Function at 0x10007da0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x804
mov eax, dword [0x10139d00]
xor eax, esp
mov dword [esp + 0x7fc], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
mov edi, ecx
push edi
call esi
push str.._...CerBerSystemLocked2019
mov ebx, eax
call esi
cmp ebx, eax
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
jle 0x10007dfa
push str.._...CerBerSystemLocked2019
push edi
call esi
push str.._...CerBerSystemLocked2019
mov ebp, eax
call esi
sub ebp, eax
lea eax, [edi + ebp*2]
push eax
call ebx
test eax, eax
jne 0x10007dfa
mov eax, str.._...CerBerSystemLocked2019
jmp 0x10007e68
push edi
call esi
push str..EnCiPhErEd
mov ebp, eax
call esi
cmp ebp, eax
jle 0x10007e2e
push str..EnCiPhErEd
push edi
call esi
push str..EnCiPhErEd
mov ebp, eax
call esi
sub ebp, eax
lea ecx, [edi + ebp*2]
push ecx
call ebx
test eax, eax
jne 0x10007e2e
mov eax, str..EnCiPhErEd
jmp 0x10007e68
push edi
call esi
push str..Ejei
mov ebp, eax
call esi
cmp ebp, eax
jle 0x10007efa
push str..Ejei
push edi
call esi
push str..Ejei
mov ebp, eax
call esi
sub ebp, eax
lea edx, [edi + ebp*2]
push edx
call ebx
test eax, eax
jne 0x10007efa
mov eax, str..Ejei
mov ecx, dword [0x101d3304]
cmp ecx, 1
jne 0x10007e7a
mov al, cl
jmp 0x10007efc
xor ebx, ebx
cmp ecx, ebx
je 0x10007efa
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x10]
push ecx
push 1
push ebx
push eax
push SysReAllocString
mov dword [0x101d3304], ebx
mov dword [esp + 0x24], ebx
call esi
test eax, eax
jne 0x10007efa
push 0x206
lea eax, [esp + 0x3fe]
xor edx, edx
push ebx
push eax
mov word [esp + 0x404], dx
call fcn.100d4cc0
mov eax, dword [esp + 0x1c]
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x3fc]
push edx
push ebx
push ebx
push 0x101226e4
push eax
mov dword [esp + 0x2c], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10007f15
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.100d0738
add esp, 0x804
ret
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
push 0x206
lea ecx, [esp + 0x606]
xor eax, eax
push ebx
push ecx
mov dword [esp + 0x1c], ebx
mov word [esp + 0x60c], ax
call fcn.100d4cc0
lea edx, [esp + 0x404]
push edx
lea eax, [esp + 0x610]
push str._ws_shellopencommand
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x208
lea ecx, [esp + 0x414]
push ebx
push ecx
call fcn.100d4cc0
add esp, 0x24
lea edx, [esp + 0x10]
push edx
push 1
push ebx
lea eax, [esp + 0x60c]
push eax
push SysReAllocString
call esi
test eax, eax
jne 0x10007efa
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x3fc]
push edx
push ebx
push ebx
push 0x10128b0a
push eax
mov dword [esp + 0x2c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10007fca
mov ecx, dword [esp + 0x10]
push ecx
call edi
jmp 0x10007efa
lea edx, [esp + 0x3f8]
push edx
lea esi, [esp + 0x1c]
call fcn.1000e080
mov eax, esi
push eax
call fcn.1000e520
call fcn.10007c20
test al, al
je 0x10007ff8
mov dword [0x101d3304], 1
mov bl, 1
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov al, bl
jmp 0x10007efc