Function at 0x1007965
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1009364]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push 0x1f
pop edx
xor ebx, ebx
mov byte [ebp - 0x84], bl
mov ecx, edx
lea edi, [ebp - 0x83]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x104], bl
mov ecx, edx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x204], bl
mov ecx, edx
lea edi, [ebp - 0x203]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or dword [ebp - 0x20c], 0xffffffff
or dword [ebp - 0x22c], 0xffffffff
stosb byte es:[edi], al
xor eax, eax
mov byte [ebp - 0x184], bl
mov ecx, edx
lea edi, [ebp - 0x183]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x224]
push eax
push 0xf003f
push ebx
push str.SystemCurrentControlSetEnumPCI
push 0x80000002
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x230], ebx
call esi
test eax, eax
je 0x1007a1f
or eax, 0xffffffff
jmp 0x1007c3d
mov edi, 0x80
push edi
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 0x228], 1
push ebx
jmp 0x1007c17
lea eax, [ebp - 0x84]
push eax
push str.SystemCurrentControlSetEnumPCI
lea eax, [ebp - 0x104]
push 0x1001fa4
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x218]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x104]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x1007c2b
push edi
lea eax, [ebp - 0x84]
push eax
mov dword [ebp - 0x21c], 1
push ebx
jmp 0x1007bd9
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x204]
push 0x1001fa4
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x204]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x1007bc4
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x184]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x1002464
push dword [ebp - 0x210]
mov dword [ebp - 0x214], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1007baf
lea eax, [ebp - 0x184]
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
call fcn.010071b8
mov byte [ebp - 0x206], al
lea eax, [ebp - 0x220]
push eax
call fcn.010071b8
mov byte [ebp - 0x205], al
lea eax, [ebp - 0x220]
push eax
call fcn.010071b8
mov dl, byte [ebp - 0x206]
mov ecx, dword [ebp + 8]
cmp dl, byte [ecx]
jne 0x1007baf
mov dl, byte [ebp - 0x205]
cmp dl, byte [ecx + 1]
jne 0x1007baf
cmp al, byte [ecx + 2]
jne 0x1007baf
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
push ebx
push 0x1002458
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
not eax
and eax, dword [ebp - 0x22c]
mov dword [ebp - 0x20c], eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x1007bed
mov eax, dword [ebp - 0x21c]
inc dword [ebp - 0x21c]
push edi
lea ecx, [ebp - 0x84]
push ecx
push eax
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1007a98
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], 0xffffffff
jne 0x1007c2b
mov eax, dword [ebp - 0x228]
inc dword [ebp - 0x228]
push edi
lea ecx, [ebp - 0x84]
push ecx
push eax
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1007a3c
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x20c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01007f42
leave
ret 4