Function at 0x76845c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x7abd18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xcb4
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0xcc0]
push eax
push 0xf003f
push 0
push 0x8a1824
push reloc.DSOUND.dll_DirectSoundEnumerateA
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x768bf6
xor eax, eax
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xcbc], 0x400
lea ebx, [ebp - 0xcb0]
lea ecx, [ebp - 0xcbc]
xor edx, edx
lea eax, [ebp - 0xcb8]
mov esi, dword [ebp - 0x1c]
push eax
push edx
push edx
push edx
push ecx
push ebx
push esi
push dword [ebp - 0xcc0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0x1c]
test eax, eax
jne 0x768bdc
lea edx, [ebp - 0xcb0]
lea eax, [ebp - 0x8b0]
push eax
push 0xf003f
push 0
push edx
push dword [ebp - 0xcc0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xcbc], 0x400
lea ebx, [ebp - 0x8ac]
lea ecx, [ebp - 0xcbc]
xor edx, edx
lea eax, [ebp - 0xcb8]
mov esi, dword [ebp - 0x14]
push eax
push edx
push edx
push edx
push ecx
push ebx
push esi
push dword [ebp - 0x8b0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
inc dword [ebp - 0x14]
test eax, eax
jne 0x768bd1
lea edx, [ebp - 0x8ac]
lea eax, [ebp - 0x4ac]
push eax
push 0xf003f
push 0
push edx
push dword [ebp - 0x8b0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x4a8], 0x400
lea ecx, [ebp - 0xa4]
lea edx, [ebp - 0x4a4]
lea eax, [ebp - 0x4a8]
push eax
push edx
push ecx
push 0
push 0x8a1830
push dword [ebp - 0x4ac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0xa0], 0x8a17f0
mov dword [ebp - 0x9c], 0
lea edi, [ebp - 0x4a4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x7685d9
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x7685d1
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x9c], eax
lea edi, [ebp - 0x4a4]
mov esi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x7685ef
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
test edi, edi
je 0x768c8f
mov esi, dword [ebp - 0x9c]
test esi, esi
je 0x768c88
mov al, byte [edi]
cmp al, byte [esi]
jne 0x768656
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x768642
or dl, dl
je 0x76863e
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x768642
add edi, 2
add esi, 2
or dl, dl
jne 0x768622
xor eax, eax
jmp 0x768647
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
mov esi, dword [ebp - 0x9c]
sete dl
jmp 0x768658
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0xa0], 0x8a17f0
test esi, esi
je 0x76867b
push esi
call fcn.007703b0
pop ecx
mov dword [ebp - 0x9c], 0
test ebx, ebx
jne 0x76851b
mov dword [ebp - 0x4a8], 0x400
lea ecx, [ebp - 0xa4]
lea edx, [ebp - 0x4a4]
lea eax, [ebp - 0x4a8]
push eax
push edx
push ecx
push 0
push 0x8a1840
push dword [ebp - 0x4ac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x98], 0x8a17f0
mov dword [ebp - 0x94], 0
lea edi, [ebp - 0x4a4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x7686eb
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x7686e3
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x94], eax
lea edi, [ebp - 0x4a4]
mov esi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x768701
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0xc]
mov edi, dword [eax + 4]
test edi, edi
je 0x768c80
mov esi, dword [ebp - 0x94]
test esi, esi
je 0x768c79
mov al, byte [edi]
cmp al, byte [esi]
jne 0x768768
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x768754
or dl, dl
je 0x768750
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x768754
add edi, 2
add esi, 2
or dl, dl
jne 0x768734
xor eax, eax
jmp 0x768759
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
mov esi, dword [ebp - 0x94]
sete dl
jmp 0x76876a
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x98], 0x8a17f0
test esi, esi
je 0x76878d
push esi
call fcn.007703b0
pop ecx
mov dword [ebp - 0x94], 0
test ebx, ebx
jne 0x76851b
mov dword [ebp - 0x4a8], 0x400
lea ecx, [ebp - 0xa4]
lea edx, [ebp - 0x4a4]
lea eax, [ebp - 0x4a8]
push eax
push edx
push ecx
push 0
push 0x8a184c
push dword [ebp - 0x4ac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x90], 0x8a17f0
mov dword [ebp - 0x8c], 0
lea edi, [ebp - 0x4a4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x7687fd
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x7687f5
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x8c], eax
lea edi, [ebp - 0x4a4]
mov esi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x768813
mov dword [ebp - 4], 2
mov eax, dword [ebp + 0x10]
mov edi, dword [eax + 4]
test edi, edi
je 0x768c71
mov esi, dword [ebp - 0x8c]
test esi, esi
je 0x768c6a
mov al, byte [edi]
cmp al, byte [esi]
jne 0x76887a
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x768866
or dl, dl
je 0x768862
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x768866
add edi, 2
add esi, 2
or dl, dl
jne 0x768846
xor eax, eax
jmp 0x76886b
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
mov esi, dword [ebp - 0x8c]
sete dl
jmp 0x76887c
