Function at 0x7376ad42
Capabilities:
Query or enumerate registry value

Disassembly:
mov ebx, 0x40000000
mov edi, dword [esi + 4]
test edi, edi
je 0x7376e14c
push dword [ebp - 0x10c]
lea eax, [edi + 0x618]
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x7376e14c
mov eax, dword [ebp - 0x110]
and eax, 2
jne 0x73775e57
test dword [edi + 4], 0x40000100
jne 0x73775e57
test esi, esi
je 0x7376b13c
mov eax, dword [0x737a008c]
xor esi, esi
test eax, eax
mov dword [ebp - 0x11c], esi
je 0x73775e86
mov ecx, dword [eax + 0x14]
cmp ecx, dword [ebp - 0x130]
jne 0x7376e15c
cmp dword [eax + 4], edi
jne 0x7376e15c
test eax, eax
je 0x73775e86
mov ecx, dword [eax + 0x24]
test ecx, ecx
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x120], eax
je 0x73775e86
test byte [ebp - 0x110], 2
jne 0x73775ece
test byte [edi + 5], 0x44
je 0x73775eda
mov eax, dword [ebp - 0x128]
mov ecx, edi
call fcn.7376c91b
mov ebx, eax
test ebx, ebx
je 0x73775f0d
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x134]
push dword [ebp - 0x124]
mov dword [esi + 0x48], eax
call fcn.7376ca07
test eax, eax
pop ecx
je 0x7376ace4
or byte [edi + 7], 1
cmp dword [ebp - 0x12c], 0
jne 0x73775f23
mov eax, dword [ebp + 0x14]
or dword [esi + 0xc], eax
or dword [esi + 0x44], 0xffffffff
cmp dword [ebp - 0x11c], 0
jne 0x73775f2c
mov eax, dword [ebp - 0x120]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp - 0x114]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ebx
xor esi, esi
push dword [0x7379f190]
dec dword [section..data]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x7376b2ad
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x7379f39c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 4
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x18]
push edi
xor ebx, ebx
push esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x73775cad
mov eax, dword [ebp + 0x14]
shr eax, 0x15
not eax
and eax, 1
push eax
mov dword [esi], ebx
call fcn.73768bbc
test eax, eax
pop ecx
je 0x73775cb7
push dword [0x7379f190]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [section..data]
call sub.GDI32.dll_GdiEntry13
mov esi, eax
cmp esi, dword [0x7379f99c]
jne 0x7376cc54
call fcn.7376b5cc
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x118]
push eax
push 0x73761a34
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x7376b032
and word [0x7379f3a0], 0x7190
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b3a0
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775cc1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b390
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775cd9
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b380
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775cf1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b36c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775d08
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b35c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775d20
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b348
push dword [ebp - 0x118]
call esi
test eax, eax
je 0x73775d38
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b33c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775d50
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b324
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775d68
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b30c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775d80
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b2f8
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775d98
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b2e4
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x73775db0
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x118]
push eax
