Function at 0x10009700
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10035533
push eax
mov eax, 0x18ac
mov dword fs:[0], esp
call fcn.10022b00
mov eax, dword [esp + 0x18c0]
mov ecx, dword [eax]
push esi
push edi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x1770
xor esi, esi
call fcn.1000b480
mov eax, dword [esp + 8]
mov dword [esp + 0x18bc], esi
mov ecx, 0x100380de
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009773
test dl, dl
je 0x1000976c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009773
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009750
xor eax, eax
or edi, 0xffffffff
jmp 0x1000977c
sbb eax, eax
mov edi, 0xffffffff
sbb eax, edi
xor edx, edx
test eax, eax
sete dl
mov eax, edx
test eax, eax
je 0x100097ca
push str.0000
call fcn.10003900
mov ecx, dword [esp + 0x18d0]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x18bc], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x100097c3
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x10009941
lea ecx, [esp + 0xc]
push ecx
call fcn.10002540
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10009828
push 0x100383c8
call fcn.10003900
mov edx, dword [esp + 0x18d0]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x18bc], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x1000981e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
jmp 0x10009941
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10009896
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18cc]
push eax
mov dword [edx], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x18bc], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x1000988c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x10009941
mov eax, 0x1b4e81b5
mul dword [esp + 0x10]
push ebp
mov ebp, edx
shr ebp, 5
test ebp, ebp
jle 0x100098f6
lea edi, [esp + 0x148]
mov ecx, dword [esp + 0xc]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x100098d6
test dl, dl
je 0x100098d2
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x100098d6
add eax, 2
add ecx, 2
test dl, dl
jne 0x100098b6
xor eax, eax
jmp 0x100098db
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
jne 0x1000995a
inc esi
add edi, 0x12c
cmp esi, ebp
jl 0x100098b0
or edi, 0xffffffff
push 0x100383cc
call fcn.10003900
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18d4]
add esp, 4
push edx
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18c0], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x1000993b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x18b4]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18b8
ret 0xc
imul esi, esi, 0x12c
push 0x12b
lea edx, [esp + 0x21]
push 0
push edx
lea esi, [esp + esi + 0x154]
mov byte [esp + 0x28], 0
call fcn.10021df0
add esi, 0x32
push esi
push 0x100384b0
push str.__result__:___s_:__s__
lea eax, [esp + 0x34]
push 0x12c
push eax
call fcn.100226c5
lea ecx, [esp + 0x3c]
push ecx
call fcn.100225f3
push eax
call fcn.10003900
mov edx, dword [esp + 0x18f8]
mov dword [edx], eax
mov eax, dword [esp + 0x38]
add esp, 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18c0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x100099ec
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x10009940