Function at 0x2178198
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
call fcn.02177d41
mov dword [ebp - 4], eax
test eax, eax
jne 0x21787c5
mov ecx, 0x218cb74
call fcn.0217c661
test eax, eax
je 0x21787c5
push 0x218cbf0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x218cc08
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x218cc38
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x218cc20
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x28
call fcn.02171697
add esp, 4
test eax, eax
je 0x217820f
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.02177ea3
mov dword [0x218c318], eax
jmp 0x2178219
mov dword [0x218c318], 0
push 0x28
call fcn.02171697
add esp, 4
test eax, eax
je 0x2178239
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.02177ea3
mov dword [0x218c314], eax
jmp 0x2178243
mov dword [0x218c314], 0
cmp dword [ebp - 4], 0
jne 0x21787c5
call fcn.021795e6
push 2
call fcn.02179a24
mov dword [ebp - 4], 0
push 0x10
call fcn.02171697
add esp, 4
test eax, eax
je 0x2178282
push 0x10
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.02178053
mov dword [0x218c31c], eax
jmp 0x217828c
mov dword [0x218c31c], 0
cmp dword [ebp - 4], 0
je 0x21782b6
mov esi, dword [0x218c31c]
test esi, esi
je 0x21782ac
mov ecx, esi
call fcn.0217cb86
push esi
call fcn.02171305
add esp, 4
mov dword [0x218c31c], 0
push 0x10
call fcn.02171697
add esp, 4
test eax, eax
je 0x21782db
push 0xb0
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.02178053
mov dword [0x218c328], eax
jmp 0x21782e5
mov dword [0x218c328], 0
cmp dword [ebp - 4], 0
je 0x217830f
mov esi, dword [0x218c328]
test esi, esi
je 0x2178305
mov ecx, esi
call fcn.0217cb86
push esi
call fcn.02171305
add esp, 4
mov dword [0x218c328], 0
push 0x14
xor ebx, ebx
call fcn.02171697
add esp, 4
mov esi, eax
test esi, esi
je 0x217838a
mov dword [esi + 4], 0x10
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov eax, dword [esi + 4]
shl eax, 3
push eax
call fcn.02171697
add esp, 4
mov edi, eax
mov dword [esi], eax
cmp edi, ebx
jne 0x2178351
mov dword [ebp - 4], 0xe
jmp 0x2178382
mov ecx, dword [esi + 4]
xor eax, eax
shl ecx, 3
shr ecx, 2
rep stosd dword es:[edi], eax
xor edi, edi
cmp dword [esi + 4], eax
jbe 0x217837b
xor ebx, ebx
inc edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi]
mov dword [ecx + ebx], eax
add ebx, 8
cmp dword [esi + 4], edi
ja 0x2178367
mov dword [ebp - 4], 0
mov dword [0x218c334], esi
jmp 0x2178394
mov dword [0x218c334], 0
xor esi, esi
cmp dword [ebp - 4], esi
je 0x21783af
mov eax, dword [0x218c334]
push eax
call fcn.02171305
add esp, 4
mov dword [0x218c334], esi
push 0x10
call fcn.02171697
add esp, 4
test eax, eax
je 0x21783d1
push 0x10
lea ecx, [ebp - 4]
push ecx
mov ecx, eax
call fcn.02178053
mov dword [0x218c320], eax
jmp 0x21783db
mov dword [0x218c320], 0
cmp dword [ebp - 4], 0
je 0x2178405
mov esi, dword [0x218c320]
test esi, esi
je 0x21783fb
mov ecx, esi
call fcn.0217cb86
push esi
call fcn.02171305
add esp, 4
mov dword [0x218c320], 0
push 0x10
call fcn.02171697
add esp, 4
mov ecx, eax
test ecx, ecx
je 0x2178427
push 0x40
lea eax, [ebp - 4]
push eax
call fcn.02178053
mov dword [0x218c330], eax
jmp 0x2178431
mov dword [0x218c330], 0
cmp dword [ebp - 4], 0
je 0x217845b
mov esi, dword [0x218c330]
test esi, esi
je 0x2178451
mov ecx, esi
call fcn.0217cb86
push esi
call fcn.02171305
add esp, 4
mov dword [0x218c330], 0
push 0x10
call fcn.02171697
add esp, 4
mov ecx, eax
test ecx, ecx
je 0x217847d
push 0x10
lea eax, [ebp - 4]
push eax
call fcn.02178053
mov dword [0x218c338], eax
jmp 0x2178487
mov dword [0x218c338], 0
cmp dword [ebp - 4], 0
je 0x21784b1
mov esi, dword [0x218c338]
test esi, esi
je 0x21784a7
mov ecx, esi
call fcn.0217cb86
