Function at 0x71e22655
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
push esi
push edi
je 0x71e2266b
and dword [ebx], 0
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x71e22685
cmp dword [ebp + 0x14], 0x27
jb 0x71e22685
push 9
pop ecx
mov esi, 0x71e21434
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea eax, [ebp + 0x14]
push eax
push 0x71e213bc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x71e2284c
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push 0x71e2141c
push dword [ebp + 0x14]
mov dword [ebp + 0x10], 1
mov dword [ebp + 0xc], 0x104
call edi
test eax, eax
jne 0x71e2272c
test ebx, ebx
je 0x71e226ef
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e226e1
sub eax, edx
add eax, 2
add dword [ebx], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x71e2272f
mov byte [esi], 0x83
inc esi
mov edx, esi
lea ecx, [ebp - 0x104]
lea eax, [ebp - 0x104]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x71e2270a
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e2271d
sub eax, edx
lea esi, [esi + eax + 1]
jmp 0x71e2272f
mov esi, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push 0x71e21404
push dword [ebp + 0x14]
mov dword [ebp + 0x10], 1
mov dword [ebp + 0xc], 0x104
call edi
test eax, eax
jne 0x71e227ab
test ebx, ebx
je 0x71e22777
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e22769
sub eax, edx
add eax, 2
add dword [ebx], eax
test esi, esi
je 0x71e227ab
mov byte [esi], 0x82
inc esi
mov edx, esi
lea ecx, [ebp - 0x104]
lea eax, [ebp - 0x104]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x71e2278f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e2279e
sub eax, edx
lea esi, [esi + eax + 1]
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp + 0x10]
push eax
push 0
push 0x71e213f0
push dword [ebp + 0x14]
mov dword [ebp + 0x10], 1
mov dword [ebp + 0xc], 0x104
call edi
test eax, eax
jne 0x71e22827
test ebx, ebx
je 0x71e227f3
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e227e5
sub eax, edx
add eax, 2
add dword [ebx], eax
test esi, esi
je 0x71e2282e
mov byte [esi], 0x44
inc esi
mov edx, esi
lea ecx, [ebp - 0x104]
lea eax, [ebp - 0x104]
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x71e2280b
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71e2281a
sub eax, edx
lea esi, [esi + eax + 1]
test esi, esi
je 0x71e2282e
and byte [esi], 0
test ebx, ebx
je 0x71e22834
inc dword [ebx]
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x71e22841
mov dword [eax], 1
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0x14