Function at 0x76e2f496
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x128
push 0x76e2fd50
call fcn.76e112c0
mov eax, dword [0x76e32068]
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc4], ebx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xe4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0xd4], ecx
xor esi, esi
mov dword [ebp - 0xdc], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xf8], esi
mov dword [ebp - 0x130], 0x76e2fd2c
mov dword [ebp - 0x12c], 0x76e2fd10
mov dword [ebp - 0x128], 0x76e2fcf0
mov dword [ebp - 0x124], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xfc], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0xc0], esi
mov dword [eax], esi
push 4
pop eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xf4], esi
mov dword [ebp - 0x108], eax
push 0x3c
call sym.adsldpc.dll_AllocADsMem
cmp eax, esi
je 0x76e2f598
mov ecx, eax
call fcn.76e2a893
mov dword [ebp - 0xb4], eax
jmp 0x76e2f59e
mov dword [ebp - 0xb4], esi
cmp dword [ebp - 0xb4], esi
je 0x76e2f730
push 0xf
pop ecx
xor eax, eax
mov edi, dword [ebp - 0xb4]
rep stosd dword es:[edi], eax
cmp ebx, esi
je 0x76e2f5d2
push ebx
call sym.adsldpc.dll_AllocADsStr
mov ecx, dword [ebp - 0xb4]
mov dword [ecx + 0x10], eax
cmp eax, esi
je 0x76e2f730
mov eax, dword [ebp - 0xb4]
add eax, 0x1c
push eax
mov ecx, dword [ebp - 0xd4]
call fcn.76e311c0
mov dword [ebp - 0xa0], eax
cmp eax, esi
jl 0x76e2fbaa
push dword [ebp - 0xbc]
call sym.adsldpc.dll_AllocADsStr
mov edi, dword [ebp - 0xb4]
mov dword [edi + 0x14], eax
cmp eax, esi
je 0x76e2f730
push dword [ebp + 0x20]
push dword [ebp - 0xd4]
lea eax, [ebp - 0xfc]
push eax
push ebx
call sym.adsldpc.dll_ReadSecurityDescriptorControlType
mov dword [ebp - 0xa0], eax
cmp eax, esi
jl 0x76e2f642
xor eax, eax
inc eax
cmp dword [ebp - 0xfc], eax
jne 0x76e2f642
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xec], esi
jne 0x76e2f6c2
cmp dword [ebp - 0xe0], esi
mov eax, 0x76e2fcd4
jne 0x76e2f65c
mov eax, 0x76e2fca8
push eax
push dword [ebp + 0x20]
push dword [ebp - 0xd4]
lea eax, [ebp - 0xf8]
push eax
lea eax, [ebp - 0xe8]
push eax
push 0x76e13374
push dword [ebp - 0xbc]
push esi
push ebx
call sym.adsldpc.dll_LdapReadAttribute2
mov dword [ebp - 0xa0], eax
cmp eax, esi
jl 0x76e2f6ba
cmp dword [ebp - 0xf8], esi
je 0x76e2f6ba
mov eax, dword [ebp - 0xe8]
push dword [eax]
call sym.adsldpc.dll_AllocADsStr
mov dword [edi + 0x18], eax
push dword [ebp - 0xe8]
call sym.adsldpc.dll_LdapValueFree
cmp dword [edi + 0x18], esi
je 0x76e2f730
jmp 0x76e2f6d4
mov dword [ebp - 0xa0], esi
jmp 0x76e2f6d4
push dword [ebp - 0xec]
call sym.adsldpc.dll_AllocADsStr
mov dword [edi + 0x18], eax
cmp eax, esi
je 0x76e2f730
cmp ebx, esi
je 0x76e2f6e8
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov dword [ebp - 0xf0], eax
jmp 0x76e2f6ee
mov dword [ebp - 0xf0], esi
push dword [ebp - 0xbc]
mov ebx, dword [sym.imp.msvcrt.dll_wcslen]
call ebx
mov edi, 0x76e13328
push edi
mov dword [ebp - 0x120], eax
call ebx
pop ecx
pop ecx
mov ecx, dword [ebp - 0x120]
add ecx, dword [ebp - 0xf0]