push esi
call fcn.02171305
add esp, 4
mov dword [0x218c338], 0
push 0x10
call fcn.02171697
add esp, 4
mov ecx, eax
test ecx, ecx
je 0x21784d3
push 0x10
lea eax, [ebp - 4]
push eax
call fcn.02178053
mov dword [0x218c340], eax
jmp 0x21784dd
mov dword [0x218c340], 0
cmp dword [ebp - 4], 0
je 0x2178507
mov esi, dword [0x218c340]
test esi, esi
je 0x21784fd
mov ecx, esi
call fcn.0217cb86
push esi
call fcn.02171305
add esp, 4
mov dword [0x218c340], 0
push 0x24
call fcn.02171697
add esp, 4
mov esi, eax
xor eax, eax
test esi, esi
je 0x2178537
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [esi + 8], 0x78
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x218c324], esi
jmp 0x2178541
mov dword [0x218c324], 0
push 0x24
call fcn.02171697
add esp, 4
mov esi, eax
xor eax, eax
test esi, esi
je 0x2178571
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [esi + 8], 0x168
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x218c32c], esi
jmp 0x217857b
mov dword [0x218c32c], 0
push 0x24
call fcn.02171697
add esp, 4
mov esi, eax
xor eax, eax
test esi, esi
je 0x21785ab
mov dword [esi], eax
mov dword [esi + 4], eax
lea eax, [esi + 0xc]
mov dword [esi + 8], 0x78
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x218c33c], esi
jmp 0x21785b5
mov dword [0x218c33c], 0
push 8
call fcn.02171697
add esp, 4
xor ecx, ecx
test eax, eax
je 0x21785d1
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [0x218c344], eax
jmp 0x21785db
mov dword [0x218c344], 0
push 0xc
call fcn.02171697
add esp, 4
xor ecx, ecx
test eax, eax
je 0x21785fe
mov dword [eax], 0x40
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [0x218c360], eax
jmp 0x2178608
mov dword [0x218c360], 0
xor esi, esi
cmp dword [ebp - 4], esi
jne 0x21787c5
cmp dword [0x218c314], esi
je 0x21787c5
cmp dword [0x218c318], esi
je 0x21787c5
cmp dword [0x218c31c], esi
je 0x21787c5
cmp dword [0x218c320], esi
je 0x21787c5
cmp dword [0x218c324], esi
je 0x21787c5
cmp dword [0x218c328], esi
je 0x21787c5
cmp dword [0x218c32c], esi
je 0x21787c5
cmp dword [0x218c330], esi
je 0x21787c5
cmp dword [0x218c340], esi
je 0x21787c5
cmp dword [0x218c334], esi
je 0x21787c5
cmp dword [0x218c338], esi
je 0x21787c5
cmp dword [0x218c33c], esi
je 0x21787c5
cmp dword [0x218c344], esi
je 0x21787c5
cmp dword [0x218c360], esi
je 0x21787c5
mov dword [ebp - 0xc], 0x76
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push dword [0x21870b0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x217873f
mov eax, dword [0x218c300]
push eax
call fcn.02171305
add esp, 4
mov eax, dword [ebp - 0xc]
inc eax
and al, 0xfe
push eax
call fcn.02171697
add esp, 4
mov dword [0x218c300], eax
cmp eax, esi
je 0x21787c5
lea eax, [ebp - 0xc]
lea edx, [ebp - 0x10]
push eax
mov eax, dword [str.DCOM_Protocols]
push dword [0x218c300]
push edx
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp eax, 0xea
je 0x21786e4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x217874b
cmp dword [ebp - 0x10], 7
je 0x2178763
mov eax, dword [0x218c300]
push eax
call fcn.02171305
mov dword [0x218c300], 0
add esp, 4
push str.ncalrpc
call fcn.02172b01
push eax
call fcn.021780b0
mov dword [ebp - 4], eax
test eax, eax
jne 0x21787ca
push 2
xor esi, esi
call fcn.02179a24
mov dword [0x218c310], esi
call fcn.021734ef
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x21787ca
push 2
xor esi, esi
call fcn.02179a24
call fcn.0217c317
push esi
mov eax, dword [0x218cad0]
push esi
push eax
call sub.RPCRT4.dll_RpcServerRegisterIf
push esi
mov dword [ebp - 4], eax
push esi
mov eax, dword [0x218caa0]
push eax
call sub.RPCRT4.dll_RpcServerRegisterIf
mov dword [ebp - 4], eax
jmp 0x21787ca
mov eax, 0xe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret