Function at 0x7ddfd08b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x34
lea eax, [ebp - 0x90]
push esi
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
call sub.ntdll.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x14]
push esi
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x94]
push eax
push 0x7ddb364c
push 4
mov dword [ebp - 0x94], 0x7ddfd01c
call dword [sym.imp.ntdll.dll_RtlQueryRegistryValues]
mov eax, 0x7ddfd788
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd316
push dword [ebp - 0xc]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
call sub.ntdll.dll_atol
pop ecx
lea ecx, [ebp - 0x44]
call fcn.7ddfcd7d
test eax, eax
jne 0x7ddfd157
xor eax, eax
jmp 0x7ddfd6d0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], ebx
call fcn.7ddfcd67
mov eax, 0x7ddfd784
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd305
mov eax, edi
call fcn.7ddfcd67
mov eax, 0x7ddfd784
call fcn.7ddfcbf9
test eax, eax
jne 0x7ddfd1b7
mov eax, 0x7ddfd780
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd1b7
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
lea esi, [ebp - 0x15]
call fcn.7ddfce49
test eax, eax
je 0x7ddfd150
mov eax, edi
mov dword [ebp - 0x54], ebx
call fcn.7ddfcd67
xor esi, esi
mov eax, 0x7ddfd784
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd305
mov eax, edi
call fcn.7ddfcd67
mov eax, 0x7ddfd788
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd210
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
pop ecx
cmp eax, 5
je 0x7ddfd202
cmp eax, 6
je 0x7ddfd202
cmp eax, 7
je 0x7ddfd202
cmp eax, 8
jne 0x7ddfd150
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x50], ebx
call fcn.7ddfcd67
mov eax, 0x7ddfd784
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd305
mov eax, edi
call fcn.7ddfcd67
mov eax, 0x7ddfd77c
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd23f
mov byte [ebp - 1], bl
jmp 0x7ddfd26d
mov eax, 0x7ddfd788
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd278
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
dec eax
pop ecx
je 0x7ddfd269
dec eax
jne 0x7ddfd150
mov byte [ebp - 1], 2
jmp 0x7ddfd26d
mov byte [ebp - 1], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x3c], ebx
call fcn.7ddfcd67
mov eax, 0x7ddfd784
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd305
mov eax, edi
call fcn.7ddfcd67
mov eax, 0x7ddfd778
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd2be
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
jmp 0x7ddfd2ef
mov eax, 0x7ddfd774
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], esi
test eax, eax
je 0x7ddfd2f9
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 2], 2
mov byte [ebp - 3], 2
lea eax, [ebp - 0x14]
call fcn.7ddfcd67
jmp 0x7ddfd305
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
jne 0x7ddfd150
jmp 0x7ddfd5d7
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
je 0x7ddfd610
mov eax, 0x7ddfd76c
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd358
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
pop ecx
lea ecx, [ebp - 0x44]
call fcn.7ddfcd7d
test eax, eax
je 0x7ddfd150
mov dword [ebp - 0x40], 1
jmp 0x7ddfd5b7
mov eax, 0x7ddfd760
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd38a
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
lea esi, [ebp - 0x15]
call fcn.7ddfce49
test eax, eax
je 0x7ddfd150
mov dword [ebp - 0x54], 1
jmp 0x7ddfd5b7
mov eax, 0x7ddfd758
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd3cb
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
pop ecx
cmp eax, 5
je 0x7ddfd3bc
cmp eax, 6
je 0x7ddfd3bc
cmp eax, 7
je 0x7ddfd3bc
cmp eax, 8
jne 0x7ddfd150
mov byte [ebp - 0x16], al
mov dword [ebp - 0x50], 1
jmp 0x7ddfd5b7
mov eax, 0x7ddfd74c
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd3ec
mov byte [ebp - 1], 1
mov dword [ebp - 0x3c], 1
jmp 0x7ddfd5b7
mov eax, 0x7ddfd744
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd41c
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
dec eax
pop ecx
je 0x7ddfd416
dec eax
jne 0x7ddfd150
mov byte [ebp - 1], 2
jmp 0x7ddfd3e0
mov byte [ebp - 1], 0
jmp 0x7ddfd3e0
