Function at 0xd9704c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
mov byte [ebp - 0x168], 0
cmp eax, ecx
je 0xd97075
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
cmp eax, ecx
je 0xd9707e
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
cmp eax, ecx
je 0xd97087
mov byte [eax], cl
mov eax, dword [ebp + 0x18]
cmp eax, ecx
je 0xd97090
mov byte [eax], cl
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x101
push ecx
mov ebx, 0xc8
push ebx
lea edi, [ebx + 0x1c]
push edi
push 0x2e
push 0xda06ac
mov esi, 0xda22f8
push esi
call fcn.00d92544
add esp, 0x14
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
or eax, eax
jne 0xd971b8
call fcn.00d96dc2
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x168]
push ecx
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x1c], eax
xor eax, eax
push eax
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x3c]
push ecx
mov dword [ebp - 4], eax
push eax
jmp 0xd9719b
or eax, eax
jne 0xd9716e
cmp dword [ebp - 0x14], eax
jbe 0xd9716e
cmp dword [ebp - 0xc], eax
jbe 0xd9716e
cmp dword [ebp - 0x18], 1
jne 0xd9716e
push ebx
push edi
push 9
push 0xda06a0
push esi
call fcn.00d92544
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00d9eed1
add esp, 0x1c
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
jne 0xd971d0
lea eax, [ebp - 0x3c]
push eax
call fcn.00d96cad
pop ecx
or eax, eax
je 0xd9715e
lea eax, [ebp - 0x3c]
push eax
call fcn.00d9f1a5
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, 0x55555555
cmp eax, ecx
je 0xd971d0
push 0x100
push 0
push esi
call fcn.00d9ee2a
add esp, 0xc
inc dword [ebp - 4]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x12c
mov dword [ebp - 0x14], 0x20
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0x103
jne 0xd970fb
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100
push 0
push esi
call fcn.00d9ee2a
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push ebx
push edi
push 4
push 0xda069c
push esi
call fcn.00d92544
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.00d9ee95
push 0x100
push 0
push esi
mov dword [ebp - 4], eax
call fcn.00d9ee2a
add esp, 0x28
cmp dword [ebp - 4], 0
je 0xd97227
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0xd97222
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.00d9ef00
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0xd971cb
cmp byte [ebp - 0x168], 0x22
jne 0xd9725b
lea eax, [ebp - 0x167]
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.00d9ef00
lea eax, [ebp - 0x168]
push 0x22
push eax
call fcn.00d9ed23
add esp, 0x10
or eax, eax
je 0xd9725b
mov byte [eax], 0
push ebx
push edi
push 5
push 0xda0694
push esi
call fcn.00d92544
push eax
lea eax, [ebp - 0x168]
push eax
call fcn.00d9ee95
push 0x100
sub ebx, ebx
push ebx
push esi
mov edi, eax
call fcn.00d9ee2a
add esp, 0x28
cmp edi, ebx
jne 0xd972b8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0xd972aa
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.00d9ef00
pop ecx
pop ecx
sub eax, eax
cmp dword [ebp - 0x10], ebx
sete al
inc eax
jmp 0xd971cb
push dword [ebp + 8]
lea eax, [ebp - 0x168]
push eax
call fcn.00d9ed77
pop ecx
pop ecx
or eax, eax
jne 0xd972dd
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0xd971cb
lea eax, [ebp - 0x168]
push 0x5c
push eax
mov byte [edi], bl
call fcn.00d9ed23
pop ecx
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0xd97301
lea eax, [ebp - 0x168]
mov dword [ebp - 4], eax
jmp 0xd97304
inc dword [ebp - 4]
push dword [ebp - 4]
call fcn.00d96cad
pop ecx
or eax, eax
jne 0xd97335
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], ebx
je 0xd9732d
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.00d9ef00
pop ecx
pop ecx
mov byte [edi], 0x2e
jmp 0xd972aa
push dword [ebp - 4]
call fcn.00d9f1a5
push eax
pop esi
xor esi, 0x55555555
push esi
pop ebx
shr ebx, 8
push esi
mov dword [ebp - 0xc], esi
and ebx, 0xff
call fcn.00d96c96
pop ecx
pop ecx
test eax, eax
jne 0xd973d5
lea eax, [ebx - 0x40]
cmp eax, 0x3f
ja 0xd973d5
and esi, 0xff
cmp esi, 0x10
jge 0xd973d5
mov esi, dword [ebp + 0x10]
mov byte [edi], 0x2e
sub edi, edi
cmp esi, edi
je 0xd9739d
lea eax, [ebp - 0x18c]
push eax
push edi
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0xd9739d
mov dword [esi], 1
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0xd973a6
mov dword [eax], ebx
cmp dword [ebp + 0x14], edi
je 0xd973b9
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.00d9ef00
pop ecx
pop ecx
cmp dword [ebp + 0x18], edi
je 0xd973cb
push dword [ebp - 4]
push dword [ebp + 0x18]
call fcn.00d9ef00
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 0x10], edi
jmp 0xd972af
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0xd973f2
lea eax, [ebp - 0x3c]
push eax
push dword [ebp + 0x14]
call fcn.00d9ef00
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 0x10], eax
mov byte [edi], 0x2e
jmp 0xd972af