Function at 0x76b17bb0
Capabilities:
Query or enumerate registry value

Disassembly:
xor edi, edi
jmp 0x76b17c16
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x168
mov eax, dword [0x76b30340]
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x164], eax
push edi
mov eax, 0x80d
xor edi, edi
cmp edx, eax
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x15c], 1
ja 0x76b18029
je 0x76b19f19
lea eax, [edx - 0x801]
cmp eax, 0xb
jbe switch.0x76b18a1c
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x164]
test eax, eax
je 0x76b17c22
mov dword [eax], edi
mov eax, dword [ebp - 0x15c]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.76b128c0
leave
ret 0x1c
sub edx, 0x80e
je 0x76b18d26
dec edx
je 0x76b18d1a
dec edx
je 0x76b18d03
sub edx, 0x1805
jne 0x76b18bbe
cmp dword [ebp + 0xc], 1
jne 0x76b19147
test byte [esi + 0x4c], 2
je 0x76b19fb2
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push 4
push dword [ebp - 0x154]
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b15f55
jmp 0x76b17ba7
jmp dword [eax*4 + 0x76b18d3d]
test ebx, ebx
jne 0x76b19faa
test ecx, ecx
jne 0x76b19faa
add esi, 0x68
push esi
lea eax, [ebp - 7]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.76b1986d
lea eax, [ebp - 0x48]
push eax
push 0x76b18a90
lea eax, [ebp - 0x150]
push 0x76b18a88
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x150]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x76b17ba7
jmp 0x76b18b1f
add ecx, ecx
mov dword [ebp - 0x158], ecx
je 0x76b19fb2
push ecx
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
mov eax, dword [ebp - 0x154]
dec eax
push eax
add esi, 0x68
push esi
push ebx
call fcn.76b2a6cd
mov eax, dword [ebp - 0x158]
and word [eax + ebx - 2], 0
jmp 0x76b17c16
cmp esi, 1
jl 0x76b18b18
xor edi, edi
mov word [ebx], di
jmp 0x76b17c16
push 0x15
jmp 0x76b19f9f
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x168]
push eax
push ebx
push 0x76b18d70
push dword [ebp - 0x158]
mov dword [ebp - 0x160], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x76b18b5e
mov dword [ebp - 0x154], 1
push dword [ebp - 0x158]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x154]
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x76b17c16
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
mov eax, dword [esi + 0x40]
jmp 0x76b18bac
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push dword [esi + 0x10]
call sym.WINMM.dll_DrvGetModuleHandle
mov dword [ebx], eax
jmp 0x76b17c16
mov dword [ebx], 2
jmp 0x76b17ba7
dec edx
je 0x76b18ca5
dec edx
je 0x76b18c15
dec edx
jne case.0x76b18a1c.2055
cmp dword [ebp + 0xc], 1
jne 0x76b18bf0
test byte [esi + 0x4c], 2
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b2e02a
jmp 0x76b18d36
cmp dword [ebp + 0xc], 2
jne 0x76b19fb2
test byte [esi + 0x4c], 2
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b2e310
jmp 0x76b18d36
cmp dword [ebp + 0xc], 1
jne 0x76b18c5b
test byte [esi + 0x4c], 2
je 0x76b19fb2
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push 4
push dword [ebp - 0x154]
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b16d56
jmp 0x76b17ba7
cmp dword [ebp + 0xc], 2
jne 0x76b19fb2
test byte [esi + 0x4c], 2
je 0x76b19fb2
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push 4
push dword [ebp - 0x154]
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b16e1c
jmp 0x76b17ba7
cmp dword [ebp + 0xc], 1
jne 0x76b18cc3
test byte [esi + 0x4c], 2
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b2df60
jmp 0x76b18d36
cmp dword [ebp + 0xc], 2
jne 0x76b18ce1
test byte [esi + 0x4c], 2
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b2e248
jmp 0x76b18d36
cmp dword [ebp + 0xc], 3
jne 0x76b19fb2
test byte [esi + 0x4c], 2
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b2e64d
jmp 0x76b18d36
push dword [ebp - 0x154]
push ebx
push dword [ebp + 0xc]
call fcn.76b1e434
push eax
call fcn.76b17c3c
jmp 0x76b18d36
push ebx
push dword [ebp + 0x10]
push esi
call fcn.76b1e403
jmp 0x76b18d36
push dword [ebp - 0x154]
push ebx
push dword [ebp + 0x10]
push esi
call fcn.76b1e387
mov edi, eax
jmp 0x76b17c16
cmp dword [ebp + 0xc], 2
jne 0x76b1918d
test byte [esi + 0x4c], 2
je 0x76b19fb2
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push 4
push dword [ebp - 0x154]
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b15ffd
jmp 0x76b17ba7
cmp dword [ebp + 0xc], 3
jne 0x76b19fb2
test byte [esi + 0x4c], 2
je 0x76b19fb2
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push 4
push dword [ebp - 0x154]
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
push dword [ebp - 0x154]
push ebx
call fcn.76b1603a
jmp 0x76b17ba7
push 4
push ebx
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
mov esi, dword [esi + 0x48]
test esi, esi
je 0x76b18bb3
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov dword [ebx], eax
jmp 0x76b17ba7
mov edi, dword [esi + 0x48]
push dword [ebp - 0x154]
mov esi, dword [ebp - 0x154]
push ebx
mov dword [ebp - 0x158], edi
shr esi, 1
call fcn.76b12ab0
test eax, eax
je 0x76b19fb2
test edi, edi
je 0x76b18b09
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call edi
inc eax
cmp esi, eax
jl 0x76b19fa5
push dword [ebp - 0x158]
call edi
mov esi, eax
inc esi
xor edi, edi
push esi
push dword [ebp - 0x158]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x76b17c16
push 8
pop edi
jmp 0x76b17c16
push 0x15
pop edi
jmp 0x76b19f8a
push 0xb
pop eax
jmp 0x76b17c28
push 0xb
jmp 0x76b19f9f