mov eax, 0x7ddfd73c
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd43b
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], eax
jmp 0x7ddfd5b7
mov eax, 0x7ddfd734
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd45b
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x5c], esi
jmp 0x7ddfd5b7
mov eax, 0x7ddfd72c
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd47a
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], eax
jmp 0x7ddfd5b7
mov eax, 0x7ddfd724
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd49a
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x38], esi
jmp 0x7ddfd5b7
mov eax, 0x7ddfd71c
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd4b9
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
jmp 0x7ddfd5b7
mov eax, 0x7ddfd710
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd4d9
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x34], esi
jmp 0x7ddfd5b7
mov eax, 0x7ddfd708
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd4f8
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x58], eax
jmp 0x7ddfd5b7
mov eax, 0x7ddfd6fc
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd518
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x58], esi
jmp 0x7ddfd5b7
mov eax, 0x7ddfd6f4
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd537
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], eax
jmp 0x7ddfd5b7
mov eax, 0x7ddfd6e8
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd554
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x30], esi
jmp 0x7ddfd5b7
mov eax, 0x7ddfd6e0
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd584
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea ebx, [ebp - 2]
call fcn.7ddfce8b
test eax, eax
je 0x7ddfd150
mov dword [ebp - 0x28], 1
jmp 0x7ddfd5b7
mov eax, 0x7ddfd6d8
lea edi, [ebp - 0x14]
call fcn.7ddfcbf9
test eax, eax
je 0x7ddfd150
mov ebx, dword [ebp - 8]
lea eax, [ebp - 3]
push eax
mov eax, dword [ebp - 0xc]
call fcn.7ddfcf38
test eax, eax
je 0x7ddfd150
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x14]
call fcn.7ddfcd67
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
je 0x7ddfd5ce
xor esi, esi
jmp 0x7ddfd322
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x40], 0
je 0x7ddfd5e2
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x44]
mov dword [eax + 4], ecx
jmp 0x7ddfd5e5
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [ebp - 0x50], esi
je 0x7ddfd5f2
mov cl, byte [ebp - 0x16]
mov byte [eax + 0x12], cl
cmp dword [ebp - 0x3c], esi
je 0x7ddfd5ff
mov cl, byte [ebp - 1]
mov byte [eax + 0x14], cl
jmp 0x7ddfd61a
cmp dword [ebp - 0x40], esi
je 0x7ddfd616
cmp dword [ebp - 0x44], 0x6e
jne 0x7ddfd616
mov byte [eax + 0x14], 2
jmp 0x7ddfd61a
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov byte [eax + 0x14], 0
xor esi, esi
cmp dword [ebp - 0x54], esi
je 0x7ddfd627
mov cl, byte [ebp - 0x15]
mov byte [eax + 0x13], cl
cmp dword [ebp - 0x24], esi
je 0x7ddfd641
cmp dword [ebp - 0x38], esi
je 0x7ddfd63a
or dword [eax + 8], 0x300
jmp 0x7ddfd641
and dword [eax + 8], 0xfffffcff
cmp dword [ebp - 0x1c], esi
je 0x7ddfd655
cmp dword [ebp - 0x30], esi
je 0x7ddfd651
or dword [eax + 8], 4
jmp 0x7ddfd655
and dword [eax + 8], 0xfffffffb
cmp dword [ebp - 0x20], esi
je 0x7ddfd669
cmp dword [ebp - 0x34], esi
je 0x7ddfd665
or dword [eax + 8], 8
jmp 0x7ddfd669
and dword [eax + 8], 0xfffffff7
cmp dword [ebp - 0x48], esi
je 0x7ddfd67d
cmp dword [ebp - 0x58], esi
je 0x7ddfd679
or dword [eax + 8], 0x40
jmp 0x7ddfd67d
and dword [eax + 8], 0xffffffbf
cmp dword [ebp - 0x28], esi
je 0x7ddfd692
movzx ecx, byte [ebp - 2]
shl ecx, 4
xor ecx, dword [eax + 8]
and ecx, 0x30
xor dword [eax + 8], ecx
cmp dword [ebp - 0x2c], esi
je 0x7ddfd6aa
movzx ecx, byte [ebp - 3]
shl ecx, 0xc
xor ecx, dword [eax + 8]
and ecx, 0x3000
xor dword [eax + 8], ecx
cmp dword [ebp - 0x4c], esi
je 0x7ddfd6ce
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
cmp dword [ebp - 0x5c], esi
je 0x7ddfd6cb
mov dword [eax + 0x10], 0xea60
jmp 0x7ddfd6ce
mov dword [eax + 0x10], esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8