Function at 0x7d231a70
Capabilities:
Query or enumerate registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x140
mov al, byte [0x7d2b7350]
mov dword [esp + 8], 1
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
push ebp
mov ebp, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push esi
mov esi, dword [sym.imp.ntdll.dll_NtSetValueKey]
push edi
test al, al
jne 0x7d231b79
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0
push eax
push str.BitBucket
push 0x80000002
call fcn.7d232070
mov ebx, eax
test ebx, ebx
jne 0x7d231ad0
mov edi, 0xc0000001
jmp 0x7d231b48
cmp ebx, 0xffffffff
je 0x7d231b44
push str.NukeOnDelete
lea eax, [esp + 0x28]
push eax
call ebp
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
lea eax, [esp + 0x34]
push eax
push ebx
call esi
mov edi, eax
test edi, edi
jns 0x7d231b0a
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
mov esi, 0x22
call ebx
jmp 0x7d231b52
push str.UseGlobalSettings
lea eax, [esp + 0x28]
push eax
call ebp
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
lea eax, [esp + 0x34]
push eax
push ebx
call esi
mov esi, dword [esp + 0x14]
mov edi, eax
test edi, edi
mov eax, 0x33
push ebx
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
cmovs esi, eax
call ebx
jmp 0x7d231b52
mov edi, dword [esp + 0x20]
mov ebx, dword [sym.imp.ntdll.dll_NtClose]
mov esi, dword [esp + 0x14]
test esi, esi
je 0x7d231b74
push edi
push esi
push str.__02X____08X_
push 0x907
call sym.SbieDll.dll_SbieApi_Log
add esp, 0x10
xor al, al
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [0x7d2b7350]
xor edi, edi
mov ecx, 0x100
test al, al
lea eax, [esp + 0x14]
push eax
push str.BitBucket
push 0x80000001
cmovne edi, ecx
call fcn.7d232070
mov dword [esp + 0x20], eax
test eax, eax
je 0x7d231cac
cmp eax, 0xffffffff
je 0x7d231cac
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x30]
push str.Volume
push eax
mov dword [esp + 0x40], 0x18
mov dword [esp + 0x4c], 0x40
mov dword [esp + 0x48], eax
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call ebp
lea eax, [esp + 0x38]
or edi, 0xf003f
push eax
push edi
lea eax, [esp + 0x1c]
push eax
call fcn.7d221226
test eax, eax
js 0x7d231ca6
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
push ecx
push 0x100
lea ecx, [esp + 0x58]
mov dword [esp + 0x44], eax
push ecx
xor esi, esi
push esi
push esi
push eax
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
js 0x7d231ca0
mov eax, dword [esp + 0x5c]
xor ecx, ecx
shr eax, 1
mov word [esp + eax*2 + 0x60], cx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x34]
push eax
call ebp
lea eax, [esp + 0x38]
push eax
push edi
lea eax, [esp + 0x24]
push eax
call fcn.7d221226
test eax, eax
js 0x7d231c7f
push str.NukeOnDelete
lea eax, [esp + 0x28]
push eax
call ebp
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x30]
call dword [sym.imp.ntdll.dll_NtSetValueKey]
push dword [esp + 0x1c]
call ebx
lea eax, [esp + 0x2c]
inc esi
push eax
push 0x100
lea eax, [esp + 0x58]
push eax
push 0
push esi
push dword [esp + 0x28]
call dword [sym.imp.ntdll.dll_NtEnumerateKey]
test eax, eax
jns 0x7d231c26
push dword [esp + 0x14]
call ebx
push dword [esp + 0x20]
call ebx
pop edi
mov al, 1
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret