Function at 0x8c0cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1128
call fcn.00a91950
mov eax, dword [0xb196ec]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0x111c], ecx
mov dword [ebp - 0x1120], ebx
cmp dword [0xb387d4], ebx
je 0x8c0d35
mov ecx, dword [0xbe7f54]
cmp eax, ebx
jne 0x8c0d48
cmp ecx, ebx
jne 0x8c0fe6
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x8c0fe6
mov eax, dword [0xbc27fc]
cmp eax, ebx
je 0x8c0d6e
push ebx
push eax
push str.Reading_BFList...
push 0xb54ce8
call fcn.008808e0
add esp, 0x10
mov eax, dword [0xbe7f54]
cmp eax, ebx
je 0x8c0d86
push eax
call fcn.00a78fec
add esp, 4
mov dword [0xbe7f54], ebx
lea edx, [ebp - 0x1120]
push edx
push 9
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockFiles
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp esi, ebx
jne 0x8c0d35
push 0x3ff
lea eax, [ebp - 0xd13]
push ebx
push eax
call fcn.00a7ffb0
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0x40b]
push ebx
push ecx
call fcn.00a7ffb0
add esp, 0xc
lea edx, [ebp - 0x1124]
push edx
lea eax, [ebp - 0xd14]
push eax
mov eax, dword [ebp - 0x1120]
push ebx
push ebx
lea ecx, [ebp - 0x1128]
push ecx
lea edx, [ebp - 0x40c]
push edx
push ebx
mov esi, 0x400
push eax
mov dword [ebp - 0x111c], ebx
mov byte [ebp - 0xd14], bl
mov byte [ebp - 0x40c], bl
mov dword [ebp - 0x1128], esi
mov dword [ebp - 0x1124], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x8c0fbe
cmp byte [ebp - 0x40c], bl
je 0x8c0f65
push 0x3ff
lea ecx, [ebp - 0x913]
push ebx
push ecx
mov byte [ebp - 0x914], bl
call fcn.00a7ffb0
add esp, 0xc
lea eax, [ebp - 0x40c]
jmp 0x8c0e60
inc eax
cmp byte [eax], bl
jne 0x8c0e60
cmp byte [eax - 1], 0x5c
je 0x8c0f65
lea edx, [ebp - 0x40c]
push 0x5c
push edx
call fcn.00a7aa50
add esp, 8
cmp eax, ebx
je 0x8c0e8f
inc eax
push eax
lea eax, [ebp - 0x914]
push eax
jmp 0x8c0e9d
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0x914]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, 0x11
mov esi, str._sysdir_.EXE___windir_.EXE___sysdir_drivers.SYS__sysdir_.DLL
lea edi, [ebp - 0x1114]
rep movsd dword es:[edi], dword [esi]
push 0x3ba
lea eax, [ebp - 0x10ce]
push ebx
push eax
movsw word es:[edi], word [esi]
call fcn.00a7ffb0
add esp, 0xc
lea ecx, [ebp - 0x1118]
push ecx
lea edx, [ebp - 0x1114]
mov dword [ebp - 0x1118], ebx
push edx
mov bl, 0x2c
lea edi, [ebp - 0x40c]
call fcn.0095ae80
or esi, 0xffffffff
add esp, 8
cmp dword [ebp - 0x1118], esi
je 0x8c0f49
jmp 0x8c0f00
push 1
lea eax, [ebp - 0x40c]
push eax
call fcn.00977760
lea eax, [ebp - 0x40c]
lea ecx, [ebp - 0x914]
call fcn.0094c330
test eax, eax
je 0x8c0f5e
lea ecx, [ebp - 0x1118]
push ecx
lea edx, [ebp - 0x1114]
push edx
mov bl, 0x2c
lea edi, [ebp - 0x40c]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x1118], esi
jne 0x8c0f00
push 0
push 0x2c
lea eax, [ebp - 0x914]
push eax
mov edi, 0xbe7f54
call fcn.0098d640
xor ebx, ebx
mov esi, 0x400
mov eax, dword [ebp - 0x111c]
lea ecx, [ebp - 0x1124]
push ecx
lea edx, [ebp - 0xd14]
push edx
push ebx
push ebx
lea ecx, [ebp - 0x1128]
push ecx
inc eax
lea edx, [ebp - 0x40c]
push edx
push eax
mov dword [ebp - 0x111c], eax
mov eax, dword [ebp - 0x1120]
push eax
mov byte [ebp - 0xd14], bl
mov byte [ebp - 0x40c], bl
mov dword [ebp - 0x1128], esi
mov dword [ebp - 0x1124], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x8c0e2e
mov eax, dword [ebp - 0x1120]
cmp eax, ebx
je 0x8c0d35
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x1118]
push edx
mov dword [ebp - 0x1118], ebx
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x514]
call fcn.0095ae80
or esi, 0xffffffff
add esp, 8
cmp dword [ebp - 0x1118], esi
je 0x8c0d35
mov ecx, dword [ebp - 0x111c]
lea eax, [ebp - 0x514]
call fcn.0094c330
test eax, eax
je 0x8c1061
mov ecx, dword [0xbe7f54]
lea eax, [ebp - 0x1118]
push eax
push ecx
mov bl, 0x2c
lea edi, [ebp - 0x514]
call fcn.0095ae80
add esp, 8
cmp dword [ebp - 0x1118], esi
jne 0x8c1013
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00a78f21
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00a78f21
mov esp, ebp
pop ebp
ret