Function at 0x9d7a00
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0xb12448
push 0xa847a0
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, 0x106c
call fcn.00a91950
mov eax, dword [0xb196ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, ecx
mov esi, edx
xor ebx, ebx
mov dword [ebp - 0x1074], ebx
mov dword [ebp - 0x1070], ebx
mov dword [ebp - 0x1078], ebx
mov byte [ebp - 0x53c], bl
push 0x103
push ebx
lea eax, [ebp - 0x53b]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x84c], bl
push 0x103
push ebx
lea ecx, [ebp - 0x84b]
push ecx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0xa54], bl
push 0x207
push ebx
lea edx, [ebp - 0xa53]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x744], bl
push 0x207
push ebx
lea eax, [ebp - 0x743]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x9d7f00
cmp byte [edi], bl
je 0x9d7f00
cmp esi, ebx
je 0x9d7f00
cmp byte [esi], bl
je 0x9d7f00
push 0x5c
push esi
call fcn.00a7aa50
add esp, 8
lea edx, [ebp - 0x53c]
cmp eax, ebx
je 0x9d7b51
lea ecx, [eax + 1]
nop
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9d7b00
mov ecx, esi
lea edx, [ebp - 0x22c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9d7b12
lea ecx, [ebp - 0x22c]
call fcn.00958390
push 0x5c
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
je 0x9d7b63
lea ecx, [eax + 1]
lea edx, [ebp - 0x84c]
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9d7b45
jmp 0x9d7b63
mov ecx, esi
mov al, byte [ecx]
mov byte [edx], al
inc ecx
inc edx
cmp al, bl
jne 0x9d7b53
mov byte [ebp - 0x22c], bl
push 0x80000002
lea eax, [ebp - 0x1070]
mov ecx, 0xf003f
mov edx, edi
call fcn.0097f000
add esp, 4
test eax, eax
jne 0x9d7ed2
xor edi, edi
mov dword [ebp - 0x107c], edi
mov byte [ebp - 0x744], bl
push 0x208
lea edx, [ebp - 0x744]
push edx
push edi
mov eax, dword [ebp - 0x1070]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x9d7ebf
mov byte [ebp - 0xa54], bl
lea ecx, [ebp - 0xa54]
push ecx
lea ecx, [ebp - 0x744]
call fcn.0097a260
add esp, 4
cmp byte [ebp - 0xa54], bl
je 0x9d7efa
lea eax, [ebp - 0x53c]
lea ecx, [ebp - 0xa54]
call fcn.0094c330
test eax, eax
je 0x9d7c0a
lea eax, [ebp - 0x84c]
lea ecx, [ebp - 0xa54]
call fcn.0094c330
test eax, eax
jne 0x9d7efa
lea edx, [ebp - 0x1078]
push edx
push 0xf003f
push ebx
lea eax, [ebp - 0x744]
push eax
mov ecx, dword [ebp - 0x1070]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x9d7efa
mov byte [ebp - 0x106c], bl
push 0x207
push ebx
lea edx, [ebp - 0x106b]
push edx
call fcn.00a7ffb0
add esp, 0xc
mov byte [ebp - 0x434], bl
push 0x207
push ebx
lea eax, [ebp - 0x433]
push eax
call fcn.00a7ffb0
add esp, 0xc
mov dword [ebp - 0x1084], 0x208
lea ecx, [ebp - 0x1084]
push ecx
lea edx, [ebp - 0x106c]
push edx
push ebx
push ebx
push str.Prop4
mov eax, dword [ebp - 0x1078]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [ebp - 0x106c], bl
je 0x9d7ee7
cmp byte [ebp - 0x22c], bl
je 0x9d7ee7
xor esi, esi
mov dword [ebp - 0x1080], esi
lea ecx, [ebp - 0x434]
push ecx
lea ecx, [ebp - 0x106c]
call fcn.0097a260
add esp, 4
cmp byte [ebp - 0x434], bl
je 0x9d7ee7
cmp byte [ebp - 0x433], 0x3a
jne 0x9d7d06
cmp byte [ebp - 0x22b], 0x3a
jne 0x9d7d06
lea eax, [ebp - 0x22b]
lea ecx, [ebp - 0x433]
call fcn.0094c330
test eax, eax
je 0x9d7d1b
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0x434]
call fcn.0094c330
test eax, eax
jne 0x9d7d58
mov dword [ebp - 0x1074], 1
cmp dword [ebp + 8], ebx
je 0x9d7ebf
lea edx, [ebp - 0x744]
push edx
mov eax, dword [ebp - 0x1070]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x9d7d58
mov esi, 1
mov dword [ebp - 0x1080], esi
dec edi
mov dword [ebp - 0x107c], edi
cmp esi, ebx
jne 0x9d7ee7
lea ecx, [ebp - 0x434]
call fcn.00958390
cmp byte [ebp - 0x433], 0x3a
jne 0x9d7d92
cmp byte [ebp - 0x22b], 0x3a
jne 0x9d7d92
lea eax, [ebp - 0x22b]
lea ecx, [ebp - 0x433]
call fcn.0094c330
test eax, eax
je 0x9d7da7
lea eax, [ebp - 0x22c]
lea ecx, [ebp - 0x434]
call fcn.0094c330
test eax, eax
jne 0x9d7de6
mov dword [ebp - 0x1074], 1
cmp dword [ebp + 8], ebx
je 0x9d7ebf
lea ecx, [ebp - 0x744]
push ecx
mov edx, dword [ebp - 0x1070]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x9d7dec
mov esi, 1
mov dword [ebp - 0x1080], esi
dec edi
mov dword [ebp - 0x107c], edi
jmp 0x9d7dec
mov dword [ebp - 0x1074], ebx
cmp esi, ebx
jne 0x9d7ee7
mov byte [ebp - 0xe64], bl
push 0x208
lea eax, [ebp - 0xe64]
push eax
lea ecx, [ebp - 0x434]
push ecx
call dword [str.__0uBlocked]
mov byte [ebp - 0xc5c], bl
push 0x208
lea edx, [ebp - 0xc5c]
push edx
lea eax, [ebp - 0x22c]
push eax
call dword [str.__0uBlocked]
cmp byte [ebp - 0xe63], 0x3a
jne 0x9d7e59
cmp byte [ebp - 0xc5b], 0x3a
jne 0x9d7e59
lea eax, [ebp - 0xc5b]
lea ecx, [ebp - 0xe63]
call fcn.0094c330
test eax, eax
je 0x9d7e6e
lea eax, [ebp - 0xc5c]
lea ecx, [ebp - 0xe64]
call fcn.0094c330
test eax, eax
jne 0x9d7ee1
mov dword [ebp - 0x1074], 1
cmp dword [ebp + 8], ebx
je 0x9d7ebf
lea ecx, [ebp - 0x744]
push ecx
mov edx, dword [ebp - 0x1070]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x9d7ee7
mov dword [ebp - 0x1080], 1
dec edi
mov dword [ebp - 0x107c], edi
mov ecx, dword [ebp - 0x1078]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1078], ebx
inc edi
jmp 0x9d7b87
mov eax, dword [ebp - 0x1070]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1070], ebx
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x1074]
jmp 0x9d7f45
mov dword [ebp - 0x1074], ebx
mov ecx, dword [ebp - 0x1078]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1078], ebx
inc edi
jmp 0x9d7b87
mov dword [ebp - 4], 0xfffffffe
jmp 0x9d7f43
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret