Function at 0x10009ed3
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [ebp + 0x10]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10009ee4
mov edx, dword [ebp + 0x14]
sub eax, ecx
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
mov ecx, 0x20000
lea eax, [ebp - 0x34]
neg ebx
call fcn.10007b06
mov esi, 0x10000
mov edx, eax
call fcn.10007b4f
mov dword [ebp - 8], eax
call fcn.10007b4f
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
or edi, 0x20019
push edi
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x10009f49
push eax
push 0x3f
call fcn.10001ad4
pop ecx
pop ecx
jmp 0x1000a0c1
mov dword [ebp - 0xc], esi
mov edi, 0x4000
push edi
push esi
push dword [ebp - 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x10000
call fcn.1001c790
add esp, 0xc
push dword [ebp - 0x18]
push esi
push dword [ebp - 0x10]
call fcn.1001c790
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
je 0x1000a00e
cmp eax, esi
jne 0x1000a073
cmp ebx, esi
je 0x10009fd6
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x10009fcd
test cl, cl
je 0x10009fc9
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x10009fcd
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x10009faf
xor eax, eax
jmp 0x10009fd2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1000a00e
push dword [ebp - 8]
mov esi, dword [ebp + 0x18]
push str.__24s
call fcn.100017f3
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
test eax, eax
jbe 0x1000a003
cmp eax, 2
jbe 0x1000a069
cmp eax, 3
je 0x1000a02a
cmp eax, 4
je 0x1000a018
cmp eax, 7
je 0x1000a069
push 0x1002d9c0
call fcn.100017f3
pop ecx
inc dword [ebp - 0xc]
xor esi, esi
jmp 0x10009f51
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x1002da80
call fcn.100017f3
pop ecx
jmp 0x1000a00d
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x18], 0
jbe 0x1000a003
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
movsx eax, byte [ecx + eax]
and eax, 0xff
push eax
cmp eax, 0xf
ja 0x1000a050
push 0x1002da84
jmp 0x1000a055
push 0x1002da88
call fcn.100017f3
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
cmp eax, dword [ebp - 0x18]
jb 0x1000a034
jmp 0x1000a003
push dword [ebp - 0x10]
push 0x1002d578
jmp 0x1000a022
mov dword [ebp - 0xc], esi
cmp ebx, esi
jne 0x1000a0b8
push edi
push 0
push dword [ebp - 8]
mov dword [ebp - 0x1c], edi
call fcn.1001c790
add esp, 0xc
push dword [ebp - 0x1c]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1000a0b8
push dword [ebp - 8]
mov esi, dword [ebp + 0x18]
push str._s_n
call fcn.100017f3
inc dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x1000a07a
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret