Function at 0x7c81baa3
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x7c8856cc]
mov ecx, dword [ebp + 0x18]
or dword [ecx], 0xffffffff
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0xc]
push edi
mov edi, dword [eax + 0xc]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [eax + 0x10]
xor ebx, ebx
and edi, 0xf0000000
cmp ecx, ebx
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x25], bl
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x54], edi
je 0x7c82ad57
lea esi, [ecx + 4]
cmp word [esi], bx
je 0x7c82ad57
cmp edx, ebx
je 0x7c81bb0c
test edi, 0x20000000
mov byte [ebp - 0x1d], 1
jne 0x7c81bb0f
mov byte [ebp - 0x1d], bl
test edi, edi
js 0x7c83343e
test edi, 0x40000000
je 0x7c82ad3f
mov dword [ebp - 0x24], 0x7c885398
mov eax, dword [ebp - 0x24]
movzx eax, word [eax]
inc eax
inc eax
movzx ecx, word [esi]
mov dword [ebp - 0x40], edi
and dword [ebp - 0x40], 0x10000000
lea esi, [eax + ecx + 2]
jne 0x7c83b916
cmp byte [ebp - 0x1d], bl
jne 0x7c83b926
inc esi
inc esi
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
cmp eax, ebx
mov dword [ebp - 0x2c], eax
je 0x7c83b935
cmp dword [ebp - 0x24], ebx
mov edi, dword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
mov word [ebp - 0x2e], si
mov esi, dword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
mov word [ebp - 0x30], bx
je 0x7c81bba0
push dword [ebp - 0x24]
lea eax, [ebp - 0x30]
push eax
call esi
push 0x7c81ba60
lea eax, [ebp - 0x30]
push eax
call edi
mov eax, dword [ebp - 0x4c]
add eax, 4
push eax
lea eax, [ebp - 0x30]
push eax
call esi
cmp dword [ebp - 0x40], ebx
jne 0x7c83b93f
cmp byte [ebp - 0x1d], bl
jne 0x7c83b95c
mov esi, 0x7c885078
push esi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
cmp dword [0x7c885074], 0xffffffff
je 0x7c81be32
mov eax, dword [0x7c885060]
cmp eax, dword [ebp - 0x4c]
jne 0x7c81be32
mov eax, dword [0x7c885064]
cmp eax, dword [ebp - 0x54]
jne 0x7c81be32
mov al, byte [ebp + 0x14]
cmp byte [0x7c885068], al
jne 0x7c81be32
push 1
lea eax, [ebp - 0x30]
push eax
push 0x7c88506c
call dword [sym.imp.ntdll.dll_RtlEqualUnicodeString]
test al, al
je 0x7c81be32
lea eax, [ebp - 0x38]
push eax
push 0x18
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [0x7c885074]
call dword [sym.imp.ntdll.dll_NtQueryKey]
cmp eax, 0xc000017c
je 0x7c81be32
mov eax, dword fs:[0x18]
push dword [ebp - 0x2c]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push 2
push ebx
push ebx
push dword [ebp - 0x3c]
push 0xffffffffffffffff
push dword [0x7c885074]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push esi
mov edi, eax
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 0x14
push esi
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
call fcn.7c81ba20
cmp byte [ebp + 0x14], bl
lea eax, [ebp - 0x30]
mov dword [ebp - 0x6c], 0x18
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x60], 0xc0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
jne 0x7c82ad14
lea eax, [ebp - 0x6c]
push eax
push 0x80000000
push dword [ebp - 0x3c]
call dword [sym.imp.ntdll.dll_NtOpenKey]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jl 0x7c83b9f4
push esi
call dword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
mov eax, dword [ebp - 0x4c]
mov dword [0x7c885060], eax
mov eax, dword [ebp - 0x54]
mov dword [0x7c885064], eax
mov al, byte [ebp + 0x14]
mov byte [0x7c885068], al
mov eax, dword [ebp - 0x30]
mov dword [0x7c88506c], eax
mov eax, dword [ebp - 0x2c]
mov dword [0x7c885070], eax
mov eax, dword [0x7c885074]
cmp eax, 0xffffffff
jne 0x7c83b9e8
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
push 2
push ebx
push ebx
push eax
push 0xffffffffffffffff
mov dword [0x7c885074], ecx
push dword [eax]
push 0xffffffffffffffff
call dword [sym.imp.ntdll.dll_NtDuplicateObject]
push esi
mov dword [ebp - 0x24], eax
call dword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
mov eax, dword [ebp - 0x24]
jmp 0x7c81bc76
mov edi, dword [sym.imp.ntdll.dll_NtCreateKey]
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6c]
push eax
push 0x2000f
push dword [ebp - 0x3c]
call edi
cmp eax, 0xc0000034
mov dword [ebp - 0x24], eax
jne 0x7c81be79
jmp 0x7c82ad49
mov dword [ebp - 0x24], ebx
xor eax, eax
jmp 0x7c81bb32
cmp byte [ebp - 0x25], bl
je 0x7c83b975
jmp 0x7c81be79
xor eax, eax
jmp 0x7c81bc76
sti
fstp dword [edx + 0x15]
fistp word [ebx - 0x1ae42072]
das
dec esp
pop ebx
xor eax, 0x4481f8a3
mov byte [0xbdd5923a], al
pop edi
outsb dx, byte [esi]
cmp dword [eax], esp
adc al, 0xb6
mov al, byte [0xc4c4fe6e]
or al, byte [edi + 0x31]
sbb dword [edx + 0x67], ecx
int3
adc dword [ecx - 0x68], 0x6f330c37
mov eax, 0x3eb31f4b
sbb al, 0x7b
les edi, [edi - 0x7c]
imul esi, dword [edx + edx*8 + 0xd6b8b89], 0xffffffd2
out 0x5b, al
in al, 0x45
push esi
xlatb
xchg dword [ebp - 0x62b501ba], esi
and ebx, dword [esi - 0x69]
stosd dword es:[edi], eax
lcall 0x3b83, 0x79b88e42
or ebp, edx
sbb dword [eax - 0x43], edi
outsd dx, dword [esi]
xor byte [esi + esi*8 + 0x22], ch
mov ebp, ebx
ret
stosd dword es:[edi], eax
les edi, [ecx - 0x17f2a0f5]
sal ch, cl
ja 0x7c83ba03
xor dword [edx], edx
adc edi, ecx
mov cl, 0x8e
push cs
sub al, 0x81
sahf
test eax, 0x8e307d78
mov edi, 0xa43fbbe7
ljmp 0x32f2
int3
clc
test al, 0xea
mov eax, dword [0x7bebccc9]
adc eax, dword [ecx]
test ah, 0xfa
pop esi
mov byte [0xf2fa2320], al
loopne 0x7c83b9c7
and byte [ebx], ah
cli
loopne 0x7c83b9c7
stosd dword es:[edi], eax
pushfd
and ebp, dword [edi + 0x1a120c0]
lahf
iretd