Function at 0xf7899bc
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
cmp dword [0xf7ae760], 0
push ebx
push esi
push edi
push ebp
je 0xf789c0d
mov edi, dword [esp + 0x24]
push edi
call dword [sym.imp.MSVCRT20.dll_wcslen]
add esp, 4
inc eax
cmp eax, 1
jbe 0xf789a10
push 0
push 0
push 0
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
push 0xffffffffffffffff
push edi
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0xf789a1a
mov eax, 0x8007000e
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 0x18
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call fcn.0f726e61
mov ebx, eax
test ebx, ebx
jne 0xf789a2d
mov eax, 0x8007000e
jmp 0xf789a06
push 0
push 0
push esi
push ebx
push 0xffffffffffffffff
push edi
push 0
push 0
call ebp
test eax, eax
jne 0xf789a4d
push ebx
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789a06
cmp dword [esp + 0x34], 0
je 0xf789aa5
cmp dword [esp + 0x30], 0
je 0xf789a9b
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
mov dword [esp + 0x10], eax
lea esi, [esp + 0x10]
lea ecx, [esp + 0x18]
push esi
push dword [esp + 0x34]
push ecx
push dword [esp + 0x34]
push ebx
push dword [esp + 0x34]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
mov dword [esp + 0x14], eax
test eax, eax
je 0xf789aa9
push ebx
call fcn.0f726e12
mov eax, dword [esp + 0x14]
jmp 0xf789a06
mov dword [esp + 0x10], 0
jmp 0xf789a65
xor esi, esi
jmp 0xf789a69
mov eax, dword [esp + 0x18]
cmp eax, 1
jb 0xf789abc
cmp eax, 2
jbe 0xf789aea
cmp eax, 7
je 0xf789aea
cmp dword [esp + 0x34], 0
je 0xf789acd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
mov dword [ecx], eax
push ebx
call fcn.0f726e12
mov eax, dword [esp + 0x2c]
test eax, eax
je 0xf789ae1
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
jmp 0xf789a06
cmp dword [esp + 0x34], 0
je 0xf789acd
push dword [esp + 0x10]
call fcn.0f726e61
mov ebp, eax
test ebp, ebp
jne 0xf789b10
push ebx
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789a06
cmp dword [esp + 0x30], 0
je 0xf789b69
mov eax, dword [esp + 0x10]
mov edi, ebp
mov esi, dword [esp + 0x30]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x34]
mov eax, dword [ecx]
shr eax, 1
push eax
push dword [esp + 0x34]
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0xf789bf5
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789a06
push esi
push ebp
push 0
push 0
push ebx
push dword [esp + 0x34]
call edi
mov dword [esp + 0x14], eax
test eax, eax
je 0xf789b93
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
mov eax, dword [esp + 0x14]
jmp 0xf789a06
mov eax, dword [esp + 0x10]
add eax, eax
push eax
call fcn.0f726e61
mov esi, eax
test esi, esi
jne 0xf789bbb
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789a06
push dword [esp + 0x10]
push esi
push 0xffffffffffffffff
push ebp
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, eax
test edi, edi
jne 0xf789bef
push ebx
call fcn.0f726e12
push ebp
call fcn.0f726e12
push esi
call fcn.0f726e12
mov eax, 0x8007000e
jmp 0xf789a06
push esi
call fcn.0f726e12
lea eax, [edi*2]
mov ecx, dword [esp + 0x34]
push ebp
mov dword [ecx], eax
call fcn.0f726e12
jmp 0xf789acd
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0xf789a06