push 0x7376b2c8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x7376b091
and byte [0x7379f3a2], 0xfd
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x7376b2bc
push dword [ebp - 0x118]
mov dword [ebp - 0x120], edi
call esi
test eax, eax
je 0x73775dcf
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x737a07d0], 0
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x110], ebx
je 0x7376b3aa
test byte [0x7379f3a0], 2
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x11c], ebx
jne 0x73775de7
mov eax, dword [ebp - 0x130]
cmp eax, ebx
jne 0x73775e41
xor eax, eax
cmp dword [ebp - 0x124], 2
mov esi, 0x7376ca60
je 0x73775e0f
inc eax
cmp dword [ebp - 0x124], ebx
jne 0x7376e10d
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x124], esi
mov ecx, edi
mov edi, esi
mov esi, dword [ebp - 0x124]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x7376e3c8
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x10c], 0x73761a2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [0x737a008c]
cmp esi, ebx
mov dword [ebp - 0x130], eax
jne 0x7376abf6
push dword [ebp - 0x10c]
call fcn.73768cce
xor edi, edi
cmp eax, edi
pop ecx
mov dword [ebp - 0x114], eax
je 0x73775f6d
test byte [ebp - 0x110], 2
jne 0x73775f77
mov dword [ebp - 0x120], edi
call sub.GDI32.dll_GdiEntry13
push edi
push edi
push dword [ebp - 0x10c]
mov dword [0x7379f99c], eax
push 0xffffffffffffffff
push edi
push edi
push edi
call fcn.7376c175
mov esi, eax
add esp, 0x1c
cmp esi, edi
je 0x73775f8a
mov eax, dword [ebp - 0x10c]
mov ecx, esi
sub ecx, eax
mov dword [esi + 0x148], 0x902
lea ebx, [ecx + 0x618]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x7376b1ae
test byte [esi + 4], 0x20
je 0x73775fe9
mov edx, esi
call fcn.7376886d
push dword [ebp - 0x120]
push dword [ebp - 0x110]
push esi
call fcn.7376c65d
add esp, 0xc
test eax, eax
je 0x73775fb8
mov eax, dword [ebp - 0x128]
mov ecx, esi
call fcn.7376c91b
test eax, eax
mov dword [ebp - 0x128], eax
je 0x7377600b
mov eax, dword [ebp - 0x128]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x134]
push dword [ebp - 0x124]
mov dword [edi + 0x48], eax
call fcn.7376ca07
test eax, eax
pop ecx
je 0x7376b227
or byte [esi + 7], 1
cmp dword [ebp - 0x12c], 0
jne 0x7376e143
mov eax, dword [ebp + 0x14]
or dword [edi + 0xc], eax
mov eax, dword [ebp - 0x114]
or dword [edi + 0x44], 0xffffffff
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x10c]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x7376b24d
mov eax, dword [esi + 0x434]
push 0x73761a2c
add esi, 0x438
push esi
mov dword [edi + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x11c], 0
je 0x7376b28b
cmp dword [ebp - 0x120], 0
jne 0x7376b28b
push edi
call fcn.73768f6c
pop ecx
push dword [0x7379f190]
dec dword [section..data]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x138]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.73761331
leave
ret
call fcn.7376b3b9
jmp 0x7376b0aa
cmp dword [section..data], 1
jne 0x7376add8
call fcn.7376cc76
mov dword [0x7379f99c], esi
jmp 0x7376add8
cmp dword [ebp - 0x124], eax
je 0x73775e1c
cmp dword [ebp - 0x114], ebx
jne 0x7376b0f8
push 0x10
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x73775e2d
xor eax, eax
inc eax
jmp 0x7376b0fe
or byte [edi + 0xd], 0x20
jmp 0x7376b234
mov esi, dword [esi + 0x70]
test esi, esi
je 0x7376ac3f
jmp 0x7376abfb
mov eax, dword [eax + 0x70]
test eax, eax
je 0x7376ac74
jmp 0x7376ac5c
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x124]
call 0x7376e42e
add esp, 0x10
test eax, eax
je 0x73775e37
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], eax
push 0x737a07d0
push dword [ebp - 0x10c]
mov dword [ebp - 0x12c], 1
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
je 0x7376b118
jmp 0x7376b122
mov eax, 0x80070057
jmp 0x7376b2ad
