Function at 0xbed9f3
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov eax, edx
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], ecx
mov ebx, ecx
mov dword [ebp - 4], ecx
mov esi, ecx
push edi
mov edi, ecx
test eax, eax
je 0xbedb61
cmp word [eax], cx
je 0xbedb61
push 0xa1dca0
push eax
call fcn.00ab4bb4
pop ecx
pop ecx
test eax, eax
jne 0xbeda43
push edi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
jmp 0xbeda61
mov edx, dword [ebp - 0x10]
lea ecx, [ebp - 8]
call fcn.00a323fd
test eax, eax
js 0xbedac3
push dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push edi
push 1
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_ZwQueryValueKey]
test eax, eax
jns 0xbeda90
cmp eax, 0x80000005
je 0xbeda90
cmp eax, 0xc0000023
je 0xbeda90
xor esi, esi
inc esi
jmp 0xbedcb9
mov eax, dword fs:[0x30]
push dword [ebp - 4]
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0xbedaca
push 0xa1dccc
push 0x3c8
push 0xa1dce8
push 1
call fcn.00a32ac8
add esp, 0x10
xor edi, edi
jmp 0xbedcb9
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x18]
push edi
push 1
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ntdll.dll_ZwQueryValueKey]
test eax, eax
jns 0xbedb00
push 0xa1dd08
push 0x3d3
push 0xa1dce8
push 1
call fcn.00a32ac8
add esp, 0x10
jmp 0xbedb6d
mov eax, dword [edi + 4]
cmp dword [ebp + 8], ebx
jne 0xbedb14
mov eax, dword [ebp + 0x24]
xor ecx, ecx
inc ecx
mov esi, ecx
mov dword [eax], ecx
jmp 0xbedb6d
cmp eax, dword [ebp + 8]
jne 0xbedb6a
mov ecx, dword [edi + 8]
add ecx, edi
mov dword [ebp - 0xc], ecx
test eax, eax
je 0xbedc93
cmp eax, 2
jbe 0xbedc46
cmp eax, 3
je 0xbedc26
cmp eax, 4
je 0xbedc1c
cmp eax, 7
je 0xbedb8d
cmp eax, 0xb
jne 0xbedc93
mov eax, dword [ebp + 0x14]
cmp eax, dword [ecx]
jne 0xbedb6a
mov eax, dword [ebp + 0x18]
cmp eax, dword [ecx + 4]
jne 0xbedb6a
mov eax, dword [ebp + 0x24]
mov dword [eax], 1
xor esi, esi
inc esi
test edi, edi
je 0xbedca2
mov eax, dword fs:[0x30]
push edi
xor edi, edi
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0xbedca4
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x18]
mov eax, dword [edi + 0xc]
add eax, 2
push eax
push 8
push ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0xbedbbb
push 0xa1dccc
push 0x40f
jmp 0xbedaef
push dword [edi + 0xc]
push dword [ebp - 0xc]
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov eax, dword [edi + 0xc]
xor ecx, ecx
shr eax, 1
add esp, 0xc
mov word [ebx + eax*2], cx
mov ecx, ebx
mov eax, dword [edi + 0xc]
and eax, 0xfffffffe
add eax, ebx
cmp ebx, eax
jae 0xbedc05
xor edx, edx
cmp word [ecx], dx
jne 0xbedbf6
cmp word [ecx + 2], dx
je 0xbedc05
push 0x3b
pop eax
mov word [ecx], ax
mov eax, dword [edi + 0xc]
add ecx, 2
and eax, 0xfffffffe
add eax, ebx
cmp ecx, eax
jb 0xbedbe5
mov ecx, dword [ebp + 0xc]
mov edx, ebx
call fcn.00a31f47
test eax, eax
jne 0xbedb61
jmp 0xbedb6a
mov eax, dword [ebp + 0x10]
cmp eax, dword [ecx]
jmp 0xbedb5f
mov eax, dword [ebp + 0x20]
cmp eax, dword [edi + 0xc]
jne 0xbedb6a
push eax
push ecx
push dword [ebp + 0x1c]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
add esp, 0xc
test eax, eax
jmp 0xbedb5f
mov eax, dword fs:[0x30]
mov ecx, dword [eax + 0x18]
mov eax, dword [edi + 0xc]
add eax, 2
push eax
push 8
push ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0xbedc74
push 0xa1dccc
push 0x3f8
jmp 0xbedaef
push dword [edi + 0xc]
push dword [ebp - 0xc]
push ebx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov eax, dword [edi + 0xc]
add esp, 0xc
shr eax, 1
xor ecx, ecx
mov word [ebx + eax*2], cx
jmp 0xbedc05
push 0xa1dd20
push 0x45a
jmp 0xbedaef
xor edi, edi
test ebx, ebx
je 0xbedcb9
mov eax, dword fs:[0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 8], 0
je 0xbedcd3
push dword [ebp - 8]
mov ecx, dword fs:[0x30]
push edi
push dword [ecx + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x20