Function at 0x73eba35d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcac
mov eax, dword [0x73ec600c]
push ebx
push esi
push edi
mov esi, 0x73e7fb44
lea edi, [ebp - 0x440]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0xe34
mov dword [ebp - 0xca8], eax
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xca0], 0x25e
call fcn.73e714ab
mov esi, eax
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0xc98], esi
jne 0x73eba3b4
push 8
jmp 0x73eba8a7
push ebx
push 0x84
push 0x73ec7e30
mov dword [esi], 6
call fcn.73e71609
add esp, 0xc
call fcn.73eb911c
test eax, eax
jne 0x73eba3dc
push esi
jmp 0x73eba8a0
mov eax, dword [0x73ec7e78]
cmp eax, ebx
je 0x73eba3fd
push 0x12
push ebx
push ebx
lea ecx, [ebp - 0x440]
push ecx
call eax
cmp eax, 0xffffffff
mov dword [ebp - 0xc9c], eax
jne 0x73eba404
call fcn.73eb984b
jmp 0x73eba3d6
push ebx
push 0x1c
pop esi
lea eax, [ebp - 0x45c]
push esi
push eax
call fcn.73e71609
push ebx
lea eax, [ebp - 0x430]
push esi
push eax
mov dword [ebp - 0x45c], esi
call fcn.73e71609
mov dword [ebp - 0x430], esi
mov esi, 0x73e7fb44
lea edi, [ebp - 0x42c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x18
movsd dword es:[edi], dword [esi]
xor esi, esi
mov eax, dword [0x73ec7ea8]
cmp eax, ebx
je 0x73eba4b7
mov edi, dword [ebp - 0xc9c]
lea ecx, [ebp - 0x45c]
push ecx
push esi
lea ecx, [ebp - 0x440]
push ecx
push ebx
push edi
call eax
cmp eax, ebx
je 0x73eba4b7
mov eax, dword [0x73ec7eac]
cmp eax, ebx
je 0x73eba4b7
lea ecx, [ebp - 0x430]
push ecx
lea ecx, [ebp - 0xcac]
push ecx
push dword [ebp - 0xca0]
lea ecx, [ebp - 0x45c]
push dword [ebp - 0xc98]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba4b7
push dword [ebp - 0xca8]
mov eax, dword [ebp - 0xc98]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x73eba4c2
inc esi
jmp 0x73eba443
push dword [ebp - 0xc9c]
jmp 0x73eba890
mov eax, dword [0x73ec7e74]
cmp eax, ebx
je 0x73eba88f
push ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba88f
push edi
call fcn.73eb90ce
push ebx
push ebx
call fcn.73eb90b1
mov edi, eax
cmp edi, 0xffffffff
je 0x73eba895
push ebx
push 0x1c
pop esi
lea eax, [ebp - 0x430]
push esi
push eax
call fcn.73e71609
mov eax, dword [0x73ec7e60]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x430], esi
je 0x73eba88f
lea ecx, [ebp - 0x430]
push ecx
push ebx
push ebx
lea ecx, [ebp - 0x20c]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba88f
push ebx
mov esi, 0x22c
lea eax, [ebp - 0x688]
push esi
push eax
call fcn.73e71609
mov eax, dword [0x73ec7e6c]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x688], esi
je 0x73eba88f
lea ecx, [ebp - 0x688]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba88f
mov eax, dword [0x73ec7e94]
cmp eax, ebx
je 0x73eba88f
push 0xf003f
push 2
push ebx
push 1
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, 0xffffffff
mov dword [ebp - 0xc9c], eax
je 0x73eba88f
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0xca0]
push ecx
lea ecx, [ebp - 0x664]
push ecx
lea ecx, [ebp - 0xca4]
push ecx
push ebx
push 0x73eba91c
push eax
mov dword [ebp - 0xca0], 0x208
call esi
test eax, eax
je 0x73eba5fd
push dword [ebp - 0xc9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x73eba88f
lea eax, [ebp - 0x664]
push eax
call fcn.73eb9ec1
