Function at 0xf789762
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
cmp dword [0xf7ae760], 0
push ebx
push esi
push edi
push ebp
je 0xf789991
mov esi, dword [esp + 0x30]
mov eax, dword [esi]
mov dword [esp + 0x1c], eax
push eax
call fcn.0f726e61
mov ebx, eax
test ebx, ebx
jne 0xf78979b
mov eax, 0x8007000e
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x20
cmp dword [esp + 0x40], 0
je 0xf7897f3
cmp dword [esp + 0x3c], 0
je 0xf7897e9
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
mov dword [esp + 0x14], eax
lea edi, [esp + 0x14]
lea ecx, [esp + 0x18]
push edi
push dword [esp + 0x40]
push ecx
push dword [esp + 0x40]
push esi
push ebx
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [esp + 0x10], eax
test eax, eax
je 0xf7897f7
push ebx
call fcn.0f726e12
mov eax, dword [esp + 0x10]
jmp 0xf789791
mov dword [esp + 0x14], 0
jmp 0xf7897b3
xor edi, edi
jmp 0xf7897b7
push dword [esp + 0x1c]
push dword [esp + 0x30]
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0xf789820
push ebx
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789791
mov eax, dword [esp + 0x18]
cmp eax, 1
jb 0xf789833
cmp eax, 2
jbe 0xf78985f
cmp eax, 7
je 0xf78985f
cmp dword [esp + 0x40], 0
je 0xf789842
mov eax, dword [edi]
mov ecx, dword [esp + 0x40]
mov dword [ecx], eax
push ebx
call fcn.0f726e12
mov eax, dword [esp + 0x38]
test eax, eax
je 0xf789856
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
jmp 0xf789791
cmp dword [esp + 0x40], 0
je 0xf789842
push dword [esp + 0x14]
call fcn.0f726e61
mov ebp, eax
test ebp, ebp
jne 0xf789885
push ebx
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789791
cmp dword [esp + 0x3c], 0
je 0xf7898de
mov eax, dword [esp + 0x14]
mov edi, ebp
mov esi, dword [esp + 0x3c]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x40]
mov eax, dword [ecx]
shr eax, 1
push eax
push dword [esp + 0x40]
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0xf789979
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789791
mov eax, dword [esp + 0x1c]
push edi
push ebp
mov dword [esi], eax
push 0
push 0
push esi
push ebx
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [esp + 0x10], eax
test eax, eax
je 0xf789917
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
mov eax, dword [esp + 0x10]
jmp 0xf789791
mov eax, dword [esp + 0x14]
add eax, eax
push eax
call fcn.0f726e61
mov esi, eax
test esi, esi
jne 0xf78993f
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789791
push dword [esp + 0x14]
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0xf789973
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
push esi
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789791
push esi
call fcn.0f726e12
lea eax, [edi*2]
mov ecx, dword [esp + 0x40]
push ebp
mov dword [ecx], eax
call fcn.0f726e12
jmp 0xf789842
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
push dword [esp + 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0xf789791