Function at 0x10009970
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100377cb
push eax
mov eax, 0x18ac
mov dword fs:[0], esp
call fcn.10024c40
mov eax, dword [esp + 0x18c0]
mov ecx, dword [eax]
push esi
push edi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x1770
xor esi, esi
call fcn.1000b730
mov eax, dword [esp + 8]
mov dword [esp + 0x18bc], esi
mov ecx, 0x1003bb51
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100099e3
test dl, dl
je 0x100099dc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100099e3
add eax, 2
add ecx, 2
test dl, dl
jne 0x100099c0
xor eax, eax
or edi, 0xffffffff
jmp 0x100099ec
sbb eax, eax
mov edi, 0xffffffff
sbb eax, edi
xor edx, edx
test eax, eax
sete dl
mov eax, edx
test eax, eax
je 0x10009a3a
push str.0000
call fcn.10003320
mov ecx, dword [esp + 0x18d0]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x18bc], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x10009a33
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x10009bb1
lea ecx, [esp + 0xc]
push ecx
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10009a98
push 0x1003be28
call fcn.10003320
mov edx, dword [esp + 0x18d0]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x18bc], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009a8e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
jmp 0x10009bb1
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10009b06
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18cc]
push eax
mov dword [edx], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x18bc], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009afc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x10009bb1
mov eax, 0x1b4e81b5
mul dword [esp + 0x10]
push ebp
mov ebp, edx
shr ebp, 5
test ebp, ebp
jle 0x10009b66
lea edi, [esp + 0x148]
mov ecx, dword [esp + 0xc]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009b46
test dl, dl
je 0x10009b42
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009b46
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009b26
xor eax, eax
jmp 0x10009b4b
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
jne 0x10009bca
inc esi
add edi, 0x12c
cmp esi, ebp
jl 0x10009b20
or edi, 0xffffffff
push 0x1003be2c
call fcn.10003320
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18d4]
add esp, 4
push edx
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18c0], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009bab
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x18b4]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18b8
ret 0xc
imul esi, esi, 0x12c
push 0x12b
lea edx, [esp + 0x21]
push 0
push edx
lea esi, [esp + esi + 0x154]
mov byte [esp + 0x28], 0
call fcn.10024010
add esi, 0x32
push esi
push 0x1003bf10
push str.__result__:___s_:__s__
lea eax, [esp + 0x34]
push 0x12c
push eax
call fcn.10023fef
lea ecx, [esp + 0x3c]
push ecx
call fcn.10025171
push eax
call fcn.10003320
mov edx, dword [esp + 0x18f8]
mov dword [edx], eax
mov eax, dword [esp + 0x38]
add esp, 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18c0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009c5c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x10009bb0