Function at 0x736dad42
Capabilities:
Query or enumerate registry value

Disassembly:
mov ebx, 0x40000000
mov edi, dword [esi + 4]
test edi, edi
je 0x736de14c
push dword [ebp - 0x10c]
lea eax, [edi + 0x618]
push eax
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
jne 0x736de14c
mov eax, dword [ebp - 0x110]
and eax, 2
jne 0x736e5e57
test dword [edi + 4], 0x40000100
jne 0x736e5e57
test esi, esi
je 0x736db13c
mov eax, dword [0x7371008c]
xor esi, esi
test eax, eax
mov dword [ebp - 0x11c], esi
je 0x736e5e86
mov ecx, dword [eax + 0x14]
cmp ecx, dword [ebp - 0x130]
jne 0x736de15c
cmp dword [eax + 4], edi
jne 0x736de15c
test eax, eax
je 0x736e5e86
mov ecx, dword [eax + 0x24]
test ecx, ecx
mov eax, dword [eax + 0x5c]
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x120], eax
je 0x736e5e86
test byte [ebp - 0x110], 2
jne 0x736e5ece
test byte [edi + 5], 0x44
je 0x736e5eda
mov eax, dword [ebp - 0x128]
mov ecx, edi
call fcn.736dc91b
mov ebx, eax
test ebx, ebx
je 0x736e5f0d
mov esi, dword [ebx + 4]
mov eax, dword [ebp - 0x134]
push dword [ebp - 0x124]
mov dword [esi + 0x48], eax
call fcn.736dca07
test eax, eax
pop ecx
je 0x736dace4
or byte [edi + 7], 1
cmp dword [ebp - 0x12c], 0
jne 0x736e5f23
mov eax, dword [ebp + 0x14]
or dword [esi + 0xc], eax
or dword [esi + 0x44], 0xffffffff
cmp dword [ebp - 0x11c], 0
jne 0x736e5f2c
mov eax, dword [ebp - 0x120]
mov dword [esi + 0x5c], eax
mov eax, dword [ebp - 0x114]
mov dword [esi + 0x24], eax
mov eax, dword [ebp - 0x138]
mov dword [eax], ebx
xor esi, esi
push dword [0x7370f190]
dec dword [section..data]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
jmp 0x736db2ad
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x7370f39c]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 4
mov dword [ebp - 0x124], eax
mov eax, dword [ebp + 0x10]
pop edi
mov dword [ebp - 0x128], eax
mov eax, dword [ebp + 0x18]
push edi
xor ebx, ebx
push esi
mov dword [ebp - 0x138], esi
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], ebx
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x736e5cad
mov eax, dword [ebp + 0x14]
shr eax, 0x15
not eax
and eax, 1
push eax
mov dword [esi], ebx
call fcn.736d8bbc
test eax, eax
pop ecx
je 0x736e5cb7
push dword [0x7370f190]
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [section..data]
call sub.GDI32.dll_GdiEntry13
mov esi, eax
cmp esi, dword [0x7370f99c]
jne 0x736dcc54
call fcn.736db5cc
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x118]
push eax
push 0x736d1a34
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x736db032
and word [0x7370f3a0], 0x7190
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db3a0
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5cc1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db390
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5cd9
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db380
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5cf1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db36c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5d08
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db35c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5d20
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db348
push dword [ebp - 0x118]
call esi
test eax, eax
je 0x736e5d38
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db33c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5d50
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db324
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5d68
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db30c
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5d80
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db2f8
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5d98
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db2e4
push dword [ebp - 0x118]
mov dword [ebp - 0x110], edi
