Function at 0x8704c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
mov byte [ebp - 0x168], 0
cmp eax, ecx
je 0x87075
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ecx
je 0x8707e
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0x87087
mov byte [eax], cl
mov eax, dword [ebp + 0x18]
cmp eax, ecx
je 0x87090
mov byte [eax], cl
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x101
push ecx
mov ebx, 0xc8
push ebx
lea edi, [ebx + 0x1c]
push edi
push 0x2e
push 0x906ac
mov esi, 0x922f8
push esi
call fcn.00082544
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x871b8
call fcn.00086dc2
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 4], eax
push eax
jmp 0x8719b
test eax, eax
jne 0x8716e
cmp dword [ebp - 0x14], eax
jbe 0x8716e
cmp dword [ebp - 0xc], eax
jbe 0x8716e
cmp dword [ebp - 0x18], 1
jne 0x8716e
push ebx
push edi
push 9
push 0x906a0
push esi
call fcn.00082544
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0008eed1
add esp, 0x1c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
jne 0x871d0
lea eax, [ebp - 0x3c]
push eax
call fcn.00086cad
pop ecx
test eax, eax
je 0x8715e
lea eax, [ebp - 0x3c]
push eax
call fcn.0008f1a5
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, 0x61616161
cmp eax, ecx
je 0x871d0
push 0x100
push 0
push esi
call fcn.0008ee2a
add esp, 0xc
inc dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0x870fb
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push 0
push esi
call fcn.0008ee2a
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push ebx
push edi
push 4
push 0x9069c
push esi
call fcn.00082544
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0008ee95
push 0x100
push 0
push esi
mov dword [ebp - 4], eax
call fcn.0008ee2a
add esp, 0x28
cmp dword [ebp - 4], 0
je 0x87227
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x87222
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0008ef00
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x871cb
cmp byte [ebp - 0x168], 0x22
jne 0x8725b
lea eax, [ebp - 0x167]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0008ef00
lea eax, [ebp - 0x168]
push 0x22
push eax
call fcn.0008ed23
add esp, 0x10
test eax, eax
je 0x8725b
mov byte [eax], 0
push ebx
push edi
push 5
push 0x90694
push esi
call fcn.00082544
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.0008ee95
push 0x100
xor ebx, ebx
push ebx
push esi
mov edi, eax
call fcn.0008ee2a
add esp, 0x28
cmp edi, ebx
jne 0x872b8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0x872aa
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0008ef00
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 0x10], ebx
sete al
inc eax
jmp 0x871cb
push dword [ebp + 8]
lea eax, [ebp - 0x168]
push eax
call fcn.0008ed77
pop ecx
pop ecx
test eax, eax
jne 0x872dd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x871cb
lea eax, [ebp - 0x168]
push 0x5c
push eax
mov byte [edi], bl
call fcn.0008ed23
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x87301
lea eax, [ebp - 0x168]
mov dword [ebp - 4], eax
jmp 0x87304
inc dword [ebp - 4]
push dword [ebp - 4]
call fcn.00086cad
pop ecx
test eax, eax
jne 0x87335
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0x8732d
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.0008ef00
pop ecx
pop ecx
mov byte [edi], 0x2e
jmp 0x872aa
popal
popal
popal
popal
push 0x8b00007e
invalid