Function at 0x7dd71b94
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0xb4], ecx
mov ecx, dword [ebp + 0x14]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xa0], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xbc], esi
mov dword [ebp - 0xc0], ecx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], eax
cmp edi, ebx
je 0x7dd993ab
movzx edx, word [edi]
mov dword [ebp - 0xb0], edx
cmp dx, bx
je 0x7dd993ab
test dl, 1
jne 0x7dd993ab
cmp dword [edi + 4], ebx
je 0x7dd751a8
cmp esi, ebx
je 0x7dd993ab
cmp ecx, ebx
je 0x7dd993ab
cmp dword [ebp - 0xb4], ebx
je 0x7dd993ab
cmp esi, ebx
je 0x7dd71c48
cmp dword [ebp - 0xa0], ebx
je 0x7dd71dc2
cmp eax, 0x80000004
je 0x7dd9937d
cmp eax, 0x80000050
je 0x7dd9937d
cmp eax, 0x80000060
je 0x7dd9937d
movzx ecx, word [edi]
cmp cx, bx
jbe 0x7dd71c77
add ecx, 0xfffffffe
mov word [edi], cx
neg esi
sbb esi, esi
and esi, 2
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0x9c], ecx
test al, 2
jne 0x7dd8c4eb
lea eax, [ebp - 0xb8]
push eax
mov ebx, 0x90
push ebx
lea eax, [ebp - 0x94]
push eax
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
push edi
push dword [ebp - 0xa4]
call esi
cmp dword [ebp - 0xac], 0
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa8]
jne 0x7dd993b6
cmp dword [ebp - 0x98], 0x80000005
je 0x7dd74522
mov ebx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xac]
test ecx, ecx
jne 0x7ddb19c1
xor ecx, ecx
cmp dword [ebp - 0x98], ecx
jl 0x7dd71db1
cmp dword [ebp - 0xa0], ecx
je 0x7dd71d33
mov eax, dword [ebx + 8]
mov ecx, dword [ebp - 0xbc]
cmp dword [ecx], eax
jb 0x7dd761b8
push eax
lea eax, [ebx + 0xc]
push eax
push dword [ebp - 0xa0]
call sub.ntdll.dll_memmove
add esp, 0xc
xor ecx, ecx
cmp dword [ebp - 0x98], ecx
jl 0x7dd71db1
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb0], ecx
je 0x7ddb19e4
cmp eax, ecx
je 0x7dd71d58
mov edx, dword [ebx + 4]
mov dword [eax], edx
mov eax, dword [ebx + 8]
mov edx, dword [ebp - 0xbc]
mov dword [edx], eax
mov eax, dword [ebp - 0xc0]
cmp eax, ecx
je 0x7dd71d82
cmp dword [ebp - 0x98], ecx
jl 0x7dd71dad
cmp dword [ebp - 0xa0], ecx
je 0x7dd71dad
mov edx, dword [ebx + 8]
mov dword [eax], edx
lea eax, [ebp - 0x94]
cmp ebx, eax
jne 0x7dd745aa
push dword [ebp - 0x98]
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.7dd71442
leave
ret 0x18
mov dword [eax], ecx
jmp 0x7dd71d82
cmp dword [ebp - 0x98], 0x80000005
jne 0x7dd71d63
jmp 0x7dd71d3d
mov dword [esi], ebx
jmp 0x7dd71c48
xor ecx, ecx
cmp dword [ebp - 0xa0], ecx
je 0x7dd745c3
cmp dword [ebp - 0xb0], 2
jne 0x7dd71ce5
mov edx, dword [ebp - 0xbc]
mov edx, dword [edx]
cmp edx, dword [ebp - 0x8c]
jb 0x7dd71ce5
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x9c], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0xb8]
mov eax, dword [eax + 0x30]
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
je 0x7ddb19d4
lea eax, [ebp - 0xb8]
push eax
push dword [ebp - 0x9c]
push ebx
push 2
push edi
push dword [ebp - 0xa4]
call esi
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa8]
jmp 0x7dd71ceb
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
jmp 0x7dd71d90
mov dword [ebp - 0x98], ecx
jmp 0x7dd71ce5
cmp word [edi], 2
jne 0x7dd993c3
cmp word [edi + 2], bx
je 0x7dd71c38
jmp 0x7dd993c3
mov dword [ebp - 0x98], 0x80000005
jmp 0x7dd71d33
lea ecx, [ebp - 0xac]
push ecx
lea ecx, [ebp - 0xa8]
push ecx
push 0x2000000
push eax
push ebx
call fcn.7dd8c332
cmp eax, ebx
jl 0x7ddb1966
mov eax, dword [ebp - 0xac]
cmp eax, ebx
je 0x7dd71c98
jmp 0x7ddb196c
call sym.KERNEL32.dll_RegKrnGetGlobalState
mov eax, dword [eax + 0x3c]
cmp eax, ebx
je 0x7dd993c3
push dword [ebp - 0xc0]
push esi
push dword [ebp - 0xa0]
push dword [ebp - 0xb4]
push ebx
push edi
push dword [ebp - 0xc4]
call eax
jmp 0x7dd71d9c
cmp dword [edi + 4], ebx
je 0x7dd751a8
jmp 0x7dd993c3
test eax, eax
jne 0x7ddb1983
jmp 0x7dd71cd5
push 0x57
jmp 0x7ddb19f6
push eax
jmp 0x7dd71d96
cmp dword [ebp - 0xa8], ebx
je 0x7dd71c98
mov dword [ebp - 0xa4], eax
jmp 0x7dd71c98
cmp dword [ebp - 0xa4], eax
je 0x7dd71cd5
cmp dword [ebp - 0x98], 0xc0000034
jne 0x7dd71cd5
lea ecx, [ebp - 0xb8]
push ecx
push ebx
lea ecx, [ebp - 0x94]
push ecx
push dword [ebp - 0xb0]
mov dword [ebp - 0xa4], eax
push edi
push eax
jmp 0x7dd71cba
test eax, eax
je 0x7dd71cf9
cmp ecx, dword [ebp - 0xc4]
je 0x7ddb19d8
push ecx
jmp 0x7ddb19d9
push 0xe
jmp 0x7ddb19f6
push eax
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x7dd71cf9
cmp eax, ecx
je 0x7dd71d63
mov edx, dword [ebx + 4]
mov dword [eax], edx
jmp 0x7dd71d63
pop eax
jmp 0x7dd71d9c