call esi
test eax, eax
je 0x736e5db0
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x118]
push eax
push 0x736db2c8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x736db091
and byte [0x7370f3a2], 0xfd
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push 0x736db2bc
push dword [ebp - 0x118]
mov dword [ebp - 0x120], edi
call esi
test eax, eax
je 0x736e5dcf
push dword [ebp - 0x118]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x737107d0], 0
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x110], ebx
je 0x736db3aa
test byte [0x7370f3a0], 2
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x11c], ebx
jne 0x736e5de7
mov eax, dword [ebp - 0x130]
cmp eax, ebx
jne 0x736e5e41
xor eax, eax
cmp dword [ebp - 0x124], 2
mov esi, 0x736dca60
je 0x736e5e0f
inc eax
cmp dword [ebp - 0x124], ebx
jne 0x736de10d
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x124], esi
mov ecx, edi
mov edi, esi
mov esi, dword [ebp - 0x124]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x736de3c8
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x10c], 0x736d1a2c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [0x7371008c]
cmp esi, ebx
mov dword [ebp - 0x130], eax
jne 0x736dabf6
push dword [ebp - 0x10c]
call fcn.736d8cce
xor edi, edi
cmp eax, edi
pop ecx
mov dword [ebp - 0x114], eax
je 0x736e5f6d
test byte [ebp - 0x110], 2
jne 0x736e5f77
mov dword [ebp - 0x120], edi
call sub.GDI32.dll_GdiEntry13
push edi
push edi
push dword [ebp - 0x10c]
mov dword [0x7370f99c], eax
push 0xffffffffffffffff
push edi
push edi
push edi
call fcn.736dc175
mov esi, eax
add esp, 0x1c
cmp esi, edi
je 0x736e5f8a
mov eax, dword [ebp - 0x10c]
mov ecx, esi
sub ecx, eax
mov dword [esi + 0x148], 0x902
lea ebx, [ecx + 0x618]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x736db1ae
test byte [esi + 4], 0x20
je 0x736e5fe9
mov edx, esi
call fcn.736d886d
push dword [ebp - 0x120]
push dword [ebp - 0x110]
push esi
call fcn.736dc65d
add esp, 0xc
test eax, eax
je 0x736e5fb8
mov eax, dword [ebp - 0x128]
mov ecx, esi
call fcn.736dc91b
test eax, eax
mov dword [ebp - 0x128], eax
je 0x736e600b
mov eax, dword [ebp - 0x128]
mov edi, dword [eax + 4]
mov eax, dword [ebp - 0x134]
push dword [ebp - 0x124]
mov dword [edi + 0x48], eax
call fcn.736dca07
test eax, eax
pop ecx
je 0x736db227
or byte [esi + 7], 1
cmp dword [ebp - 0x12c], 0
jne 0x736de143
mov eax, dword [ebp + 0x14]
or dword [edi + 0xc], eax
mov eax, dword [ebp - 0x114]
or dword [edi + 0x44], 0xffffffff
mov dword [edi + 0x24], eax
mov eax, dword [ebp - 0x10c]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x736db24d
mov eax, dword [esi + 0x434]
push 0x736d1a2c
add esi, 0x438
push esi
mov dword [edi + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp dword [ebp - 0x11c], 0
je 0x736db28b
cmp dword [ebp - 0x120], 0
jne 0x736db28b
push edi
call fcn.736d8f6c
pop ecx
push dword [0x7370f190]
dec dword [section..data]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x138]
mov dword [ecx], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.736d1331
leave
ret
call fcn.736db3b9
jmp 0x736db0aa
cmp dword [section..data], 1
jne 0x736dadd8
call fcn.736dcc76
mov dword [0x7370f99c], esi
jmp 0x736dadd8
cmp dword [ebp - 0x124], eax
je 0x736e5e1c
cmp dword [ebp - 0x114], ebx
jne 0x736db0f8
push 0x10
push dword [ebp - 0x124]
call dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x736e5e2d
xor eax, eax
inc eax
jmp 0x736db0fe
or byte [edi + 0xd], 0x20
jmp 0x736db234
mov esi, dword [esi + 0x70]
test esi, esi
je 0x736dac3f
jmp 0x736dabfb
mov eax, dword [eax + 0x70]
test eax, eax
je 0x736dac74
jmp 0x736dac5c
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x124]
call 0x736de42e
add esp, 0x10
test eax, eax
je 0x736e5e37
lea eax, [ebp - 0x108]
mov dword [ebp - 0x10c], eax
push 0x737107d0
push dword [ebp - 0x10c]
mov dword [ebp - 0x12c], 1
call dword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
