Function at 0xffbaf19
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0xffebc20]
push esi
push edi
lea ecx, [ebp - 0x808]
push ecx
lea ecx, [ebp - 0x804]
push ecx
lea ecx, [ebp - 0x80c]
push ecx
xor edi, edi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xffb2404
push eax
mov dword [ebp - 0x808], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xffbafe1
cmp dword [ebp - 0x80c], 1
jne 0xffbafe1
mov ecx, dword [ebp - 0x808]
call fcn.0ffbaeed
mov esi, eax
lea eax, [ebp - 0x804]
mov edx, esi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0xffbaf85
push esi
call dword [sym.imp.USER32.dll_CharLowerA]
cmp esi, edi
mov dword [0xffed0a0], esi
mov eax, esi
je 0xffbafe1
mov esi, 0xffed0a0
add esi, 4
cmp esi, 0xffed1a0
jge 0xffbafdb
push 0x20
push eax
call fcn.0ffc3337
cmp eax, edi
je 0xffbafe1
mov byte [eax], 0
inc eax
mov cl, byte [eax]
test cl, cl
je 0xffbafe1
cmp cl, 0x20
jne 0xffbafd3
inc eax
cmp byte [eax], 0x20
je 0xffbafcd
cmp eax, edi
mov dword [esi], eax
jne 0xffbafa7
jmp 0xffbafe1
mov dword [0xffed19c], edi
mov eax, dword [0xffed2b0]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xffbafe9
sub eax, edx
lea ecx, [eax + 0xd]
call fcn.0ffbaeed
mov ecx, dword [0xffed2b0]
mov dword [0xffed098], eax
mov dl, byte [ecx]
inc ecx
mov byte [eax], dl
inc eax
test dl, dl
jne 0xffbb005
mov eax, str.control.exe
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xffbb016
mov edi, dword [0xffed098]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xffbb026
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xffed2b0]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xffbb046
sub eax, ecx
lea ecx, [eax + 0xd]
call fcn.0ffbaeed
mov ecx, dword [0xffed2b0]
mov dword [0xffed090], eax
mov dl, byte [ecx]
inc ecx
mov byte [eax], dl
inc eax
test dl, dl
jne 0xffbb062
push ebx
mov ebx, str.progman.exe
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xffbb076
mov edi, dword [0xffed090]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xffbb086
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xffed2ac]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xffbb0a6
sub eax, ecx
lea ecx, [eax + 0xd]
call fcn.0ffbaeed
mov ecx, dword [0xffed2ac]
mov dword [0xffed094], eax
mov dl, byte [ecx]
inc ecx
mov byte [eax], dl
inc eax
test dl, dl
jne 0xffbb0c2
mov eax, str.control.exe
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xffbb0d3
mov edi, dword [0xffed094]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xffbb0e3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xffed2ac]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0xffbb103
sub eax, ecx
lea ecx, [eax + 0xd]
call fcn.0ffbaeed
mov ecx, dword [0xffed2ac]
mov dword [0xffed08c], eax
mov dl, byte [ecx]
inc ecx
mov byte [eax], dl
inc eax
test dl, dl
jne 0xffbb11f
mov eax, ebx
mov edx, ebx
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0xffbb12e
mov edi, dword [0xffed08c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0xffbb13e
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0xffed2ac]
lea ecx, [ebp - 0x804]
sub ecx, eax
mov dl, byte [eax]
mov byte [ecx + eax], dl
inc eax
test dl, dl
jne 0xffbb163
lea edi, [ebp - 0x804]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0xffbb174
mov esi, 0xffb23f4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x804]
push eax
movsb byte es:[edi], byte [esi]
call fcn.0ffb48aa
cmp eax, 0xffffffff
pop edi
pop esi
je 0xffbb1ac
test al, 1
jne 0xffbb1ac
or eax, 1
push eax
lea eax, [ebp - 0x804]
push eax
call fcn.0ffbb1bd
mov ecx, dword [ebp - 4]
call fcn.0ffe11f0
leave
ret 4