Function at 0x10008d30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64c
mov eax, dword [0x10029170]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, edx
mov dword [ebp - 0x634], ebx
mov esi, ecx
mov dword [ebp - 0x648], edi
mov dword [ebp - 0x638], esi
lea eax, [edi + 0x1c]
mov dword [ebp - 0x640], eax
cmp esi, 0x100018b0
jne 0x10008d7c
test byte [edi + 0x38], 0x80
je 0x10008fcf
cmp esi, 0x10001898
jne 0x10008d91
test dword [edi + 0x38], 0x100
je 0x10008fcf
mov eax, dword [eax]
test eax, eax
jne 0x10009360
push 0x402
lea eax, [ebp - 0x410]
push 0
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov edi, dword [edi + 0xc]
add esp, 0xc
mov ebx, dword [ebp - 0x634]
cmp esi, 0x100018b0
jne 0x10008fe4
lea ecx, [ebp - 0x610]
mov esi, 0x100019d0
mov eax, ecx
mov edx, 0x200
sub esi, eax
lea ebx, [ebx]
lea eax, [edx + 0x7ffffdfe]
test eax, eax
je 0x10008dfe
mov al, byte [ecx + esi]
test al, al
je 0x10008dfe
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10008de0
jmp 0x100142bd
test edx, edx
je 0x100142bd
lea eax, [ebp - 0x63c]
mov byte [ecx], 0
push eax
lea ecx, [ebp - 0x610]
call fcn.1000a320
test eax, eax
js 0x10008e6f
mov edx, dword [ebp - 0x63c]
lea eax, [ebp - 0x610]
mov ecx, 0x200
lea eax, [eax + edx]
sub ecx, edx
je 0x100142cf
add edx, 0x7ffffdfe
add edx, ecx
sub edi, eax
test edx, edx
je 0x10008e5e
mov bl, byte [edi + eax]
test bl, bl
je 0x10008e5e
mov byte [eax], bl
dec edx
inc eax
sub ecx, 1
jne 0x10008e45
jmp 0x100142c9
test ecx, ecx
je 0x100142c9
mov ebx, dword [ebp - 0x634]
mov byte [eax], 0
lea eax, [ebp - 0x63c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x610]
push eax
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000937c
mov esi, dword [ebp - 0x63c]
test esi, esi
je 0x1000937c
test ebx, ebx
jne 0x10009374
lea eax, [ebp - 0x634]
mov dword [ebp - 0x634], 0x400
push eax
lea eax, [ebp - 0x410]
push eax
lea eax, [ebp - 0x644]
push eax
push 0
push 0x10001a10
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
je 0x100092da
mov ebx, dword [ebp - 0x638]
cmp ebx, 0x100018b0
jne 0x10008f0c
lea eax, [ebp - 0x410]
mov edx, 0x10001a60
push eax
push 0x401
mov ecx, esi
call fcn.10009e10
test al, al
jne 0x10008f13
mov byte [ebp - 0x410], 0
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10008f23
sub esi, ecx
jne 0x10009091
cmp ebx, 0x10001898
jne 0x10008fcf
mov eax, dword [ebp - 0x648]
cmp dword [eax + 0x1c], 0
jne 0x10008fcf
test byte [eax + 0x38], 0x80
je 0x1000931b
mov edx, dword [eax + 0xc]
mov ecx, 0x100018b0
call fcn.10005e50
mov esi, eax
test esi, esi
je 0x1000931b
lea eax, [ebp - 0x410]
mov edx, 0x10001a10
push eax
push 0x401
mov ecx, esi
call fcn.10009e10
test al, al
jne 0x10008fad
lea eax, [ebp - 0x410]
mov edx, 0x10001a60
push eax
push 0x401
mov ecx, esi
call fcn.10009e10
neg al
sbb al, al
and byte [ebp - 0x410], al
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10008fc0
sub ecx, edx
je 0x1000931b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012ae0
mov esp, ebp
pop ebp
ret 8
cmp esi, 0x10001898
jne 0x10008fcf
lea ecx, [ebp - 0x610]
mov esi, 0x10001a20
mov eax, ecx
mov edx, 0x200
sub esi, eax
lea eax, [edx + 0x7ffffdfe]
test eax, eax
je 0x1000901e
mov al, byte [esi + ecx]
test al, al
je 0x1000901e
mov byte [ecx], al
inc ecx
sub edx, 1
jne 0x10009000
jmp 0x100142c3
test edx, edx
je 0x100142c3
lea eax, [ebp - 0x63c]
mov byte [ecx], 0
push eax
lea ecx, [ebp - 0x610]
call fcn.1000a320
test eax, eax
js 0x10008e6f
mov edx, dword [ebp - 0x63c]
lea eax, [ebp - 0x610]
mov ecx, 0x200
lea eax, [eax + edx]
sub ecx, edx
je 0x100142cf
add edx, 0x7ffffdfe
add edx, ecx
sub edi, eax
lea esp, [esp]
test edx, edx
je 0x10008e5e
mov bl, byte [edi + eax]
test bl, bl
je 0x10008e5e
mov byte [eax], bl
dec edx
inc eax
sub ecx, 1
jne 0x10009070
jmp 0x100142c9
mov edx, dword [ebp - 0x638]
cmp edx, 0x10001898
je 0x100142e7
mov eax, 0
add esi, 1
je 0x100090d7
lea ecx, [ecx]
mov cl, byte [ebp + eax - 0x410]
cmp cl, 0x20
je 0x10009210
cmp cl, 0x2c
je 0x10009210
cmp cl, 0x3b
je 0x10009210
inc eax
cmp eax, esi
jb 0x100090b0
cmp esi, 0x402
jae 0x10009387
xor ebx, ebx
mov byte [ebp + esi - 0x410], 0
