Function at 0xf886c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0xf8875
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0xf8b4a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.000143f0
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call fcn.0001bf50
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 4]
call fcn.0001442c
mov eax, dword [ebp - 0x24]
call fcn.00013fa8
test eax, eax
jg 0xf8902
lea edx, [ebp - 0x40]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x3c]
mov edx, 0xf8b64
call fcn.00013ff4
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 0x38]
call fcn.000145ac
mov eax, dword [ebp - 0x38]
mov edx, edi
call fcn.000f5a4c
jmp 0xf8a98
lea eax, [ebp - 0x28]
mov edx, 0x800
call fcn.000271f0
lea eax, [ebp - 0x2c]
mov edx, 0x800
call fcn.000271f0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push dword [ebp - 0x24]
push 0xf8b7c
push 0xf8b88
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00014068
mov eax, dword [ebp - 0x44]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0xf8a62
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov edx, 0x800
call fcn.00012c70
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x800
call fcn.00012c70
mov dword [ebp - 0x30], 0x800
mov dword [ebp - 0x18], 0x800
xor eax, eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
mov eax, dword [ebp - 0x28]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegEnumValueW
mov ebx, eax
test ebx, ebx
jne 0xf8a5f
mov eax, dword [ebp - 0x28]
call fcn.0001b94c
test eax, eax
jle 0xf8a5f
cmp dword [ebp - 0x34], 1
jne 0xf8a5f
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x28]
call fcn.00014548
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
call fcn.00014548
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x20]
call fcn.0001c9b0
mov eax, dword [ebp - 0x48]
push eax
push 0xf8ba4
push dword [ebp - 0x14]
push 0xf8ba4
lea eax, [ebp - 0x50]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0x50]
lea edx, [ebp - 0x4c]
call fcn.0001c9b0
mov eax, dword [ebp - 0x4c]
pop edx
call fcn.0001495c
mov esi, eax
test esi, esi
jle 0xf8a5b
mov eax, dword [ebp - 0x14]
call fcn.00014630
mov ecx, eax
add ecx, 2
lea eax, [ebp - 0x20]
mov edx, esi
call fcn.00014830
lea edx, [ebp - 0x20]
mov ecx, esi
mov eax, dword [ebp - 0x1c]
call fcn.000148c0
test esi, esi
jne 0xf89f4
inc dword [ebp - 0xc]
test ebx, ebx
je 0xf895e
cmp dword [ebp - 0x10], 0
je 0xf8a79
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x2c]
mov edx, 0x800
call fcn.00027218
lea eax, [ebp - 0x28]
mov edx, 0x800
call fcn.00027218
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x20]
call fcn.0001442c
lea eax, [ebp - 0x54]
mov ecx, dword [ebp - 8]
mov edx, 0xf8bac
call fcn.0001469c
mov eax, dword [ebp - 0x54]
mov edx, edi
call fcn.000f5704
push 0xf8bdc
push dword [ebp - 4]
push 0xf8be4
lea eax, [ebp - 0x58]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0x58]
mov edx, edi
call fcn.000f5704
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx]
lea eax, [ebp - 0x5c]
mov edx, 0xf8bdc
call fcn.0001469c
mov eax, dword [ebp - 0x5c]
mov edx, edi
call fcn.000f5704
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf8b51
lea eax, [ebp - 0x5c]
mov edx, 6
call fcn.00014408
lea eax, [ebp - 0x44]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0x38]
call fcn.000143f0
lea eax, [ebp - 0x24]
call fcn.00013d18
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x14]
call fcn.000143f0
ret