Function at 0x7022a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [0x770b48]
push esi
lea eax, [ebp - 0x10]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call edi
mov edx, dword [ebp - 0x10]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x7022dc
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x770b48]
lea eax, [ebp - 0xc]
push eax
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x7025cd
mov eax, 4
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x81424c]
lea edx, [ebp - 4]
cmp eax, 0xf
push edx
lea eax, [ebp - 8]
push 0x83e820
push eax
push 0
push 0x79c1dc
push ecx
jne 0x70233b
call esi
test eax, eax
je 0x70233d
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
call esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x83e824
push eax
push 0
push 0x79c1d4
push ecx
call esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x83e828
push eax
push 0
push 0x79c1cc
push ecx
call esi
mov eax, dword [0x83e820]
test eax, eax
jne 0x702390
mov edx, dword [0x83e824]
mov eax, dword [0x83e828]
mov dword [0x79c038], edx
mov dword [0x79c03c], eax
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e82c
push edx
push 0
push 0x79c1c0
push eax
call esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e830
push edx
push 0
push 0x79c1b4
push eax
call esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e834
push edx
push 0
push 0x79c1ac
push eax
call esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e838
push edx
push 0
push 0x79c1a0
push eax
call esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x79c04c
push edx
push 0
push 0x76c76c
push eax
call esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x79c050
push edx
push 0
push 0x79c194
push eax
call esi
test eax, eax
je 0x702444
mov edi, 1
mov byte [0x839f19], 1
mov dword [0x79c050], edi
jmp 0x702467
cmp dword [0x79c050], 1
jne 0x70245b
mov edi, 1
mov byte [0x839f19], 1
jmp 0x702467
mov byte [0x839f19], 0
mov edi, 1
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e844
push edx
push 0
push 0x797118
push eax
call esi
test eax, eax
je 0x70248f
mov dword [0x83e844], 0
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e83c
push edx
push 0
push 0x797134
push eax
call esi
test eax, eax
je 0x7024b7
mov dword [0x83e83c], 2
mov eax, dword [0x83e83c]
sub eax, 0
je 0x7024da
dec eax
je 0x7024e0
mov dword [0x83eca4], 0
mov dword [0x83eca8], 0
jmp 0x7024e6
mov dword [0x83eca4], edi
mov dword [0x83eca8], edi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e840
push edx
push 0
push 0x797128
push eax
call esi
test eax, eax
je 0x70250e
mov dword [0x83e840], 2
mov eax, dword [0x83e840]
sub eax, 0
je 0x70252f
dec eax
je 0x702523
mov dword [0x79c040], edi
jmp 0x702539
mov dword [0x79c040], 2
jmp 0x702539
mov dword [0x79c040], 4
mov eax, dword [0x79c04c]
cmp eax, edi
je 0x70254c
test eax, eax
je 0x70254c
mov dword [0x79c04c], edi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e7f8
push edx
push 0
push 0x79c188
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x28
call esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e7d8
push edx
push 0
mov edi, 0x10
push 0x79c17c
push eax
mov dword [ebp - 8], 3
mov dword [ebp - 4], edi
call esi
mov eax, dword [ebp - 0xc]
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 8]
push 0x83e7e8
push edx
push 0
push 0x79c170
push eax
mov dword [ebp - 8], 3
mov dword [ebp - 4], edi
call esi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [0x770b48]
mov edx, dword [0x83e838]
lea eax, [ebp - 0xc]
mov dword [0x83ec9c], edx
push eax
push 1
push 0
push ecx
push reloc.ijl15.dll_Ordinal_2
call edi
test eax, eax
jne 0x7026c4
mov ecx, dword [ebp - 0xc]
mov eax, 4
lea edx, [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push edx
lea eax, [ebp - 8]
push 0x83e848
push eax
push 0
push 0x79c164
push ecx
call esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x83e84c
push eax
push 0
push 0x79c158
push ecx
call esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x83e850
push eax
push 0
push 0x79c148
push ecx
call esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x83e858
push eax
push 0
push 0x79c138
push ecx
call esi
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x83e854
push eax
push 0
push 0x79c128
push ecx
call esi
test eax, eax
je 0x702692
mov dword [0x83e854], 2
mov ecx, dword [ebp - 0xc]
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 8]
push 0x83e860
push eax
push 0
push 0x79c118
push ecx
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0x400
call esi
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x83e848]
pop edi
mov dword [0x769d34], eax
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret