Function at 0x7c879e94
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x7c8856cc]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
push esi
push edi
mov dword [ebp - 0x430], eax
jne 0x7c879ec0
push 0x57
jmp 0x7c87a153
mov eax, dword [ebp + 0xc]
test eax, 0xfffffffc
jne 0x7c87a14e
lea ecx, [eax - 1]
and ecx, eax
test cl, 3
jne 0x7c87a14e
and eax, 1
cmp dword [0x7c885038], ebx
mov dword [ebp - 0x434], eax
jne 0x7c879f3b
mov esi, 0x7c885360
push esi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x7c885038], ebx
jne 0x7c879f34
push 0x20019
push 0x7c81b180
push 0x7c81b118
push 0x7c885038
call fcn.7c81aec6
test eax, eax
je 0x7c879f34
push 0x3f1
call fcn.7c80935e
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
jmp 0x7c87a158
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov esi, dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
xor eax, eax
mov ecx, 0x85
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x440]
push eax
push 0x214
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push dword [0x7c885038]
mov dword [ebp - 0x428], ebx
call esi
mov ebx, 0x8000001a
jmp 0x7c87a13a
test eax, eax
jl 0x7c87a147
mov edi, dword [ebp - 0x208]
shr edi, 1
cmp edi, 2
ja 0x7c87a102
mov eax, dword [ebp - 0x204]
cmp ax, 0x30
jb 0x7c879fa9
cmp ax, 0x39
jbe 0x7c879fc0
or eax, 0x20
cmp ax, 0x61
jb 0x7c87a102
cmp ax, 0x66
ja 0x7c87a102
cmp dword [ebp - 0x434], 0
je 0x7c879fd6
cmp dword [ebp - 0x20c], 2
jbe 0x7c87a102
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x20c], 2
jbe 0x7c87a022
mov eax, dword [ebp - 0x210]
lea eax, [ebp + eax - 0x218]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x424]
push eax
push 0x10
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
test eax, eax
je 0x7c87a022
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x434], 0
je 0x7c87a038
cmp dword [ebp - 0x424], 1
jne 0x7c87a102
and word [ebp + edi*2 - 0x204], 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x42c]
push eax
push 0x10
lea eax, [ebp - 0x43c]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToInteger]
test eax, eax
jne 0x7c87a102
push 2
push 0x104
lea eax, [ebp - 0x420]
push eax
push 0
push dword [ebp - 0x42c]
call fcn.7c82de9a
test eax, eax
je 0x7c87a102
xor eax, eax
cmp dword [ebp + 0x14], eax
je 0x7c87a0c4
cmp dword [ebp - 0x424], 1
push dword [ebp + 0x10]
setne al
inc eax
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x42c]
call dword [ebp - 0x430]
jmp 0x7c87a0fd
cmp dword [ebp - 0x424], 1
push 3
push dword [ebp + 0x10]
setne al
inc eax
push eax
push dword [ebp - 0x42c]
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp + 0xc]
push dword [ebp - 0x430]
push dword [0x7c8853a8]
call fcn.7c838103
cmp eax, 1
jne 0x7c87a142
inc dword [ebp - 0x428]
xor eax, eax
mov ecx, 0x85
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x440]
push eax
push 0x214
lea eax, [ebp - 0x218]
push eax
push 1
push dword [ebp - 0x428]
push dword [0x7c885038]
call esi
cmp eax, ebx
jne 0x7c879f7e
xor eax, eax
inc eax
jmp 0x7c87a15a
push 0x3f1
jmp 0x7c87a153
push 0x3ec
call fcn.7c80935e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 0x10