Function at 0xba2744
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [ebp - 4]
mov dword [ebp - 0x44], ecx
xor edi, edi
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.api_ms_win_security_isolatedcontainer_l1_1_0.dll_IsProcessInIsolatedContainer]
test eax, eax
js 0xbdcac5
mov ebx, dword [ebp - 4]
neg ebx
sbb ebx, ebx
and ebx, 0x80000
call fcn.00b922ec
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x40000
mov dword [ebp - 0x40], eax
call fcn.00bbfc90
push edi
push edi
movzx eax, al
push edi
neg eax
push 0xb2dd7c
sbb eax, eax
push 0xb2dcd8
and eax, 0x4000
push reloc.SHCORE.dll_Ordinal_1
mov dword [ebp - 0x3c], eax
call dword [sym.imp.api_ms_win_shcore_registry_l1_1_0.dll_SHGetValueW]
neg eax
mov dword [ebp - 8], edi
sbb esi, esi
lea eax, [ebp - 8]
and esi, 0xffff8000
push eax
add esi, 0x8000
call dword [sym.imp.USERENV.dll_GetProfileType]
test eax, eax
je 0xbdcacf
test byte [ebp - 8], 1
mov dword [ebp - 0x10], 0x2000
jne 0xba27eb
mov dword [ebp - 0x10], edi
call fcn.00bbcce4
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x1000
mov dword [ebp - 0x38], eax
call fcn.00b9231a
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x800
mov dword [ebp - 0x34], eax
call fcn.00bbe70f
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x400
mov dword [ebp - 0x30], eax
call fcn.00bbfb29
movzx eax, al
neg eax
push 0x43
sbb eax, eax
and eax, 0x200
mov dword [ebp - 0x2c], eax
call dword [sym.imp.api_ms_win_ntuser_sysparams_l1_1_0.dll_GetSystemMetrics]
neg eax
sbb eax, eax
and eax, 0x100
mov dword [ebp - 0x28], eax
call fcn.00b8b956
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x40
mov dword [ebp - 0x24], eax
call fcn.00bbef00
neg eax
push 0x1d
sbb eax, eax
and eax, 0x10
mov dword [ebp - 0x20], eax
call dword [sym.imp.api_ms_win_shcore_sysinfo_l1_1_0.dll_IsOS]
neg eax
sbb eax, eax
and eax, 8
mov dword [ebp - 0x1c], eax
call fcn.00bbb577
movzx eax, al
mov edx, 0xb288f0
neg eax
sbb eax, eax
and eax, 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0xc]
push eax
push ecx
push 0xb2dcb8
mov ecx, reloc.SHCORE.dll_Ordinal_1
call fcn.00b819c7
test eax, eax
js 0xbdcb02
cmp dword [ebp - 0xc], edi
mov dword [ebp - 0xc], edi
je 0xbdcb02
lea eax, [ebp - 0x14]
mov edx, 0xb2dbc8
push eax
push ecx
push 0xb2dc34
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00b819c7
test eax, eax
js 0xba294c
cmp dword [ebp - 0x14], edi
je 0xba294c
or esi, ebx
mov ebx, dword [ebp - 0x44]
or esi, edi
or esi, dword [ebp - 0xc]
or esi, dword [ebp - 0x18]
or esi, dword [ebp - 0x1c]
or esi, dword [ebp - 0x20]
or esi, dword [ebp - 0x24]
or esi, dword [ebp - 0x28]
or esi, dword [ebp - 0x2c]
or esi, dword [ebp - 0x30]
or esi, dword [ebp - 0x34]
or esi, dword [ebp - 0x38]
or esi, dword [ebp - 0x10]
or esi, dword [ebp - 0x3c]
or esi, dword [ebp - 0x40]
or dword [ebx + 0x5c], esi
test byte [0xd0a5c4], 2
je 0xba2945
call fcn.00bbf8fa
movzx esi, al
neg esi
sbb esi, esi
and esi, 0x20000
call fcn.00bbf0f1
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x10000
or esi, eax
or dword [ebx + 0x5c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
inc edi
jmp 0xba28e3
mov ebx, edi
mov dword [ebp - 4], ebx
jmp 0xba276c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
test eax, eax
jle 0xbdcae3
movzx eax, ax
or eax, 0x80070000
test eax, eax
js 0xbdcaea
mov eax, 0x80004005
mov ecx, dword [ebp + 4]
mov edx, 0x278
push eax
push 0xb27854
call fcn.00b913f8
jmp 0xba27e8
mov dword [ebp - 0xc], 2
jmp 0xba28c1