lea eax, [ebp - 0xca0]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xca4]
push eax
push ebx
push 0x73eba904
push dword [ebp - 0xc9c]
mov dword [ebp - 0xca0], 0x208
call esi
test eax, eax
jne 0x73eba5ec
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x664]
push eax
call fcn.73eba1c7
test eax, eax
jne 0x73eba662
push dword [ebp - 0xc9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x73eba8bf
mov eax, dword [0x73ec7e70]
or byte [ebp - 0x682], 1
cmp eax, ebx
je 0x73eba5ec
lea ecx, [ebp - 0x688]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba5ec
mov eax, dword [0x73ec7e90]
cmp eax, ebx
je 0x73eba5ec
push 1
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba5ec
push ebx
lea eax, [ebp - 0xc94]
push 0x60c
push eax
call fcn.73e71609
add esp, 0xc
lea eax, [ebp - 0xca0]
push eax
lea eax, [ebp - 0x888]
push eax
lea eax, [ebp - 0xca4]
push eax
push ebx
push 0x73eba8e8
push dword [ebp - 0xc9c]
mov esi, 0x200
mov dword [ebp - 0xca0], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x73eba702
mov word [ebp - 0x888], bx
mov eax, dword [0x73ec7e68]
cmp eax, ebx
je 0x73eba5ec
push ebx
push esi
lea ecx, [ebp - 0xa88]
push ecx
push ebx
push 0xb
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba5ec
mov eax, dword [0x73ec7e68]
cmp eax, ebx
je 0x73eba5ec
push ebx
push esi
lea ecx, [ebp - 0xc88]
push ecx
push ebx
push ebx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba5ec
mov eax, dword [0x73ec7e64]
cmp eax, ebx
mov dword [ebp - 0xc94], 0x60c
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0xc8c], ebx
je 0x73eba5ec
lea ecx, [ebp - 0xc94]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba5ec
push dword [ebp - 0xc9c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.73eb909d
cmp eax, 0xffffffff
mov dword [ebp - 0xc9c], eax
je 0x73eba88f
push ebx
mov esi, 0x22c
lea eax, [ebp - 0x688]
push esi
push eax
call fcn.73e71609
mov eax, dword [0x73ec7e6c]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x688], esi
je 0x73eba7f1
lea ecx, [ebp - 0x688]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
jne 0x73eba814
push dword [ebp - 0xc9c]
call fcn.73eb9083
push edi
call fcn.73eb90ce
call fcn.73eb984b
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x73eba8ca
mov eax, dword [0x73ec7e70]
or dword [ebp - 0x684], 8
cmp eax, ebx
mov esi, dword [ebp - 0xc9c]
mov dword [ebp - 0x670], esi
je 0x73eba889
lea ecx, [ebp - 0x688]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
je 0x73eba889
mov eax, dword [0x73ec7e84]
cmp eax, ebx
je 0x73eba889
lea ecx, [ebp - 0x430]
push ecx
push edi
push 0x15
call eax
cmp eax, ebx
je 0x73eba889
mov eax, dword [0x73ec7e70]
and dword [ebp - 0x684], 0xfffffff7
cmp eax, ebx
mov dword [ebp - 0x670], ebx
je 0x73eba889
lea ecx, [ebp - 0x688]
push ecx
lea ecx, [ebp - 0x430]
push ecx
push edi
call eax
cmp eax, ebx
jne 0x73eba8b1
push esi
call fcn.73eb9083
push edi
call fcn.73eb90ce
call fcn.73eb984b
push dword [ebp - 0xc98]
call fcn.73e71e1a
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x73eba8d7
push esi
call fcn.73eb9fed
push esi
mov ebx, eax
call fcn.73eb9083
push edi
call fcn.73eb90ce
call fcn.73eb984b
push dword [ebp - 0xc98]
call fcn.73e71e1a
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.73e71586
leave
ret 4