Function at 0x10009580
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10037746
push eax
mov eax, 0x1788
mov dword fs:[0], esp
call fcn.10024bc0
push ebx
push esi
push edi
xor ebx, ebx
push 0x1770
lea eax, [esp + 0x28]
push ebx
push eax
mov dword [esp + 0x28], 0x1770
mov dword [esp + 0x24], ebx
call fcn.10023f90
mov ecx, dword [esp + 0x17b4]
mov edx, dword [ecx]
add esp, 0xc
push edx
lea ecx, [esp + 0x10]
call fcn.1000b730
mov eax, dword [esp + 0x17ac]
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x14]
mov dword [esp + 0x17a0], ebx
call fcn.1000b730
mov eax, dword [esp + 0xc]
mov byte [esp + 0x179c], 1
mov ecx, 0x1003bb32
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009621
cmp dl, bl
je 0x1000961d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009621
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009601
xor eax, eax
jmp 0x10009626
sbb eax, eax
sbb eax, 0xffffffff
mov edi, dword [esp + 0x10]
xor edx, edx
cmp eax, ebx
sete dl
mov ecx, 0x1003bb33
mov eax, edi
mov esi, edx
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009660
cmp dl, bl
je 0x1000965c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009660
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009640
xor eax, eax
jmp 0x10009665
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
cmp esi, ebx
jne 0x10009927
cmp eax, ebx
jne 0x10009927
lea edx, [esp + 0x14]
push edx
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
je 0x10009700
mov ecx, dword [esp + 0x17b0]
xor eax, eax
mov word [ecx], ax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x179c], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x100096cb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x179c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100096f6
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x10009983
push ebp
lea ecx, [esp + 0x20]
push ecx
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x2c]
push eax
push ebx
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x100097c0
mov ebp, 0x14
lea edi, [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009758
cmp dl, bl
je 0x10009754
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009758
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009738
xor eax, eax
jmp 0x1000975d
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
cmp eax, ebx
sete dl
mov ecx, 0x1003bb3a
mov eax, edi
mov esi, edx
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009790
cmp dl, bl
je 0x1000978c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009790
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009770
xor eax, eax
jmp 0x10009795
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
cmp esi, ebx
jne 0x100097c6
cmp eax, ebx
jne 0x100097c6
mov eax, dword [esp + 0x1c]
inc eax
add edi, 0x12c
cmp eax, 0x14
mov dword [esp + 0x1c], eax
jl 0x10009732
jmp 0x100097c6
xor ebp, ebp
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x1c]
xor eax, eax
lea edx, [ecx + 1]
cmp edx, ebp
setge al
pop ebp
cmp eax, ebx
je 0x1000987d
imul ecx, ecx, 0x12c
lea esi, [esp + ecx + 0x24]
mov edx, 0x1003bb3b
mov ecx, esi
mov edi, edi
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009810
cmp al, bl
je 0x1000980c
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009810
add ecx, 2
add edx, 2
cmp al, bl
jne 0x100097f0
xor eax, eax
jmp 0x10009815
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
cmp eax, ebx
setne cl
mov eax, esi
mov edi, ecx
mov ecx, dword [esp + 0xc]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009844
cmp dl, bl
je 0x10009840
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009844
add eax, 2
add ecx, 2
cmp dl, bl
jne 0x10009824
xor eax, eax
jmp 0x10009849
sbb eax, eax
sbb eax, 0xffffffff
xor edx, edx
cmp eax, ebx
setne dl
mov eax, edx
cmp edi, ebx
je 0x1000987d
cmp eax, ebx
je 0x1000987d
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x17b0]
xor eax, eax
push edx
mov word [ecx], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
jmp 0x10009936
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
imul eax, eax, 0x12c
mov edi, dword [esp + 0x10]
push ecx
push 0x1003bef0
lea esi, [esp + eax + 0x2c]
push 0x32
push esi
call fcn.10023f6f
push edi
push 0x1003bef0
push 0xfa
add esi, 0x32
push esi
call fcn.10023f6f
mov eax, dword [esp + 0x34]
add esp, 0x20
push 0x1770
lea edx, [esp + 0x28]
push edx
push 3
push ebx
push str.hlpreg
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0x17b0]
cmp eax, ebx
mov eax, dword [esp + 0x14]
push eax
je 0x10009910
xor ecx, ecx
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x179c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x100096bf
mov ecx, 1
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
jmp 0x10009936
mov edx, dword [esp + 0x17b0]
xor ecx, ecx
mov word [edx], cx
lea eax, [edi - 0x10]
mov byte [esp + 0x179c], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009956
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x179c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009981
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x1794]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1794
ret 0x10