Function at 0x10009ca0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10037770
push eax
mov eax, 0x1780
mov dword fs:[0], esp
call fcn.10024bc0
mov eax, dword [esp + 0x1794]
mov ecx, dword [eax]
push esi
push edi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x1770
call fcn.1000b730
mov esi, dword [esp + 8]
mov dword [esp + 0x1790], 0
mov ecx, 0x1003bb5d
mov eax, esi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009d15
test dl, dl
je 0x10009d0e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009d15
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009cf2
xor eax, eax
or edi, 0xffffffff
jmp 0x10009d1e
sbb eax, eax
mov edi, 0xffffffff
sbb eax, edi
xor edx, edx
test eax, eax
sete dl
mov eax, edx
test eax, eax
je 0x10009d60
mov ecx, dword [esp + 0x17a0]
xor eax, eax
mov word [ecx], ax
lea eax, [esi - 0x10]
mov dword [esp + 0x1790], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x10009e9d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x10009e9d
lea ecx, [esp + 0xc]
push ecx
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10009db4
mov eax, dword [esp + 0x17a0]
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x1790], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009daa
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
jmp 0x10009e9f
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10009dfc
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x17a0]
xor edx, edx
push ecx
mov word [eax], dx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
jmp 0x10009d3a
mov eax, 0x1b4e81b5
mul dword [esp + 0x10]
shr edx, 5
push ebx
xor esi, esi
push ebp
test edx, edx
jle 0x10009e60
mov ebp, dword [esp + 0x10]
lea edi, [esp + 0x20]
mov ecx, ebp
mov eax, edi
lea esp, [esp]
mov bl, byte [eax]
cmp bl, byte [ecx]
jne 0x10009e40
test bl, bl
je 0x10009e3c
mov bl, byte [eax + 1]
cmp bl, byte [ecx + 1]
jne 0x10009e40
add eax, 2
add ecx, 2
test bl, bl
jne 0x10009e20
xor eax, eax
jmp 0x10009e45
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
jne 0x10009eb8
inc esi
add edi, 0x12c
cmp esi, edx
jl 0x10009e18
or edi, 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x17a8]
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009e9b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
pop ebp
pop ebx
xor eax, eax
mov ecx, dword [esp + 0x1788]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x178c
ret 0xc
imul esi, esi, 0x12c
push 0x1003bb5f
push 0x1003bef0
lea esi, [esp + esi + 0x28]
push 0x32
push esi
call fcn.10023f6f
push 0x1003bb5e
push 0x1003bef0
push 0xfa
add esi, 0x32
push esi
call fcn.10023f6f
mov eax, dword [esp + 0x34]
add esp, 0x20
push 0x1770
lea edx, [esp + 0x24]
push edx
push 3
push 0
push str.hlpreg
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x10009f4c
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x17a8]
xor ecx, ecx
push eax
mov word [edx], cx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10009e8f
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x17a8]
mov edx, 1
mov word [eax], dx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov dword [esp + 0x1798], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10009e8f