Function at 0x7dd887bd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4bc
mov eax, dword [0x7de403ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x4a8], eax
xor eax, eax
mov word [ebp - 0x480], ax
push esi
push edi
lea edi, [ebp - 0x47e]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x414]
mov dword [ebp - 0x450], ecx
mov dword [ebp - 0x458], ecx
xor ecx, ecx
lea eax, [ebp - 0x414]
mov dword [ebp - 0x454], eax
mov eax, 0x208
mov word [ebp - 0x414], cx
mov word [ebp - 0x45c], cx
mov ecx, eax
mov word [ebp - 0x45a], cx
lea ecx, [ebp - 0x20c]
xor esi, esi
mov dword [ebp - 0x44c], eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x42c], ecx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x434], ecx
xor ecx, ecx
mov word [ebp - 0x436], ax
mov eax, dword fs:[0x18]
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x474], esi
mov word [ebp - 0x20c], cx
mov word [ebp - 0x438], cx
mov ecx, dword [eax + 0xf9c]
mov eax, dword [0x7de402f4]
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x4a4], ecx
mov dword [ebp - 0x470], eax
mov edi, 0xfffe
cmp ecx, esi
jne 0x7dd888bb
cmp eax, esi
jne 0x7dd88a36
lea eax, [ebp - 0x480]
push eax
call dword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
test eax, eax
jl 0x7dd88a9f
xor eax, eax
mov word [ebp - 0x438], ax
movzx eax, word [ebp - 0x480]
add eax, 2
cmp eax, edi
ja 0x7dd88a9f
cmp eax, dword [ebp - 0x428]
ja 0x7dda7573
movzx ecx, word [ebp - 0x480]
mov eax, dword [ebp - 0x430]
push ecx
movzx ecx, word [ebp - 0x438]
push dword [ebp - 0x47c]
shr ecx, 1
mov dword [ebp - 0x434], eax
lea eax, [eax + ecx*2]
push eax
call sub.ntdll.dll_memmove
mov eax, dword [ebp - 0x438]
mov ecx, dword [ebp - 0x480]
mov edx, dword [ebp - 0x434]
add eax, ecx
lea ecx, [eax + 2]
mov word [ebp - 0x438], ax
movzx eax, ax
shr eax, 1
mov word [ebp - 0x436], cx
xor ecx, ecx
mov word [edx + eax*2], cx
movzx eax, word [ebp - 0x438]
add eax, 0x5c
add esp, 0xc
cmp eax, edi
ja 0x7dd88a9f
cmp eax, dword [ebp - 0x428]
ja 0x7dda7587
movzx ecx, word [ebp - 0x438]
mov eax, dword [ebp - 0x430]
push 0x5a
shr ecx, 1
mov dword [ebp - 0x434], eax
lea eax, [eax + ecx*2]
push 0x7dd88b78
push eax
call sub.ntdll.dll_memmove
mov eax, dword [ebp - 0x438]
add word [ebp - 0x438], 0x5a
mov edx, dword [ebp - 0x434]
add eax, 0x5c
mov word [ebp - 0x436], ax
movzx eax, word [ebp - 0x438]
shr eax, 1
xor ecx, ecx
mov word [edx + eax*2], cx
lea eax, [ebp - 0x438]
add esp, 0xc
mov dword [ebp - 0x498], eax
lea eax, [ebp - 0x4a0]
push eax
push 8
lea eax, [ebp - 0x470]
push eax
mov dword [ebp - 0x4a0], 0x18
mov dword [ebp - 0x49c], esi
mov dword [ebp - 0x494], 0x40
mov dword [ebp - 0x490], esi
mov dword [ebp - 0x48c], esi
call ebx
cmp eax, esi
jl 0x7dda759b
cmp dword [ebp - 0x4a4], esi
jne 0x7dd88a36
push esi
push dword [ebp - 0x470]
push 0x7de402f4
call fcn.7dd7138c
test eax, eax
jne 0x7dda75b6
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x4a0]
push eax
push 0x101
lea eax, [ebp - 0x474]
push eax
mov dword [ebp - 0x4a0], 0x18
mov dword [ebp - 0x494], 0x40
mov dword [ebp - 0x498], 0x7dd88bd4
mov dword [ebp - 0x490], esi
mov dword [ebp - 0x48c], esi
call ebx
cmp eax, esi
jge 0x7dda75d2
xor ecx, ecx
