Function at 0x10009550
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100377b6
push eax
mov eax, 0x1788
mov dword fs:[0], esp
call fcn.10024c40
push ebx
push esi
push edi
xor ebx, ebx
push 0x1770
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x28], 0x1770
mov dword [esp + 0x24], ebx
call fcn.10024010
mov ecx, dword [esp + 0x17b4]
mov edx, dword [ecx]
add esp, 0xc
push edx
lea ecx, [esp + 0x10]
call fcn.1000b730
mov eax, dword [esp + 0x17ac]
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x17a0], ebx
call fcn.1000b730
mov eax, dword [esp + 0xc]
mov byte [esp + 0x179c], 1
mov ecx, 0x1003bb32
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100095f1
cmp dl, bl
je 0x100095ed
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100095f1
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100095d1
xor eax, eax
jmp 0x100095f6
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [esp + 0x10]
xor edx, edx
cmp eax, ebx
sete dl
mov ecx, 0x1003bb33
mov eax, edi
mov esi, edx
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009630
cmp dl, bl
je 0x1000962c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009630
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009610
xor eax, eax
jmp 0x10009635
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
cmp esi, ebx
jne 0x100098f7
cmp eax, ebx
jne 0x100098f7
lea edx, [esp + 0x14]
push edx
call fcn.10013640
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
je 0x100096d0
mov ecx, dword [esp + 0x17b0]
xor eax, eax
mov word [ecx], ax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x179c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x1000969b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x179c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100096c6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x10009953
push ebp
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x10009790
mov ebp, 0x14
lea edi, [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009728
cmp dl, bl
je 0x10009724
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009728
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009708
xor eax, eax
jmp 0x1000972d
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
cmp eax, ebx
sete dl
mov ecx, 0x1003bb3a
mov eax, edi
mov esi, edx
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009760
cmp dl, bl
je 0x1000975c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009760
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009740
xor eax, eax
jmp 0x10009765
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
cmp esi, ebx
jne 0x10009796
cmp eax, ebx
jne 0x10009796
mov eax, dword [esp + 0x1c]
inc eax
add edi, 0x12c
cmp eax, 0x14
mov dword [esp + 0x1c], eax
jl 0x10009702
jmp 0x10009796
xor ebp, ebp
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
xor eax, eax
lea edx, [ecx + 1]
cmp edx, ebp
setge al
pop ebp
cmp eax, ebx
je 0x1000984d
imul ecx, ecx, 0x12c
lea esi, [esp + ecx + 0x24]
mov edx, 0x1003bb3b
mov ecx, esi
mov edi, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100097e0
cmp al, bl
je 0x100097dc
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100097e0
add ecx, 2
add edx, 2
cmp al, bl
jne 0x100097c0
xor eax, eax
jmp 0x100097e5
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, esi
mov edi, ecx
mov ecx, dword [esp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009814
cmp dl, bl
je 0x10009810
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009814
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x100097f4
xor eax, eax
jmp 0x10009819
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
cmp eax, ebx
setne dl
mov eax, edx
cmp edi, ebx
je 0x1000984d
cmp eax, ebx
je 0x1000984d
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x17b0]
xor eax, eax
push edx
mov word [ecx], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
jmp 0x10009906
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
imul eax, eax, 0x12c
mov edi, dword [esp + 0x10]
push ecx
push 0x1003bef0
lea esi, [esp + eax + 0x2c]
push 0x32
push esi
call fcn.10023fef
push edi
push 0x1003bef0
push 0xfa
add esi, 0x32
push esi
call fcn.10023fef
mov eax, dword [esp + 0x34]
add esp, 0x20
push 0x1770
lea edx, [esp + 0x28]
push edx
push 3
push ebx
push str.hlpreg
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x17b0]
cmp eax, ebx
mov eax, dword [esp + 0x14]
push eax
je 0x100098e0
xor ecx, ecx
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x179c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x1000968f
mov ecx, 1
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
jmp 0x10009906
mov edx, dword [esp + 0x17b0]
xor ecx, ecx
mov word [edx], cx
lea eax, [edi - 0x10]
mov byte [esp + 0x179c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009926
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x179c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009951
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1794]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1794
ret 0x10