Function at 0x7c829956
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [0x7c8856cc]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
cmp edi, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x424], esi
je 0x7c848f36
cmp dword [ebp + 0xc], esi
jne 0x7c848f3a
call sym.KERNEL32.dll_GetSystemDefaultUILanguage
push 0x104
lea ecx, [ebp - 0x420]
push ecx
push 4
movzx eax, ax
push 0x10
push eax
call sym.KERNEL32.dll_NlsConvertIntegerToString
test eax, eax
jne 0x7c829a6b
cmp dword [ebp + 0x14], esi
lea eax, [ebp - 0x420]
je 0x7c848f4b
push dword [ebp + 0x10]
push eax
call edi
cmp eax, 1
jne 0x7c848f66
cmp dword [ebp - 0x424], esi
jne 0x7c8299fc
push 0x20019
push 0x7c829a78
push 0x7c81b118
lea eax, [ebp - 0x424]
push eax
call fcn.7c81aec6
test eax, eax
jne 0x7c848f66
push ebx
xor eax, eax
mov ecx, 0x85
lea edi, [ebp - 0x218]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x430]
push eax
push 0x214
lea eax, [ebp - 0x218]
push eax
push 1
push esi
push dword [ebp - 0x424]
mov dword [ebp - 0x428], esi
mov esi, dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
call esi
mov ebx, 0x8000001a
cmp eax, ebx
jne 0x7c848f6e
xor edi, edi
cmp dword [ebp - 0x424], edi
je 0x7c829a59
push dword [ebp - 0x424]
call dword [sym.imp.ntdll.dll_NtClose]
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.7c8097aa
leave
ret 0x10
mov word [ebp - 0x420], si
jmp 0x7c8299d1
bound ebp, qword [eax + 0x3f14a132]
adc al, 0x3f
mov cs, esp
mov ah, 0x25
xchg ebp, eax
add dword [ebx + 3], edi
out dx, al
cmp byte [eax + ecx], cl
invalid
xchg ebp, eax
pop es
test eax, 0x4fb5af66
iretd
loopne 0x7c848f92
rcr dword [ecx + 3], 1
jae 0x7c848f31
or ch, byte [edx - 0x2b504f33]
dec edx
stosb byte es:[edi], al
int 0xb0
scasd eax, dword es:[edi]
aam 0x4a
mov ebp, 0x9977cde6
int 0x77
cdq
xor al, al
movsd dword es:[edi], dword [esi]
and eax, 0xe74e8abc
and ecx, eax
sar byte [esi + 0x1d], cl
std
cmp cl, byte [eax]
out 0x34, eax
sahf
fcom dword [eax + 0x2c]
cmp al, 0x47
adc byte [0xb0437bc5], bh
sbb eax, 0x3a376981
aaa
cmp dh, byte [ecx - 0x3d912e2a]
mov cl, 0xd6
shr dword [esi - 0x3e], 1
setg byte [ebx + 0x2c]
sahf
pop ecx
jbe 0x7c848fbb
int1
mov eax, 0x20cd8639
cdq
push ecx
mov eax, dword [0x9b778241]
add dword [ebx + 0x52], ebx
mov ebx, 0xc4609aa6
scasb al, byte es:[edi]
shr dword [edx], 0xa3
test byte [esp + ecx*8 + 0xa27622f], bl
stosb byte es:[edi], al
xor dword [ecx + 0x379a32f1], 0x2ea7c979
mov dh, 0xf7
aaa
jns 0x7c848f94
cmpsd dword [esi], dword es:[edi]
mov dh, 0xf7
jle 0x7c848fdf
fcom qword [ebp - 0x20647891]
jbe 0x7c848f5e
mov dl, 0x8a
mov ebx, 0x62431fa
cli
xor dword [esi + eax], esp
push es
cmp al, 8
loop 0x7c84902c
fsincos
mov dh, 0xe4
cmp eax, 0xf62a4ca8
cmp al, 0x94
sar edi, 1
xor edi, dword [edx + 0x3b]
and byte [edx + edi + 0x19987494], dh
je 0x7c848fc8
cmp dl, byte [esp + esi*2 - 0x348be668]
adc dword [eax], esi
cmp al, byte [eax]
test byte [eax], al
pop es
mov dl, 0xf5
sbb eax, 0xebfd3f04
sal byte [esi], 1
mov ebx, 0xb3cf1f72
xchg edi, ecx
aad 0x61
fst dword [ebp + 0x6d]
shl byte [ebx], 0xf3
mov al, 0xe4
lodsb al, byte [esi]
cmpsb byte [esi], byte es:[edi]
and dword [ecx + 0x392cd1e8], ebx
popal
popfd
not dword [ebx - 0x59]
mov eax, 0x75bb861c
rcl byte [edx], cl
jnp 0x7c84902d
aas
std
jmp 0x7c848fdc
rcr byte [esi + eax*4], 0xbb
jne 0x7c849004
sbb al, 0x86
mov ebx, 0x2612d275
adc ah, byte [esi]
jnp 0x7c84902d
xchg dword [edi - 0x17], esi
and al, 0xef
jle 0x7c848ff6
jb 0x7c84907e
sbb al, 0xb1
xchg esi, eax
call 0xa923244b
cmp dword [ebp + 0x6f], eax
popal
stosb byte es:[edi], al
cwde
xchg dword gs:[esi], edi
cmp al, 0x94
insd dword es:[edi], dx
mov dword [eax - 0x3a0786b], ebx
jg 0x7c849008
mov ebp, 0x45537c0b
idiv byte [eax]
sahf
xor al, 0x69
sbb ebp, dword [eax + 0x20]
test eax, 0xb0528804
dec edx
fsubr qword [ebp + 0x5412b552]
push 0xffffffffffffff8b
push ss
push 0x798b6aa1
xor al, 9
lodsb al, byte [esi]
or byte [eax + 0x5118d77c], ch
or dword [eax + ecx + 0x18d77ca8], ebp
push ecx
test al, 0x7c
xlatb
sbb byte [ecx + 0x59], dl
pop ecx
mov ecx, 0xca405411
insd dword es:[edi], dx
mov ch, 0xe1
adc dl, byte [edi]
xlatb
out 0xfa, eax
pop eax
int1
test dword [eax - 0x754e0c08], ebp
call 0xe4d56b53
add dword [ecx + 0x79], eax
sub eax, edi
pop edx
pop ds
mov al, byte [0x2a8f084e]
adc al, 0x5a
sub ah, ah
jg 0x7c849081
cdq
mov ecx, 0xfb296937
clc
jl 0x7c8490ba
out dx, al
cmpsb byte [esi], byte es:[edi]
fdivr qword [ebx + 0x67]
out 0xcc, al
cdq
xor esp, edi
pushfd
cmp dword [edi - 0x1a], esp
int3