pop ecx
pop ecx
je 0x736db118
jmp 0x736db122
mov eax, 0x80070057
jmp 0x736db2ad
mov eax, 0x887600de
jmp 0x736db2ad
cmp dword [ebp - 0x10c], ebx
je 0x736dae42
or dword [0x7370f3a0], 1
jmp 0x736dae42
cmp dword [ebp - 0x10c], ebx
je 0x736dae73
or dword [0x7370f3a0], 2
jmp 0x736dae73
cmp dword [ebp - 0x10c], ebx
je 0x736daea4
or dword [0x7370f3a0], edi
jmp 0x736daea4
cmp dword [ebp - 0x10c], ebx
je 0x736daed5
or dword [0x7370f3a0], 8
jmp 0x736daed5
cmp dword [ebp - 0x10c], ebx
je 0x736daf06
or dword [0x7370f3a0], 0x10
jmp 0x736daf06
cmp dword [ebp - 0x10c], ebx
je 0x736daf31
or byte [0x7370f3a1], 8
jmp 0x736daf31
cmp dword [ebp - 0x10c], ebx
je 0x736daf62
or dword [0x7370f3a0], 0x20
jmp 0x736daf62
cmp dword [ebp - 0x10c], ebx
je 0x736daf93
or byte [0x7370f3a1], 4
jmp 0x736daf93
cmp dword [ebp - 0x10c], ebx
je 0x736dafc4
or dword [0x7370f3a0], 0x40
jmp 0x736dafc4
cmp dword [ebp - 0x10c], ebx
je 0x736daff5
or byte [0x7370f3a2], 1
jmp 0x736daff5
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
je 0x736db026
or byte [0x7370f3a1], 0x80
mov dword [0x73715664], eax
jmp 0x736db026
cmp dword [ebp - 0x11c], ebx
je 0x736db085
or byte [0x7370f3a2], 2
jmp 0x736db085
push 0x50
mov dword [ebp - 0x110], 2
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor ecx, ecx
inc ecx
cmp eax, ecx
ja 0x736db0c3
mov dword [ebp - 0x114], ecx
jmp 0x736db0c3
or dword [ebp - 0x110], 2
inc eax
jmp 0x736db0f2
or dword [ebp - 0x110], eax
mov dword [ebp - 0x114], eax
jmp 0x736de119
mov esi, 0x80070057
jmp 0x736dad24
mov esi, 0x88760231
jmp 0x736dad24
cmp eax, 0x736d1a2c
mov dword [ebp - 0x10c], eax
jne 0x736de3ff
jmp 0x736db122
test eax, eax
je 0x736e5e6b
mov eax, dword [edi + 4]
test ah, 1
je 0x736e5e6b
test ebx, eax
je 0x736dac3f
cmp dword [edi + 0x5d8], 1
ja 0x736de14c
test dword [edi + 4], ebx
jne 0x736de14c
jmp 0x736dac3f
push dword [ebp - 0x10c]
call fcn.736d8cce
mov esi, eax
test esi, esi
pop ecx
mov dword [ebp - 0x114], esi
jne 0x736e5ea8
mov esi, 0x80004005
jmp 0x736dad24
test byte [edi + 4], 0x20
jne 0x736e5ec3
push esi
call fcn.736fc5d3
test eax, eax
pop ecx
je 0x736e5ebf
or byte [edi + 6], 0x80
jmp 0x736e5ec3
and byte [edi + 6], 0x7f
mov dword [ebp - 0x11c], esi
jmp 0x736dac96
test byte [edi + 5], 1
jne 0x736daca3
jmp 0x736e5f04
mov edx, edi
call fcn.736d886d
mov eax, dword [ebp - 0x110]
shr eax, 1
and eax, 1
push eax
push dword [ebp - 0x110]
push edi
call fcn.736dc65d
add esp, 0xc
test eax, eax
jne 0x736dacad
push esi
call fcn.736dc25c
pop ecx
jmp 0x736e5e9e
push dword [ebp - 0x11c]
call fcn.736dc25c
pop ecx
mov esi, 0x8007000e
jmp 0x736dad24
or byte [esi + 0xd], 0x20
jmp 0x736dacf1
test byte [edi + 5], 1
je 0x736e5f36
push 0
jmp 0x736e5f3c
push dword [ebp - 0x114]
push edi
call sub.GDI32.dll_GdiEntry1
test eax, eax
jne 0x736e5f5c
push dword [ebp - 0x114]
call fcn.736dc25c
pop ecx
mov esi, 0x88760233
jmp 0x736dad24
mov eax, dword [edi + 0x434]
mov dword [ebp - 0x120], eax
jmp 0x736dad08
mov esi, 0x88760249
jmp 0x736dad24
test byte [ebp - 0x110], 1
je 0x736e5f90
mov esi, 0x88760233
jmp 0x736e6010
mov dword [ebp - 0x11c], edi
push 0xffffffffffffffff
push edi
push edi
push dword [ebp - 0x10c]
mov dword [ebp - 0x120], 1
push dword [ebp - 0x114]
call fcn.73705aae
mov esi, eax
add esp, 0x14
cmp esi, edi
jne 0x736e5fbf
mov esi, 0x80004005
jmp 0x736e6010
mov eax, dword [ebp - 0x10c]
or dword [esi + 0x14], 1
mov ecx, esi
sub ecx, eax
lea ebx, [ecx + 0x618]
mov cl, byte [eax]
mov byte [ebx + eax], cl
inc eax
test cl, cl
jne 0x736e5fd3
push esi
call fcn.736d8c3e
pop ecx
jmp 0x736db1b8
push dword [ebp - 0x114]
call fcn.736fc5d3
test eax, eax
pop ecx
je 0x736e6002
or byte [esi + 6], 0x80
jmp 0x736db1c2
and byte [esi + 6], 0x7f
jmp 0x736db1c2
mov esi, 0x8007000e
push dword [0x7370f190]
dec dword [section..data]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x114]
call fcn.736dc25c
pop ecx
jmp 0x736dad36