Function at 0x9161a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x954
mov eax, dword [0xb196ec]
xor eax, esp
mov dword [esp + 0x94c], eax
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push 0x207
lea eax, [esp + 0x755]
mov esi, ecx
push ebx
push eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x75c], bl
call fcn.00a7ffb0
add esp, 0xc
push 0x207
lea ecx, [esp + 0x23d]
push ebx
push ecx
mov byte [esp + 0x244], bl
call fcn.00a7ffb0
add esp, 0xc
push str.BackupSpacePath
lea eax, [esp + 0x28]
lea edi, [esp + 0x23c]
mov ecx, str.SoftwareMicroWorldeScan_For_WindowsBackup
mov edx, 0x80000002
mov dword [esp + 0x28], 0x208
call fcn.0094c020
mov al, byte [esp + 0x238]
cmp al, bl
je 0x9162bb
cmp byte [esp + 0x239], 0x3a
jne 0x9162bb
movsx edx, al
push edx
lea eax, [esp + 0x444]
push str._c:_
push eax
call fcn.00a78f30
add esp, 0xc
lea eax, [esp + 0x440]
call fcn.00966890
cmp eax, 3
jne 0x9162bb
lea ecx, [esp + 0x23f]
push 0x5c
push ecx
call fcn.00a7a2c0
add esp, 8
cmp eax, ebx
je 0x916284
mov byte [eax], bl
lea ecx, [esp + 0x238]
call fcn.0095a450
test eax, eax
je 0x9162bb
push ebx
lea ecx, [esp + 0x23c]
call fcn.00963d90
add esp, 4
test eax, eax
jne 0x9162bb
push 1
push 0x2c
lea edx, [esp + 0x240]
push edx
mov edi, esi
call fcn.0098d640
lea eax, [esp + 0x750]
push str.SoftwareMicroWorldeScan_For_WindowsBackupSchedulerJobs
push eax
call fcn.00a78f30
add esp, 8
lea ecx, [esp + 0x10]
push ecx
push 9
push ebx
lea edx, [esp + 0x75c]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x916465
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x55c]
push edx
push ebx
mov edi, 0x208
push eax
xor ebp, ebp
mov byte [esp + 0x568], bl
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x916465
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push 9
push ebx
lea edx, [esp + 0x554]
push edx
push eax
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x916430
push 0x207
lea ecx, [esp + 0x35]
push ebx
push ecx
mov byte [esp + 0x3c], bl
call fcn.00a7ffb0
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push ebx
push ebx
push str.DirName
push ecx
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [esp + 0x30]
cmp al, bl
je 0x916430
cmp byte [esp + 0x31], 0x3a
jne 0x916430
movsx eax, al
push eax
lea ecx, [esp + 0x444]
push str._c:_
push ecx
call fcn.00a78f30
add esp, 0xc
lea eax, [esp + 0x440]
call fcn.00966890
cmp eax, 3
jne 0x916430
lea edx, [esp + 0x37]
push 0x5c
push edx
call fcn.00a7a2c0
add esp, 8
cmp eax, ebx
je 0x9163fb
mov byte [eax], bl
lea ecx, [esp + 0x30]
call fcn.0095a450
test eax, eax
je 0x916430
push ebx
lea ecx, [esp + 0x34]
call fcn.00963d90
add esp, 4
test eax, eax
jne 0x916430
mov edi, dword [esp + 0x1c]
push 1
push 0x2c
lea eax, [esp + 0x38]
push eax
call fcn.0098d640
mov edi, 0x208
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x55c]
push eax
inc ebp
push ebp
push ecx
mov byte [esp + 0x568], bl
mov dword [esp + 0x38], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x916337
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x916474
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x95c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00a78f21
add esp, 0x954
ret