Function at 0xbf1522
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ebp + 0xc]
mov dword [ebp - 0x2dc], eax
lea edi, [ebp - 0x2bc]
xor eax, eax
movsd dword es:[edi], dword [esi]
push 0x27
mov word [ebp - 0x54], ax
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push edi
push eax
lea eax, [ebp - 0x2bc]
xor esi, esi
and dword [ebp - 0x2c4], esi
push eax
mov dword [ebp - 0x2c8], esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
cmp eax, edi
je 0xbf1591
mov ebx, 0x8000ffff
jmp 0xbf184e
and dword [ebp - 0x2c0], esi
lea eax, [ebp - 0x2c0]
push eax
mov edx, edi
lea ecx, [ebp - 0xa4]
call fcn.00a504bc
mov ebx, eax
test ebx, ebx
js 0xbf184e
mov eax, dword [ebp - 0x2c0]
add eax, 0xfffffffe
cmp eax, 0x24
ja 0xbf1610
lea eax, [ebp - 0xa2]
mov edx, edi
push eax
lea ecx, [ebp - 0x54]
call fcn.00a535e0
mov ebx, eax
test ebx, ebx
js 0xbf184e
lea eax, [ebp - 0x2c0]
mov edx, edi
push eax
lea ecx, [ebp - 0x54]
call fcn.00a504bc
mov ebx, eax
test ebx, ebx
js 0xbf184e
mov ecx, dword [ebp - 0x2c0]
lea eax, [ecx - 2]
cmp eax, 0x24
ja 0xbf1587
xor eax, eax
mov word [ebp + ecx*2 - 0x56], ax
jmp 0xbf1615
mov ebx, 0x8000ffff
test ebx, ebx
js 0xbf184e
push 0x104
lea eax, [ebp - 0x2ac]
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x2c4]
push eax
push 0x20019
lea edx, [ebp - 0x54]
call fcn.00bf1e41
mov ebx, eax
test ebx, ebx
js 0xbf184e
mov edi, dword [ebp - 0x2c4]
lea eax, [ebp - 0x2d4]
push eax
xor ecx, ecx
mov dword [ebp - 0x2d4], 4
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2cc], ecx
push eax
push ecx
push 0x18
push 0x9f3a30
push ecx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
je 0xbf169c
jle 0xbf182f
movzx ebx, bx
or ebx, 0x80070000
jmp 0xbf182f
push 0xc96c04
push 0x708
call fcn.00ab4242
pop ecx
pop ecx
test eax, eax
je 0xbf16ba
mov ecx, eax
call fcn.00bf2cc8
jmp 0xbf16bc
xor eax, eax
test eax, eax
je 0xbf182a
mov edx, eax
lea ecx, [ebp - 0x2c8]
call fcn.00bf1319
mov esi, dword [ebp - 0x2c8]
test esi, esi
je 0xbf182a
lea eax, [ebp - 0x2bc]
mov ecx, esi
push eax
call fcn.00bf35bb
mov ebx, eax
test ebx, ebx
js 0xbf182f
mov eax, dword [ebp - 0x2cc]
xor ecx, ecx
mov dword [esi + 0x34], eax
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], ecx
push eax
push ecx
push 0x18
push 0x9f3a04
push ecx
push dword [ebp - 0x2c4]
mov dword [ebp - 0x2d8], 4
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
jne 0xbf1688
mov eax, dword [ebp - 0x2d0]
mov ecx, esi
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x2ac]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf3661
mov ebx, eax
test ebx, ebx
js 0xbf182f
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf33cb
mov ebx, eax
test ebx, ebx
js 0xbf182f
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf3529
mov ebx, eax
test ebx, ebx
js 0xbf182f
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf37bf
mov ebx, eax
test ebx, ebx
js 0xbf182f
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf36f3
mov ebx, eax
test ebx, ebx
js 0xbf182f
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf391b
mov ebx, eax
test ebx, ebx
js 0xbf182f
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf345d
mov ebx, eax
test ebx, ebx
js 0xbf182f
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00bf384f
mov ebx, eax
test ebx, ebx
js 0xbf182f
mov ecx, dword [ebp - 0x2dc]
mov eax, esi
xor esi, esi
mov dword [ecx], eax
jmp 0xbf182f
mov ebx, 0x8007000e
test edi, edi
je 0xbf183a
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0xbf184e
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xc99200]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret 0x14