Function at 0xf777545
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov ecx, 0xffffffff
sub eax, eax
mov edi, dword [ebx + 4]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0xf7b3468
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x98]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebx + 8]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov ecx, 0xffffffff
lea edi, [ebp - 0x98]
sub eax, eax
repne scasb al, byte es:[edi]
dec edi
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [ebp - 4]
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x98]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0xf777608
mov dword [ebp - 4], esi
test eax, eax
jne 0xf777790
lea eax, [ebp - 8]
lea ecx, [ebp - 0x19c]
mov dword [ebp - 8], 0x104
push eax
push ecx
push str.Clsid
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0xf777787
lea eax, [ebp - 0x19c]
shr eax, 0x10
test ax, ax
lea eax, [ebp - 0x19c]
je 0xf777672
lea edi, [ebp - 0x19c]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2 + 3]
and al, 0xfc
call fcn.0f7270c0
mov eax, esp
lea ecx, [ebp - 0x19c]
push ecx
push eax
call fcn.0f72a0e0
lea ecx, [ebp - 0x18]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
test eax, eax
jl 0xf777787
lea esi, [ebp - 0x18]
mov ecx, 0x10
lea edi, [ebx + 0x10]
repe cmpsb byte [esi], byte es:[edi]
jne 0xf777787
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebx + 0x38], 0
jne 0xf7776b8
xor eax, eax
lea esp, [ebp - 0x1a8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edi, str.Clsid_
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp - 0x98]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.Clsid_
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, pe_nt_image_headers32
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
sub edi, eax
push edi
push str.Clsid_
call esi
lea eax, [ebp + eax - 0x98]
push eax
lea eax, [ebx + 0x10]
push eax
call fcn.0f73c4d0
mov esi, dword [ebp - 4]
lea ecx, [ebp - 4]
push ecx
lea eax, [ebp - 0x98]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0xf777731
mov dword [ebp - 4], esi
test eax, eax
jne 0xf777790
cmp dword [ebx + 0x3c], 0
mov ecx, str.LocalServer32
je 0xf777741
mov ecx, str.InprocServer32
lea eax, [ebp - 8]
lea edx, [ebp - 0x19c]
mov dword [ebp - 8], 0x104
push eax
mov esi, 1
push edx
push ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0xf777777
push dword [ebx]
lea ecx, [ebp - 0x19c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xf7776a9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0xf7776a9