Function at 0x7ddfd2c3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
xor eax, eax
xor esi, esi
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x34
lea eax, [ebp - 0x90]
push esi
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
call sub.ntdll.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x14]
push esi
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x94]
push eax
push 0x7ddb367c
push 4
mov dword [ebp - 0x94], 0x7ddfd254
call dword [sym.imp.ntdll.dll_RtlQueryRegistryValues]
mov eax, 0x7ddfd9c0
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd54e
push dword [ebp - 0xc]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
call sub.ntdll.dll_atol
pop ecx
lea ecx, [ebp - 0x44]
call fcn.7ddfcfb5
test eax, eax
jne 0x7ddfd38f
xor eax, eax
jmp 0x7ddfd908
lea eax, [ebp - 0x14]
mov dword [ebp - 0x40], ebx
call fcn.7ddfcf9f
mov eax, 0x7ddfd9bc
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd53d
mov eax, edi
call fcn.7ddfcf9f
mov eax, 0x7ddfd9bc
call fcn.7ddfce31
test eax, eax
jne 0x7ddfd3ef
mov eax, 0x7ddfd9b8
call fcn.7ddfce31
test eax, eax
je 0x7ddfd3ef
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
lea esi, [ebp - 0x15]
call fcn.7ddfd081
test eax, eax
je 0x7ddfd388
mov eax, edi
mov dword [ebp - 0x54], ebx
call fcn.7ddfcf9f
xor esi, esi
mov eax, 0x7ddfd9bc
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd53d
mov eax, edi
call fcn.7ddfcf9f
mov eax, 0x7ddfd9c0
call fcn.7ddfce31
test eax, eax
je 0x7ddfd448
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
pop ecx
cmp eax, 5
je 0x7ddfd43a
cmp eax, 6
je 0x7ddfd43a
cmp eax, 7
je 0x7ddfd43a
cmp eax, 8
jne 0x7ddfd388
mov byte [ebp - 0x16], al
lea eax, [ebp - 0x14]
mov dword [ebp - 0x50], ebx
call fcn.7ddfcf9f
mov eax, 0x7ddfd9bc
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd53d
mov eax, edi
call fcn.7ddfcf9f
mov eax, 0x7ddfd9b4
call fcn.7ddfce31
test eax, eax
je 0x7ddfd477
mov byte [ebp - 1], bl
jmp 0x7ddfd4a5
mov eax, 0x7ddfd9c0
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd4b0
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
dec eax
pop ecx
je 0x7ddfd4a1
dec eax
jne 0x7ddfd388
mov byte [ebp - 1], 2
jmp 0x7ddfd4a5
mov byte [ebp - 1], 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x3c], ebx
call fcn.7ddfcf9f
mov eax, 0x7ddfd9bc
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd53d
mov eax, edi
call fcn.7ddfcf9f
mov eax, 0x7ddfd9b0
call fcn.7ddfce31
test eax, eax
je 0x7ddfd4f6
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
jmp 0x7ddfd527
mov eax, 0x7ddfd9ac
lea edi, [ebp - 0x14]
call fcn.7ddfce31
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], esi
test eax, eax
je 0x7ddfd531
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
mov byte [ebp - 2], 2
mov byte [ebp - 3], 2
lea eax, [ebp - 0x14]
call fcn.7ddfcf9f
jmp 0x7ddfd53d
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov byte [ebp - 2], bl
mov byte [ebp - 3], bl
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
jne 0x7ddfd388
jmp 0x7ddfd80f
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
je 0x7ddfd848
mov eax, 0x7ddfd9a4
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd590
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
pop ecx
lea ecx, [ebp - 0x44]
call fcn.7ddfcfb5
test eax, eax
je 0x7ddfd388
mov dword [ebp - 0x40], 1
jmp 0x7ddfd7ef
mov eax, 0x7ddfd998
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd5c2
mov eax, dword [ebp - 0xc]
mov al, byte [eax]
lea esi, [ebp - 0x15]
call fcn.7ddfd081
test eax, eax
je 0x7ddfd388
mov dword [ebp - 0x54], 1
jmp 0x7ddfd7ef
mov eax, 0x7ddfd990
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd603
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
pop ecx
cmp eax, 5
je 0x7ddfd5f4
cmp eax, 6
je 0x7ddfd5f4
cmp eax, 7
je 0x7ddfd5f4
cmp eax, 8
jne 0x7ddfd388
mov byte [ebp - 0x16], al
mov dword [ebp - 0x50], 1
jmp 0x7ddfd7ef
mov eax, 0x7ddfd984
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd624
mov byte [ebp - 1], 1
mov dword [ebp - 0x3c], 1
jmp 0x7ddfd7ef
mov eax, 0x7ddfd97c
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd654
push dword [ebp - 0xc]
call sub.ntdll.dll_atol
dec eax
pop ecx
je 0x7ddfd64e
dec eax