lea eax, [eax + ecx + 3]
add eax, eax
push eax
call sym.adsldpc.dll_AllocADsMem
mov ebx, eax
mov dword [ebp - 0xdc], ebx
cmp ebx, esi
jne 0x76e2f73f
mov dword [ebp - 0xa0], 0x8007000e
jmp 0x76e2fbaa
push edi
push ebx
call dword [sym.imp.msvcrt.dll_wcscpy]
push 0x76e12c4c
push ebx
mov edi, dword [sym.imp.msvcrt.dll_wcscat]
call edi
push dword [ebp - 0xbc]
push ebx
call edi
add esp, 0x18
cmp dword [ebp - 0xe0], esi
jne 0x76e2f7a4
cmp dword [ebp - 0xbc], esi
je 0x76e2f7a4
cmp dword [ebp - 0xc4], esi
je 0x76e2f7a4
push 0x76e2fc94
push dword [ebp - 0xbc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x76e2f7a4
push 0x76e2fc90
push ebx
call edi
push dword [ebp - 0xc4]
push ebx
call edi
add esp, 0x10
lea eax, [ebp - 0xb0]
push eax
push 0x20019
push esi
push ebx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x76e2f83b
mov edi, dword [ebp - 0xb4]
mov eax, dword [edi + 0x18]
cmp eax, esi
je 0x76e2f845
cmp dword [ebp - 0xe4], esi
jne 0x76e2f826
mov dword [ebp - 0x118], 0x80
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x134]
push eax
push esi
push 0x76e13318
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x76e2f845
push dword [edi + 0x18]
lea eax, [ebp - 0x9c]
push eax
call fcn.76e2ca7c
test eax, eax
jl 0x76e2f845
mov dword [ebp - 0xb8], esi
jmp 0x76e2f845
cmp eax, esi
je 0x76e2f845
cmp dword [ebp - 0xe4], esi
je 0x76e2f845
push eax
push dword [ebp - 0xe4]
jmp 0x76e2f815
mov dword [ebp - 0xb8], 1
cmp dword [ebp - 0xb8], esi
jne 0x76e2f9e1
mov dword [ebp - 4], esi
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xd0]
push eax
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0xc4]
push dword [ebp - 0xb0]
call fcn.76e2bf6f
mov edi, eax
mov dword [ebp - 0x110], edi
cmp edi, esi
jne 0x76e2f917
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x100]
push eax
push esi
push 0x76e133ac
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov dword [ebp - 0x110], edi
cmp edi, esi
jne 0x76e2f917
mov eax, dword [ebp - 0xf4]
mov dword [ebp - 0xc0], eax
push eax
push dword [ebp - 0xd8]
push dword [ebp - 0xa8]
push dword [ebp - 0xcc]
push dword [ebp - 0xa4]
push dword [ebp - 0xd0]
push dword [ebp - 0xac]
push dword [ebp - 0xb4]
call fcn.76e2f262
mov dword [ebp - 0xa0], eax
or dword [ebp - 4], 0xffffffff
jmp 0x76e2f951
cmp dword [ebp - 0xa0], esi
jl 0x76e2f95d
cmp edi, esi
je 0x76e2f9d5
cmp dword [ebp - 0xac], esi
je 0x76e2f976
push dword [ebp - 0xac]
call sym.adsldpc.dll_FreeADsMem
mov dword [ebp - 0xac], esi
cmp dword [ebp - 0xa4], esi
je 0x76e2f98f
push dword [ebp - 0xa4]
call sym.adsldpc.dll_FreeADsMem
mov dword [ebp - 0xa4], esi
cmp dword [ebp - 0xa8], esi
je 0x76e2f9a8
push dword [ebp - 0xa8]
call sym.adsldpc.dll_FreeADsMem
mov dword [ebp - 0xa8], esi
cmp dword [ebp - 0xc8], esi
je 0x76e2f9c1
push dword [ebp - 0xc8]
call sym.adsldpc.dll_FreeADsMem
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xa0], 0x80004005
mov dword [ebp - 0xb8], 1
cmp dword [ebp - 0xb8], esi
je 0x76e2faff
cmp dword [ebp - 0xe0], esi
mov eax, 0x76e2fcd4
jne 0x76e2f9f3
mov eax, 0x76e2fca8
push dword [ebp + 0x20]
push dword [ebp - 0xd4]
lea ecx, [ebp - 0xd8]
push ecx
lea ecx, [ebp - 0xcc]
push ecx
lea ecx, [ebp - 0xd0]
push ecx
lea ecx, [ebp - 0xa8]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
lea ecx, [ebp - 0xac]
push ecx
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp - 0xbc]
push dword [ebp - 0xc4]
call fcn.76e2b405
mov dword [ebp - 0xa0], eax
cmp eax, esi
jl 0x76e2fbaa
cmp dword [ebp - 0xd0], esi
je 0x76e2fa5d
cmp dword [ebp - 0xcc], esi
jne 0x76e2fa6c
mov dword [ebp - 0xa0], 0x80004005
jmp 0x76e2fbaa
push dword [ebp + 0x20]
push dword [ebp - 0xd4]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0xc4]
call fcn.76e2d8d7
cmp eax, esi
jge 0x76e2fa98
mov dword [ebp - 0xc0], esi
cmp dword [ebp - 0x11c], esi
je 0x76e2faa8
mov dword [ebp - 0xc0], esi
jmp 0x76e2faba
cmp dword [ebp - 0x104], esi
je 0x76e2faba
mov dword [ebp - 0xc0], 1
push dword [ebp - 0xc0]
push dword [ebp - 0xd8]
push dword [ebp - 0xa8]
push dword [ebp - 0xcc]
push dword [ebp - 0xa4]
push dword [ebp - 0xd0]
push dword [ebp - 0xac]
mov edi, dword [ebp - 0xb4]
push edi
call fcn.76e2f262
mov dword [ebp - 0xa0], eax
cmp eax, esi
jge 0x76e2fb05
jmp 0x76e2fbaa
mov edi, dword [ebp - 0xb4]
cmp dword [ebp - 0xb8], esi
je 0x76e2fba2
cmp dword [edi + 0x18], esi
je 0x76e2fba2
cmp dword [ebp - 0xb0], esi
je 0x76e2fb34
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xb0], esi
lea eax, [ebp - 0x138]
push eax
lea eax, [ebp - 0xb0]
push eax
push esi
push 0x2001f
push esi
push 0x76e1309c
push esi
push dword [ebp - 0xdc]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, esi
jne 0x76e2fba2
push dword [ebp - 0xc0]
push dword [ebp - 0xd8]
push dword [ebp - 0xa8]
push dword [ebp - 0xcc]
push dword [ebp - 0xa4]
push dword [ebp - 0xd0]
push dword [ebp - 0xac]
push dword [edi + 0x18]
push dword [ebp - 0xc4]
push dword [ebp - 0xb0]
call fcn.76e2c179
mov eax, dword [ebp - 0x10c]
mov dword [eax], edi
cmp dword [ebp - 0xb8], esi
je 0x76e2fbed
cmp dword [ebp - 0xac], esi
je 0x76e2fbc5
push dword [ebp - 0xac]
call sym.adsldpc.dll_LdapValueFree
cmp dword [ebp - 0xa4], esi
je 0x76e2fbd8
push dword [ebp - 0xa4]
call sym.adsldpc.dll_LdapValueFree
cmp dword [ebp - 0xa8], esi
je 0x76e2fc39
push dword [ebp - 0xa8]
call sym.adsldpc.dll_LdapValueFree
jmp 0x76e2fc39
cmp dword [ebp - 0xac], esi
je 0x76e2fc00
push dword [ebp - 0xac]
call sym.adsldpc.dll_FreeADsMem
cmp dword [ebp - 0xa4], esi
je 0x76e2fc13
push dword [ebp - 0xa4]
call sym.adsldpc.dll_FreeADsMem
cmp dword [ebp - 0xa8], esi
je 0x76e2fc26
push dword [ebp - 0xa8]
call sym.adsldpc.dll_FreeADsMem
cmp dword [ebp - 0xc8], esi
je 0x76e2fc39
push dword [ebp - 0xc8]
call sym.adsldpc.dll_FreeADsMem
cmp dword [ebp - 0xb0], esi
je 0x76e2fc4d
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xdc], esi
je 0x76e2fc60
push dword [ebp - 0xdc]
call sym.adsldpc.dll_FreeADsStr
cmp dword [ebp - 0xa0], esi
jge 0x76e2fc79
mov ecx, dword [ebp - 0xb4]
cmp ecx, esi
je 0x76e2fc79
push 1
call fcn.76e2d221
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x1c]
call fcn.76e30ec1
call fcn.76e113e0
ret 0x1c