mov eax, 0x887600de
jmp 0x7376b2ad
cmp dword [ebp - 0x10c], ebx
je 0x7376ae42
or dword [0x7379f3a0], 1
jmp 0x7376ae42
cmp dword [ebp - 0x10c], ebx
je 0x7376ae73
or dword [0x7379f3a0], 2
jmp 0x7376ae73
cmp dword [ebp - 0x10c], ebx
je 0x7376aea4
or dword [0x7379f3a0], edi
jmp 0x7376aea4
cmp dword [ebp - 0x10c], ebx
je 0x7376aed5
or dword [0x7379f3a0], 8
jmp 0x7376aed5
cmp dword [ebp - 0x10c], ebx
je 0x7376af06
or dword [0x7379f3a0], 0x10
jmp 0x7376af06
cmp dword [ebp - 0x10c], ebx
je 0x7376af31
or byte [0x7379f3a1], 8
jmp 0x7376af31
cmp dword [ebp - 0x10c], ebx
je 0x7376af62
or dword [0x7379f3a0], 0x20
jmp 0x7376af62
cmp dword [ebp - 0x10c], ebx
je 0x7376af93
or byte [0x7379f3a1], 4
jmp 0x7376af93
cmp dword [ebp - 0x10c], ebx
je 0x7376afc4
or dword [0x7379f3a0], 0x40
jmp 0x7376afc4
cmp dword [ebp - 0x10c], ebx
je 0x7376aff5
or byte [0x7379f3a2], 1
jmp 0x7376aff5
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
je 0x7376b026
or byte [0x7379f3a1], 0x80
mov dword [0x737a5664], eax
jmp 0x7376b026
cmp dword [ebp - 0x11c], ebx
je 0x7376b085
or byte [0x7379f3a2], 2
jmp 0x7376b085
push 0x50
mov dword [ebp - 0x110], 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
inc ecx
cmp eax, ecx
ja 0x7376b0c3
mov dword [ebp - 0x114], ecx
jmp 0x7376b0c3
or dword [ebp - 0x110], 2
inc eax
jmp 0x7376b0f2
or dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
jmp 0x7376e119
mov esi, 0x80070057
jmp 0x7376ad24
mov esi, 0x88760231
jmp 0x7376ad24
cmp eax, 0x73761a2c
mov dword [ebp - 0x10c], eax
jne 0x7376e3ff
jmp 0x7376b122
test eax, eax
je 0x73775e6b
mov eax, dword [edi + 4]
test ah, 1
je 0x73775e6b
test ebx, eax
je 0x7376ac3f
cmp dword [edi + 0x5d8], 1
ja 0x7376e14c
test dword [edi + 4], ebx
jne 0x7376e14c
jmp 0x7376ac3f
push dword [ebp - 0x10c]
call fcn.73768cce
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0x114], esi
jne 0x73775ea8
mov esi, 0x80004005
jmp 0x7376ad24
test byte [edi + 4], 0x20
jne 0x73775ec3
push esi
call fcn.7378c5d3
test eax, eax
pop ecx
je 0x73775ebf
or byte [edi + 6], 0x80
jmp 0x73775ec3
and byte [edi + 6], 0x7f
mov dword [ebp - 0x11c], esi
jmp 0x7376ac96
test byte [edi + 5], 1
jne 0x7376aca3
jmp 0x73775f04
mov edx, edi
call fcn.7376886d
mov eax, dword [ebp - 0x110]
shr eax, 1
and eax, 1
push eax
push dword [ebp - 0x110]
push edi
call fcn.7376c65d
add esp, 0xc
test eax, eax
jne 0x7376acad
push esi
call fcn.7376c25c
pop ecx
jmp 0x73775e9e
push dword [ebp - 0x11c]
call fcn.7376c25c
pop ecx
mov esi, 0x8007000e
jmp 0x7376ad24
or byte [esi + 0xd], 0x20
jmp 0x7376acf1
test byte [edi + 5], 1
je 0x73775f36
push 0
jmp 0x73775f3c
push dword [ebp - 0x114]
push edi
call sub.GDI32.dll_GdiEntry1
test eax, eax
jne 0x73775f5c
push dword [ebp - 0x114]
call fcn.7376c25c
pop ecx
mov esi, 0x88760233
jmp 0x7376ad24
mov eax, dword [edi + 0x434]
mov dword [ebp - 0x120], eax
jmp 0x7376ad08
mov esi, 0x88760249
jmp 0x7376ad24
test byte [ebp - 0x110], 1
je 0x73775f90
mov esi, 0x88760233
jmp 0x73776010
mov dword [ebp - 0x11c], edi
push 0xffffffffffffffff
push edi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x120], 1
push dword [ebp - 0x114]
call fcn.73795aae
mov esi, eax
add esp, 0x14
cmp esi, edi
jne 0x73775fbf
mov esi, 0x80004005
jmp 0x73776010
mov eax, dword [ebp - 0x10c]
or dword [esi + 0x14], 1
mov ecx, esi
sub ecx, eax
lea ebx, [ecx + 0x618]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x73775fd3
push esi
call fcn.73768c3e
pop ecx
jmp 0x7376b1b8
push dword [ebp - 0x114]
call fcn.7378c5d3
test eax, eax
pop ecx
je 0x73776002
or byte [esi + 6], 0x80
jmp 0x7376b1c2
and byte [esi + 6], 0x7f
jmp 0x7376b1c2
mov esi, 0x8007000e
push dword [0x7379f190]
dec dword [section..data]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x114]
call fcn.7376c25c
pop ecx
jmp 0x7376ad36