bx
pop ax
pop edx
mov word [ebp - 0x30], 0x7d8
mov word [ebp - 0x2e], 5
mov ax, 0xc
jbe 0x100043eb
push edi
pop edi
ja 0x100043eb
sbb ah, ch
cmp edi, esp
inc edi
pop ecx
inc eax
sub dword [ebx + 0x558bd04d], ecx
and al, 0x89
pcmpgtd mm1, qword [ecx + 0xa890447]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp + 0x24]
mov dword [edi], ecx
mov word [edi + 4], ax
mov dword [edx], ecx
mov word [edx + 4], ax
pushal
dec ax
cmp ebx, eax
cmp bx, 0x52e6
dec eax
xor bl, al
popal
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x14]
mov dword [eax], 0
mov dword [ecx], 2
jbe 0x10004433
push cx
mov cx, 0x36ba
pop cx
ja 0x10004433
fcom qword [edi + 0x50665251]
push ecx
push edx
push ax
cmp dh, 0xe
cmp dh, 0xe
pop ax
pop edx
pop ecx
mov eax, dword [ebp - 0x28]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret