Function at 0xf73928a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ecx, 0xffffffff
mov ebp, esp
sub esp, 0x18c
sub eax, eax
push ebx
push esi
push edi
mov edi, str.TypeLib
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x88]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xf7b3478
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x88]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.TypeLib
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, pe_nt_image_headers32
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
sub esi, eax
push 0xf7b3478
call edi
sub esi, eax
push esi
push str.TypeLib
call edi
mov esi, eax
push 0xf7b3478
call edi
add esi, eax
lea eax, [ebp + esi - 0x88]
mov ebx, dword [ebp + 8]
push eax
mov edi, 0xf7b3478
lea ecx, [ebx + 0x10]
push ecx
call fcn.0f73c4d0
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x88]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x10
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x88]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edi, 0xf7b3468
lea eax, [ecx + ebp - 0x89]
movzx ecx, word [ebx + 0xc]
push eax
push ecx
call dword [sym.imp.MSVCRT20.dll__ultoa]
add esp, 0xc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x88]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 0x10
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x88]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edi, 0xf7b3478
lea eax, [ecx + ebp - 0x89]
movzx ecx, word [ebx + 0xe]
push eax
push ecx
call dword [sym.imp.MSVCRT20.dll__ultoa]
add esp, 0xc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x88]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xf7b3424
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x88]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x88]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0xf74cb26
lea eax, [ebp - 8]
lea ecx, [ebp - 0x18c]
mov dword [ebp - 8], 0x104
push eax
mov esi, 1
push ecx
push str.win32
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0xf7394b4
push dword [ebx + 4]
lea ecx, [ebp - 0x18c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], esi
test eax, eax
je 0xf739479
mov eax, 1
jmp 0xf7394bf