mov dword [ebp - 0x63c], ebx
cmp byte [ebp - 0x410], bl
je 0x10008fcf
nop
cmp ebx, esi
jae 0x10008fcf
lea eax, [ebp - 0x620]
lea edi, [ebp - 0x410]
push eax
add edi, ebx
lea eax, [ebp - 0x634]
push eax
cmp edx, 0x100018b0
jne 0x10009228
push 1
push edi
call dword [sym.imp.ntdll.dll_RtlIpv4StringToAddressA]
test eax, eax
js 0x100091e3
mov eax, dword [ebp - 0x634]
cmp byte [eax], 0
jne 0x100091e3
mov ebx, dword [ebp - 0x638]
sub ebx, 0x100018b0
neg ebx
sbb ebx, ebx
and ebx, 0xc
add ebx, 0x10
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_GetProcessHeap]
mov ecx, eax
test ecx, ecx
je 0x10014385
lea eax, [ebx + 0x18]
push eax
push 0
push ecx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapAlloc]
mov dword [ebp - 0x644], eax
test eax, eax
je 0x1001437d
lea ecx, [ebx + 0x18]
push ecx
push 0
push eax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
mov edx, dword [ebp - 0x644]
add esp, 0xc
cmp dword [ebp - 0x638], 0x100018b0
lea ecx, [edx + 0x18]
mov dword [edx], 0x18
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ebx
jne 0x10009234
mov eax, 2
mov word [ecx], ax
mov eax, dword [ebp - 0x620]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x640]
mov ebx, dword [ebp - 0x63c]
mov dword [eax], edx
lea eax, [edx + 8]
mov dword [ebp - 0x640], eax
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x100091e6
sub edi, ecx
inc ebx
add ebx, edi
mov dword [ebp - 0x63c], ebx
cmp byte [ebp + ebx - 0x410], al
je 0x10008fcf
mov edx, dword [ebp - 0x638]
jmp 0x10009100
cmp eax, 0x402
jae 0x10009387
mov byte [ebp + eax - 0x410], 0
jmp 0x100090d2
push edi
call dword [sym.imp.ntdll.dll_RtlIpv6StringToAddressA]
jmp 0x10009133
mov eax, 0x17
mov word [ecx], ax
mov eax, dword [ebp - 0x620]
mov dword [ecx + 8], eax
mov eax, dword [ebp - 0x61c]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp - 0x618]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x614]
mov dword [ecx + 0x14], eax
lea ecx, [ebp - 0x620]
call fcn.10009e70
test al, al
jne 0x1001431d
mov eax, dword [ebp - 0x620]
cmp al, 0xff
je 0x10014329
mov ebx, ecx
test bl, 1
jne 0x10014334
mov bl, byte [ecx]
cmp bl, 0xfe
jne 0x100092a0
mov al, byte [ecx + 1]
and al, 0xc0
cmp al, 0x80
je 0x10014373
call fcn.10009e70
test al, al
jne 0x10014373
cmp bl, 0xfe
jne 0x10014369
mov al, byte [ecx + 1]
and al, 0xc0
cmp al, 0xc0
jne 0x10014369
mov eax, 5
mov ecx, dword [ebp - 0x648]
mov eax, dword [ecx + eax*4 + 0x4c]
mov dword [edx + 0x30], eax
jmp 0x100091cc
cmp dword [ebp - 0x644], 1
jne 0x10008ee2
mov eax, dword [ebp - 0x634]
cmp eax, 1
jb 0x10008ee2
lea ecx, [ebp - 0x410]
mov byte [ebp + eax - 0x410], 0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10009307
sub ecx, edx
je 0x10008ee2
jmp 0x100142d5
cmp byte [ebp + 8], 0
jne 0x10008fcf
push ecx
push 0x10001a88
push ecx
mov edx, 0x402
lea ecx, [ebp - 0x410]
call fcn.10005910
lea esi, [ebp - 0x410]
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10009345
mov edx, dword [ebp - 0x638]
sub esi, ecx
jmp 0x100090a3
lea ebx, [eax + 8]
mov eax, dword [ebx]
mov dword [ebp - 0x640], ebx
test eax, eax
jne 0x10009360
jmp 0x10008d9b
mov byte [ebx], 0
jmp 0x10008ead
mov ebx, dword [ebp - 0x638]
jmp 0x10008f32
call fcn.10012c2a
int3
dec ecx
jmp 0x10008e06
dec ecx
jmp 0x10009026
mov ebx, dword [ebp - 0x634]
dec eax
jmp 0x10008e6c
test ebx, ebx
je 0x100142dc
mov byte [ebx], 1
mov ebx, dword [ebp - 0x638]
jmp 0x10008f13
mov ebx, dword [ebp - 0x648]
add ebx, 0x1c
mov edi, dword [ebx]
mov ecx, edi
mov dword [ebx], 0
test edi, edi
je 0x10014312
mov edi, dword [edi + 8]
call fcn.1000bd1b
mov ecx, edi
test edi, edi
jne 0x100142fe
mov edx, dword [ebp - 0x638]
mov dword [ebp - 0x640], ebx
jmp 0x100090a3
mov dword [edx + 0x30], 0
jmp 0x100091cc
movzx eax, ah
and eax, 0xf
jmp 0x100092c8
mov dword [ebp - 0x630], eax
lea ecx, [ebp - 0x630]
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x628], eax
mov eax, dword [ebp - 0x614]
mov dword [ebp - 0x624], eax
jmp 0x1000928c
mov eax, 0xe
jmp 0x100092c8
mov eax, 2
jmp 0x100092c8
push 8
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetLastError]
mov eax, 8
jmp 0x10008fd1