Function at 0x8d0c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x924
mov byte [ebp - 0xc], 0
push 8
push 0
lea eax, [ebp - 8]
push eax
call fcn.008d5570
add esp, 0xc
mov dword [ebp - 8], 8
mov dword [ebp - 0x14], 0
mov byte [ebp - 0x18], 0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 8
lea edx, [ebp - 8]
push edx
push 0
push 0
push 0x41018
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_DeviceIoControl]
test eax, eax
je 0x8d0cca
mov cl, byte [ebp - 4]
mov byte [ebp - 0x18], cl
jmp 0x8d0cd1
xor eax, eax
jmp 0x8d0f03
movsx edx, byte [ebp - 0x18]
push edx
push 0x942cf4
lea ecx, [ebp - 0x624]
call fcn.008cfd80
mov ecx, eax
call fcn.008cfe30
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.008d54f5
add esp, 0xc
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x10]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x218]
push edx
push reloc.ijl15.dll_Ordinal_2
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8d0efb
mov dword [ebp - 0x41c], 0x200
lea eax, [ebp - 0x41c]
push eax
lea ecx, [ebp - 0x418]
push ecx
push 0
push 0
push 0x942d20
lea ecx, [ebp - 0x724]
call fcn.008cfd80
mov ecx, eax
call fcn.008cfe30
push eax
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x8d0ef1
lea eax, [ebp - 0x418]
push eax
push 0x942d2c
lea ecx, [ebp - 0x824]
call fcn.008cfd80
mov ecx, eax
call fcn.008cfe30
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.008d54f5
add esp, 0xc
mov dword [ebp - 0x420], 0
lea edx, [ebp - 0x420]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x218]
push eax
push reloc.ijl15.dll_Ordinal_2
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x8d0ef1
mov dword [ebp - 0x41c], 0x100
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x218]
push edx
push 0
push 0
push 0x942d58
lea ecx, [ebp - 0x924]
call fcn.008cfd80
mov ecx, eax
call fcn.008cfe30
push eax
mov eax, dword [ebp - 0x420]
push eax
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
test eax, eax
jne 0x8d0e37
mov byte [ebp - 0xc], 1
lea ecx, [ebp - 0x218]
push ecx
call fcn.008cf000
push eax
mov edx, dword [ebp + 0xc]
add edx, 0x381
push edx
call fcn.008d5d80
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x418]
push ecx
call fcn.008d0780
push 1
mov edx, dword [ebp + 0xc]
add edx, 0x381
push edx
call fcn.008cf090
test eax, eax
jne 0x8d0ee4
mov eax, dword [ebp + 0xc]
add eax, 0x481
push eax
lea ecx, [ebp - 0x524]
push ecx
call fcn.008d5d80
add esp, 8
push 0x2e
lea edx, [ebp - 0x524]
push edx
call fcn.008d5f00
add esp, 8
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 0
je 0x8d0ea1
mov eax, dword [ebp - 0x424]
mov byte [eax], 0
push 0x942d68
lea ecx, [ebp - 0x524]
push ecx
call fcn.008d5d90
add esp, 8
push 1
lea edx, [ebp - 0x524]
push edx
call fcn.008cf090
test eax, eax
je 0x8d0ee4
lea eax, [ebp - 0x524]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0x381
push ecx
call fcn.008d5d80
add esp, 8
mov byte [ebp - 0xc], 1
mov edx, dword [ebp - 0x420]
push edx
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
and eax, 0xff
mov esp, ebp
pop ebp
ret 8