Function at 0xf781352
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
xor ebx, ebx
mov ax, word [0xf7ae688]
mov esi, dword [ebp + 0xc]
push esi
mov edi, dword [ebp + 8]
push 1
mov dword [ebp - 8], ebx
push ebx
push eax
push edi
call fcn.0f780d28
test eax, eax
je 0xf781394
mov cx, word [0xf7ae688]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
lea esp, [ebp - 0x40]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ax, word [0xf7ae670]
push esi
push 1
push 0
push eax
push edi
call fcn.0f780d28
mov dword [ebp - 4], eax
test eax, eax
je 0xf781563
mov ax, word [0xf7ae670]
mov edx, dword [ebp + 0x10]
push dword [ebp - 4]
mov word [edx], ax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0xc]
lea edx, [ecx + eax + 1]
push edx
mov dword [ebp - 0x1c], edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [eax + edx + 1]
push eax
mov dword [ebp - 0x20], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
mov edi, dword [ebp - 8]
lea eax, [ebp - 8]
push eax
push 0
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0xf78141a
mov dword [ebp - 8], edi
test eax, eax
jne 0xf781681
mov eax, dword [ebp - 0x14]
mov ecx, dword [0xf7ae6f8]
add eax, esi
add eax, 0x204
push eax
mov eax, dword [ecx]
push dword [0xf7ae6f8]
call dword [eax + 0xc]
mov ebx, eax
test ebx, ebx
je 0xf781691
lea esi, [ebx + 0x101]
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x100
push eax
push ebx
push 0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0xf781681
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + esi]
push dword [ebp - 0x1c]
mov byte [edi], 0x20
inc edi
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x14]
add eax, edi
push dword [ebp - 0x20]
mov byte [eax], 0x20
inc eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0xc]
shr eax, 0x10
test ax, ax
je 0xf78155e
mov edi, dword [ebp - 0xc]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2 + 3]
and al, 0xfc
call fcn.0f7270c0
mov eax, esp
push dword [ebp - 0xc]
push eax
call fcn.0f72a0e0
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
mov eax, esi
shr eax, 0x10
test ax, ax
je 0xf781525
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2 + 3]
and al, 0xfc
call fcn.0f7270c0
mov eax, esp
push esi
push eax
call fcn.0f72a0e0
mov esi, eax
mov eax, ebx
shr eax, 0x10
test ax, ax
mov eax, ebx
je 0xf78165b
mov edi, ebx
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2 + 3]
and al, 0xfc
call fcn.0f7270c0
mov eax, esp
push ebx
push eax
call fcn.0f72a0e0
jmp 0xf78165b
mov eax, dword [ebp - 0xc]
jmp 0xf7814ea
mov ax, word [0xf7ae674]
push esi
push 1
push 0
push eax
push edi
call fcn.0f780d28
mov dword [ebp - 4], eax
test eax, eax
je 0xf781681
mov ax, word [0xf7ae674]
mov edx, dword [ebp + 0x10]
push dword [ebp - 4]
mov word [edx], ax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
shr eax, 0x10
mov word [ebp - 0xc], ax
test ax, ax
mov eax, esi
je 0xf7815c9
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2 + 3]
and al, 0xfc
call fcn.0f7270c0
mov eax, esp
push esi
push eax
call fcn.0f72a0e0
lea ecx, [ebp - 0x34]
push ecx
push eax
call dword [sym.imp.ole32.dll_GetClassFile]
test eax, eax
je 0xf7815e7
lea eax, [ebp - 0x34]
push eax
push str.Package
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
xor edi, edi
push 0x100
mov eax, dword [0xf7ae6f8]
mov dword [ebp - 0x10], edi
push eax
mov dword [ebp - 0x14], edi
mov ebx, dword [eax]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
call dword [ebx + 0xc]
mov ebx, eax
test ebx, ebx
je 0xf781691
push edi
lea eax, [ebp - 0x34]
push 0x100
push ebx
push eax
call fcn.0f7817ef
cmp word [ebp - 0xc], di
je 0xf78164b
mov edi, esi
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx*2 + 3]
and al, 0xfc
call fcn.0f7270c0
mov eax, esp
push esi
push eax
call fcn.0f72a0e0
mov esi, eax
mov eax, ebx
shr eax, 0x10
test ax, ax
mov eax, ebx
jne 0xf781535
push esi
push eax
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.0f780eb0
mov dword [ebp - 0xc], eax
test ebx, ebx
je 0xf781691
push ebx
mov eax, dword [0xf7ae6f8]
push eax
mov ebx, dword [eax]
call dword [ebx + 0x14]
cmp dword [ebp - 4], 0
je 0xf7816a9
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp - 8], 0
je 0xf7816b8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0xf781388