cmp eax, 0xc0000034
sete cl
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x478], ecx
mov eax, dword [ebp - 0x470]
cmp eax, esi
je 0x7dd88ab5
cmp eax, dword [0x7de402f4]
jne 0x7dda76d0
cmp dword [ebp - 0x474], esi
jne 0x7dda76dc
mov edi, dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
lea eax, [ebp - 0x480]
push eax
call edi
mov ecx, dword [ebp - 0x454]
mov eax, dword [ebp - 0x450]
cmp ecx, esi
je 0x7dd88afa
cmp ecx, eax
jne 0x7dda76ed
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x454], eax
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 0x458], eax
cmp eax, esi
je 0x7dd88b09
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [ebp - 0x45c], ax
mov ax, word [ebp - 0x448]
mov word [ebp - 0x45a], ax
mov eax, dword [ebp - 0x430]
cmp eax, esi
je 0x7dd88b36
cmp eax, dword [ebp - 0x42c]
jne 0x7dda7707
mov eax, dword [ebp - 0x42c]
pop edi
cmp eax, esi
pop esi
pop ebx
je 0x7dd88b48
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x478]
xor ecx, ebp
call fcn.7dd71442
leave
ret 4
cmp eax, esi
jge 0x7dd888f7
jmp 0x7dd88a9f
cmp eax, esi
jl 0x7dd88a9f
jmp 0x7dd88974
push eax
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
jmp 0x7dd88b5c
push eax
lea eax, [ebp - 0x430]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
jmp 0x7dd88b69
xor ecx, ecx
cmp eax, 0xc0000034
sete cl
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x478], ecx
jmp 0x7dd88ab5
push dword [ebp - 0x470]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, dword [0x7de402f4]
mov dword [ebp - 0x470], eax
jmp 0x7dd88a36
push dword [ebp - 0x4a8]
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
xor eax, eax
mov word [ebp - 0x45c], ax
movzx eax, word [ebp - 0x488]
add eax, 2
cmp eax, edi
ja 0x7dd88a9f
cmp eax, dword [ebp - 0x44c]
jbe 0x7dda761f
push eax
lea eax, [ebp - 0x454]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlpEnsureBufferSize]
cmp eax, esi
jl 0x7dd88a9f
movzx ecx, word [ebp - 0x488]
mov eax, dword [ebp - 0x454]
push ecx
movzx ecx, word [ebp - 0x45c]
push dword [ebp - 0x484]
shr ecx, 1
mov dword [ebp - 0x458], eax
lea eax, [eax + ecx*2]
push eax
call sub.ntdll.dll_memmove
mov ecx, dword [ebp - 0x45c]
mov eax, dword [ebp - 0x488]
mov edx, dword [ebp - 0x458]
add eax, ecx
lea ecx, [eax + 2]
mov word [ebp - 0x45c], ax
movzx eax, ax
add esp, 0xc
mov word [ebp - 0x45a], cx
shr eax, 1
push esi
xor ecx, ecx
mov word [edx + eax*2], cx
push esi
lea eax, [ebp - 0x45c]
push eax
push esi
call dword [sym.imp.ntdll.dll_RtlNtPathNameToDosPathName]
test eax, eax
jl 0x7dd88a9f
lea eax, [ebp - 0x4b4]
push eax
push 0x10
lea eax, [ebp - 0x46c]
push eax
push 2
lea eax, [ebp - 0x45c]
push eax
push dword [ebp - 0x474]
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
sub eax, 0xc0000034
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x478], eax
jmp 0x7dd88a9f
push eax
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x7dd88ab5
push dword [ebp - 0x474]
call dword [sym.imp.ntdll.dll_NtClose]
jmp 0x7dd88ac1
lea eax, [ebp - 0x4b0]
push eax
mov dword [ebp - 0x4ac], ecx
call edi
mov eax, dword [ebp - 0x450]
jmp 0x7dd88ae8
mov dword [ebp - 0x4b8], eax
lea eax, [ebp - 0x4bc]
push eax
call edi
jmp 0x7dd88b36