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x90], 0x8a17f0
test esi, esi
je 0x76889f
push esi
call fcn.007703b0
pop ecx
mov dword [ebp - 0x8c], 0
test ebx, ebx
jne 0x76851b
mov dword [ebp - 0x4a8], 0x400
lea ecx, [ebp - 0xa4]
lea edx, [ebp - 0x4a4]
lea eax, [ebp - 0x4a8]
push eax
push edx
push ecx
push 0
push 0x8a185c
push dword [ebp - 0x4ac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x80]
push dword [ebp + 0x14]
push 0x877ab4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [ebp - 0x40], 0x8a17f0
mov dword [ebp - 0x3c], 0
lea edi, [ebp - 0x80]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x76891b
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x768913
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x3c], eax
lea edi, [ebp - 0x80]
mov esi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x76892b
mov dword [ebp - 4], 3
mov dword [ebp - 0x38], 0x8a17f0
mov dword [ebp - 0x34], 0
lea edi, [ebp - 0x4a4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x768962
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x76895a
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x34], eax
lea edi, [ebp - 0x4a4]
mov esi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x768975
mov dword [ebp - 4], 4
mov edi, dword [ebp - 0x3c]
test edi, edi
je 0x768c65
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x768c5e
mov al, byte [edi]
cmp al, byte [esi]
jne 0x7689d3
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x7689c2
or dl, dl
je 0x7689be
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x7689c2
add edi, 2
add esi, 2
or dl, dl
jne 0x7689a2
xor eax, eax
jmp 0x7689c7
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
mov esi, dword [ebp - 0x34]
sete dl
jmp 0x7689d5
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 3
mov dword [ebp - 0x38], 0x8a17f0
test esi, esi
je 0x7689f5
push esi
call fcn.007703b0
pop ecx
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x40], 0x8a17f0
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x768a18
push eax
call fcn.007703b0
pop ecx
mov dword [ebp - 0x3c], 0
test ebx, ebx
jne 0x76851b
mov dword [ebp - 0x4a8], 0x400
lea ecx, [ebp - 0xa4]
lea edx, [ebp - 0x4a4]
lea eax, [ebp - 0x4a8]
push eax
push edx
push ecx
push 0
push 0x8a186c
push dword [ebp - 0x4ac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x80]
push dword [ebp + 0x18]
push 0x877ab4
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [ebp - 0x30], 0x8a17f0
mov dword [ebp - 0x2c], 0
lea edi, [ebp - 0x80]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x768a91
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x768a89
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2c], eax
lea edi, [ebp - 0x80]
mov esi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x768aa1
mov dword [ebp - 4], 5
mov dword [ebp - 0x88], 0x8a17f0
mov dword [ebp - 0x84], 0
lea edi, [ebp - 0x4a4]
xor eax, eax
mov dh, byte [edi]
mov ecx, edi
test dh, dh
je 0x768ade
inc ecx
inc eax
mov dl, byte [ecx]
test dl, dl
jne 0x768ad6
inc eax
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x84], eax
lea edi, [ebp - 0x4a4]
mov esi, eax
mov dl, byte [edi]
inc edi
mov byte [esi], dl
inc esi
test dl, dl
jne 0x768af4
mov dword [ebp - 4], 6
mov edi, dword [ebp - 0x2c]
test edi, edi
je 0x768c56
mov esi, dword [ebp - 0x84]
test esi, esi
je 0x768c4f
mov al, byte [edi]
cmp al, byte [esi]
jne 0x768b58
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x768b44
or dl, dl
je 0x768b40
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x768b44
add edi, 2
add esi, 2
or dl, dl
jne 0x768b24
xor eax, eax
jmp 0x768b49
sbb eax, eax
or eax, 1
xor edx, edx
test eax, eax
mov esi, dword [ebp - 0x84]
sete dl
jmp 0x768b5a
xor edx, edx
xor ebx, ebx
test edx, edx
sete bl
mov dword [ebp - 4], 5
mov dword [ebp - 0x88], 0x8a17f0
test esi, esi
je 0x768b7d
push esi
call fcn.007703b0
pop ecx
mov dword [ebp - 0x84], 0
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0x8a17f0
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x768ba3
push eax
call fcn.007703b0
pop ecx
mov dword [ebp - 0x2c], 0
test ebx, ebx
jne 0x76851b
lea eax, [ebp - 0x8ac]
push 0x8a1874
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jne 0x76851b
jmp 0x768c06
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x7684b6
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x4a8], 0x400
lea ecx, [ebp - 0xa4]
lea edx, [ebp - 0x4a4]
lea eax, [ebp - 0x4a8]
push eax
push edx
push ecx
push 0
push 0x8a1880
push dword [ebp - 0x4ac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
movsx eax, byte [ebp - 0x4a4]
push eax
call dword [sym.imp.MSVCRT.dll_toupper]
pop ecx
movsx eax, al
mov dword [ebp - 0x18], eax
jmp 0x768bd1
xor edx, edx
jmp 0x768b5a
mov esi, dword [ebp - 0x84]
jmp 0x768c4f
xor edx, edx
jmp 0x7689d5
mov esi, dword [ebp - 0x34]
jmp 0x768c5e
xor edx, edx
jmp 0x76887c
mov esi, dword [ebp - 0x8c]
jmp 0x768c6a
xor edx, edx
jmp 0x76876a
mov esi, dword [ebp - 0x94]
jmp 0x768c79
xor edx, edx
jmp 0x768658
mov esi, dword [ebp - 0x9c]
jmp 0x768c88