Function at 0x9704c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
mov byte [ebp - 0x168], 0
cmp eax, ecx
je 0x97075
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ecx
je 0x9707e
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0x97087
mov byte [eax], cl
mov eax, dword [ebp + 0x18]
cmp eax, ecx
je 0x97090
mov byte [eax], cl
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x101
push ecx
mov ebx, 0xc8
push ebx
lea edi, [ebx + 0x1c]
push edi
push 0x2e
push 0xa06ac
mov esi, 0xa22f8
push esi
call fcn.00092544
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x971b8
call fcn.00096dc2
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 4], eax
push eax
jmp 0x9719b
test eax, eax
jne 0x9716e
cmp dword [ebp - 0x14], eax
jbe 0x9716e
cmp dword [ebp - 0xc], eax
jbe 0x9716e
cmp dword [ebp - 0x18], 1
jne 0x9716e
push ebx
push edi
push 9
push 0xa06a0
push esi
call fcn.00092544
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0009eed1
add esp, 0x1c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
jne 0x971d0
lea eax, [ebp - 0x3c]
push eax
call fcn.00096cad
pop ecx
test eax, eax
je 0x9715e
lea eax, [ebp - 0x3c]
push eax
call fcn.0009f1a5
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, 0x5e5e5e5e
cmp eax, ecx
je 0x971d0
push 0x100
push 0
push esi
call fcn.0009ee2a
add esp, 0xc
inc dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x970fb
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push 0
push esi
call fcn.0009ee2a
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push ebx
push edi
push 4
push 0xa069c
push esi
call fcn.00092544
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0009ee95
push 0x100
push 0
push esi
mov dword [ebp - 4], eax
call fcn.0009ee2a
add esp, 0x28
cmp dword [ebp - 4], 0
je 0x97227
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x97222
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0009ef00
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x971cb
cmp byte [ebp - 0x168], 0x22
jne 0x9725b
lea eax, [ebp - 0x167]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0009ef00
lea eax, [ebp - 0x168]
push 0x22
push eax
call fcn.0009ed23
add esp, 0x10
test eax, eax
je 0x9725b
mov byte [eax], 0
push ebx
push edi
push 5
push 0xa0694
push esi
call fcn.00092544
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0009ee95
push 0x100
xor ebx, ebx
push ebx
push esi
mov edi, eax
call fcn.0009ee2a
add esp, 0x28
cmp edi, ebx
jne 0x972b8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0x972aa
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0009ef00
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 0x10], ebx
sete al
inc eax
jmp 0x971cb
push dword [ebp + 8]
lea eax, [ebp - 0x168]
push eax
call fcn.0009ed77
pop ecx
pop ecx
test eax, eax
jne 0x972dd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x971cb
lea eax, [ebp - 0x168]
push 0x5c
push eax
mov byte [edi], bl
call fcn.0009ed23
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x97301
lea eax, [ebp - 0x168]
mov dword [ebp - 4], eax
jmp 0x97304
inc dword [ebp - 4]
push dword [ebp - 4]
call fcn.00096cad
pop ecx
test eax, eax
jne 0x97335
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0x9732d
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0009ef00
pop ecx
pop ecx
mov byte [edi], 0x2e
jmp 0x972aa
pop esi
pop esi
pop esi
pop esi
push 0x8b00007e
invalid