Function at 0x7cdc00aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x480
mov eax, dword [ebp + 0xc]
and dword [ebp - 4], 0
push ebx
push esi
test byte [eax], 8
push edi
mov dword [ebp - 8], 1
je 0x7cdc012d
mov eax, dword [ebp + 8]
mov eax, dword [eax]
test eax, eax
je 0x7cdc012d
lea ecx, [ebp - 0x60]
push 0x50
push ecx
push eax
call sym.ole32.dll_StringFromGUID2
test eax, eax
je 0x7cdc0148
lea eax, [ebp - 0x278]
push 0x7cd736c8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x13
lea esi, [ebp - 0x60]
pop ecx
lea edi, [ebp - 0x26c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 4]
mov ebx, 0x20019
push eax
lea eax, [ebp - 0x278]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.7cde47c4
mov eax, dword [ebp + 8]
mov edi, 0x7ce4f0b8
mov esi, dword [eax]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x7cdc0231
mov edi, 0x104
lea eax, [ebp - 0x480]
push edi
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov esi, eax
cmp esi, edi
jb 0x7cdc0152
mov eax, 0x8001ffff
jmp 0x7cdc02f9
lea edi, [esi - 1]
test edi, edi
jbe 0x7cdc017e
lea eax, [ebp + edi*2 - 0x480]
mov cx, word [eax]
cmp cx, 0x2f
je 0x7cdc017c
cmp cx, 0x5c
je 0x7cdc017c
cmp cx, 0x3a
je 0x7cdc017c
dec edi
dec eax
dec eax
test edi, edi
ja 0x7cdc0160
test edi, edi
je 0x7cdc0181
inc edi
lea eax, [ebp - 0x278]
push 0x7cd736c8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
sub esi, edi
mov ebx, 0x20019
lea ecx, [esi + esi + 2]
lea esi, [ebp + edi*2 - 0x480]
mov eax, ecx
lea edi, [ebp - 0x26c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 4]
push eax
and ecx, 3
lea eax, [ebp - 0x278]
push ebx
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.7cde47c4
test eax, eax
jne 0x7cdc0231
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x50
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x7cd736bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
test esi, esi
jne 0x7cdc0231
cmp dword [ebp - 0x10], 1
jne 0x7cdc0231
cmp dword [ebp - 0xc], 0x4e
jne 0x7cdc0231
push 0x13
lea esi, [ebp - 0x60]
pop ecx
lea edi, [ebp - 0x26c]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x278]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.7cde47c4
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
xor edi, edi
push dword [ebp - 4]
mov dword [eax], edi
call fcn.7cdc0300
cmp dword [esi], 1
je 0x7cdc02cf
xor esi, esi
cmp dword [ebp - 4], esi
je 0x7cdc0279
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x7cd73698
push dword [ebp - 4]
call fcn.7cdc035c
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
cmp dword [ebp - 8], esi
je 0x7cdc02d1
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x7cd73668
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x7cdc02c7
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x7cd73638
push dword [ebp - 4]
call fcn.7cdc035c
cmp dword [ebp - 8], esi
mov edi, eax
je 0x7cdc02d1
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.7cdc0837
mov edi, eax
jmp 0x7cdc02d1
or edi, 0x80070000
jmp 0x7cdc02d1
xor esi, esi
cmp edi, esi
jge 0x7cdc02e9
mov ebx, dword [ebp + 8]
push dword [ebx]
push esi
push dword [0x7ce50ed0]
call dword [0x7ce4df64]
mov dword [ebx], esi
cmp dword [ebp - 4], esi
je 0x7cdc02f7
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0xc