jne 0x7ddfd388
mov byte [ebp - 1], 2
jmp 0x7ddfd618
mov byte [ebp - 1], 0
jmp 0x7ddfd618
mov eax, 0x7ddfd974
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd673
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], eax
jmp 0x7ddfd7ef
mov eax, 0x7ddfd96c
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd693
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x5c], esi
jmp 0x7ddfd7ef
mov eax, 0x7ddfd964
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd6b2
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], eax
jmp 0x7ddfd7ef
mov eax, 0x7ddfd95c
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd6d2
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x38], esi
jmp 0x7ddfd7ef
mov eax, 0x7ddfd954
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd6f1
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
jmp 0x7ddfd7ef
mov eax, 0x7ddfd948
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd711
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x34], esi
jmp 0x7ddfd7ef
mov eax, 0x7ddfd940
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd730
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x58], eax
jmp 0x7ddfd7ef
mov eax, 0x7ddfd934
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd750
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x58], esi
jmp 0x7ddfd7ef
mov eax, 0x7ddfd92c
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd76f
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x30], eax
jmp 0x7ddfd7ef
mov eax, 0x7ddfd920
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd78c
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x30], esi
jmp 0x7ddfd7ef
mov eax, 0x7ddfd918
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd7bc
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
lea ebx, [ebp - 2]
call fcn.7ddfd0c3
test eax, eax
je 0x7ddfd388
mov dword [ebp - 0x28], 1
jmp 0x7ddfd7ef
mov eax, 0x7ddfd910
lea edi, [ebp - 0x14]
call fcn.7ddfce31
test eax, eax
je 0x7ddfd388
mov ebx, dword [ebp - 8]
lea eax, [ebp - 3]
push eax
mov eax, dword [ebp - 0xc]
call fcn.7ddfd170
test eax, eax
je 0x7ddfd388
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x14]
call fcn.7ddfcf9f
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
je 0x7ddfd806
xor esi, esi
jmp 0x7ddfd55a
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x40], 0
je 0x7ddfd81a
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x44]
mov dword [eax + 4], ecx
jmp 0x7ddfd81d
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [ebp - 0x50], esi
je 0x7ddfd82a
mov cl, byte [ebp - 0x16]
mov byte [eax + 0x12], cl
cmp dword [ebp - 0x3c], esi
je 0x7ddfd837
mov cl, byte [ebp - 1]
mov byte [eax + 0x14], cl
jmp 0x7ddfd852
cmp dword [ebp - 0x40], esi
je 0x7ddfd84e
cmp dword [ebp - 0x44], 0x6e
jne 0x7ddfd84e
mov byte [eax + 0x14], 2
jmp 0x7ddfd852
mov eax, dword [ebp + 8]
xor ebx, ebx
inc ebx
mov byte [eax + 0x14], 0
xor esi, esi
cmp dword [ebp - 0x54], esi
je 0x7ddfd85f
mov cl, byte [ebp - 0x15]
mov byte [eax + 0x13], cl
cmp dword [ebp - 0x24], esi
je 0x7ddfd879
cmp dword [ebp - 0x38], esi
je 0x7ddfd872
or dword [eax + 8], 0x300
jmp 0x7ddfd879
and dword [eax + 8], 0xfffffcff
cmp dword [ebp - 0x1c], esi
je 0x7ddfd88d
cmp dword [ebp - 0x30], esi
je 0x7ddfd889
or dword [eax + 8], 4
jmp 0x7ddfd88d
and dword [eax + 8], 0xfffffffb
cmp dword [ebp - 0x20], esi
je 0x7ddfd8a1
cmp dword [ebp - 0x34], esi
je 0x7ddfd89d
or dword [eax + 8], 8
jmp 0x7ddfd8a1
and dword [eax + 8], 0xfffffff7
cmp dword [ebp - 0x48], esi
je 0x7ddfd8b5
cmp dword [ebp - 0x58], esi
je 0x7ddfd8b1
or dword [eax + 8], 0x40
jmp 0x7ddfd8b5
and dword [eax + 8], 0xffffffbf
cmp dword [ebp - 0x28], esi
je 0x7ddfd8ca
movzx ecx, byte [ebp - 2]
shl ecx, 4
xor ecx, dword [eax + 8]
and ecx, 0x30
xor dword [eax + 8], ecx
cmp dword [ebp - 0x2c], esi
je 0x7ddfd8e2
movzx ecx, byte [ebp - 3]
shl ecx, 0xc
xor ecx, dword [eax + 8]
and ecx, 0x3000
xor dword [eax + 8], ecx
cmp dword [ebp - 0x4c], esi
je 0x7ddfd906
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
cmp dword [ebp - 0x5c], esi
je 0x7ddfd903
mov dword [eax + 0x10], 0xea60
jmp 0x7ddfd906
mov dword [eax + 0x10], esi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8