Function at 0x100092e0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1003551e
push eax
mov eax, 0x1788
mov dword fs:[0], esp
call fcn.10022b00
push ebx
push esi
push edi
xor ebx, ebx
push 0x1770
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x28], 0x1770
mov dword [esp + 0x24], ebx
call fcn.10021df0
mov ecx, dword [esp + 0x17b4]
mov edx, dword [ecx]
add esp, 0xc
push edx
lea ecx, [esp + 0x10]
call fcn.1000b480
mov eax, dword [esp + 0x17ac]
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x17a0], ebx
call fcn.1000b480
mov eax, dword [esp + 0xc]
mov byte [esp + 0x179c], 1
mov ecx, 0x100380d1
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009381
cmp dl, bl
je 0x1000937d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009381
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009361
xor eax, eax
jmp 0x10009386
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [esp + 0x10]
xor edx, edx
cmp eax, ebx
sete dl
mov ecx, 0x100380d2
mov eax, edi
mov esi, edx
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100093c0
cmp dl, bl
je 0x100093bc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100093c0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100093a0
xor eax, eax
jmp 0x100093c5
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
cmp esi, ebx
jne 0x10009687
cmp eax, ebx
jne 0x10009687
lea edx, [esp + 0x14]
push edx
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
je 0x10009460
mov ecx, dword [esp + 0x17b0]
xor eax, eax
mov word [ecx], ax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x179c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000942b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x179c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009456
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x100096e3
push ebp
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x10009520
mov ebp, 0x14
lea edi, [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100094b8
cmp dl, bl
je 0x100094b4
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100094b8
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009498
xor eax, eax
jmp 0x100094bd
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
cmp eax, ebx
sete dl
mov ecx, 0x100380d3
mov eax, edi
mov esi, edx
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100094f0
cmp dl, bl
je 0x100094ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100094f0
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100094d0
xor eax, eax
jmp 0x100094f5
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
cmp esi, ebx
jne 0x10009526
cmp eax, ebx
jne 0x10009526
mov eax, dword [esp + 0x1c]
inc eax
add edi, 0x12c
cmp eax, 0x14
mov dword [esp + 0x1c], eax
jl 0x10009492
jmp 0x10009526
xor ebp, ebp
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
xor eax, eax
lea edx, [ecx + 1]
cmp edx, ebp
setge al
pop ebp
cmp eax, ebx
je 0x100095dd
imul ecx, ecx, 0x12c
lea esi, [esp + ecx + 0x24]
mov edx, 0x100380dd
mov ecx, esi
mov edi, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009570
cmp al, bl
je 0x1000956c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009570
add ecx, 2
add edx, 2
cmp al, bl
jne 0x10009550
xor eax, eax
jmp 0x10009575
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, esi
mov edi, ecx
mov ecx, dword [esp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100095a4
cmp dl, bl
je 0x100095a0
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100095a4
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009584
xor eax, eax
jmp 0x100095a9
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
cmp eax, ebx
setne dl
mov eax, edx
cmp edi, ebx
je 0x100095dd
cmp eax, ebx
je 0x100095dd
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x17b0]
xor eax, eax
push edx
mov word [ecx], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
jmp 0x10009696
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
imul eax, eax, 0x12c
mov edi, dword [esp + 0x10]
push ecx
push 0x10038490
lea esi, [esp + eax + 0x2c]
push 0x32
push esi
call fcn.100226c5
push edi
push 0x10038490
push 0xfa
add esi, 0x32
push esi
call fcn.100226c5
mov eax, dword [esp + 0x34]
add esp, 0x20
push 0x1770
lea edx, [esp + 0x28]
push edx
push 3
push ebx
push str.hlpreg
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x17b0]
cmp eax, ebx
mov eax, dword [esp + 0x14]
push eax
je 0x10009670
xor ecx, ecx
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x179c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x1000941f
mov ecx, 1
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
jmp 0x10009696
mov edx, dword [esp + 0x17b0]
xor ecx, ecx
mov word [edx], cx
lea eax, [edi - 0x10]
mov byte [esp + 0x179c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100096b6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x179c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100096e1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1794]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1794
ret 0x10