Function at 0x7c81a5f5
Capabilities:
Query or enumerate registry value

Disassembly:
xor esi, esi
jmp 0x7c81a718
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x7c8856cc]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebx + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x210], eax
xor edi, edi
cmp esi, edi
jne 0x7c83ba0f
mov ebx, dword [ebx + 0x10]
cmp ebx, edi
je 0x7c83ba30
lea eax, [ebp - 0x208]
push eax
push edi
push dword [ebp - 0x210]
call fcn.7c80f7f6
test al, al
je 0x7c83ba3a
lea eax, [ebp - 0x20c]
push eax
push edi
push dword [ebp - 0x208]
push ebx
push dword [ebp - 0x210]
call fcn.7c81baa3
cmp eax, edi
jl 0x7c81a726
cmp dword [ebp - 0x20c], 0xffffffff
je 0x7c81a726
mov esi, dword [sym.imp.ntdll.dll_NtEnumerateValueKey]
lea eax, [ebp - 0x214]
push eax
mov ebx, 0x200
push ebx
lea eax, [ebp - 0x204]
push eax
push edi
push edi
push dword [ebp - 0x20c]
mov dword [ebp - 0x208], edi
call esi
mov edi, 0x8000001a
cmp eax, edi
je 0x7c81a5d0
test eax, eax
jl 0x7c81a716
lea eax, [ebp - 0x1f8]
mov dword [ebp - 0x218], eax
mov ax, word [ebp - 0x1fc]
push 1
mov word [ebp - 0x21c], ax
mov word [ebp - 0x21a], ax
lea eax, [ebp - 0x21c]
push eax
push 0
push dword [ebp - 0x210]
call fcn.7c80f921
test eax, eax
jl 0x7c81a716
inc dword [ebp - 0x208]
lea eax, [ebp - 0x214]
push eax
push ebx
lea eax, [ebp - 0x204]
push eax
push 0
push dword [ebp - 0x208]
push dword [ebp - 0x20c]
call esi
jmp 0x7c81a6a8
mov esi, eax
push dword [ebp - 0x20c]
call dword [sym.imp.ntdll.dll_NtClose]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.7c8097aa
leave
ret 8
mov eax, dword [0x8fcf9f01]
out 0x7d, eax
hlt
xchg ebp, edx
or al, 0x64
aas
add dword [edi - 0x73e35bb1], ebp
sbb al, 0x8c
mov edx, fs
jnp 0x7c83ba57
loop 0x7c83baae
and esp, dword [esi + edi - 0x9ad3e60]
movsb byte es:[edi], byte [esi]
mov al, byte ds:[0x4cf652c1]
dec esp
scasb al, byte es:[edi]
xchg esi, eax
xchg edx, ecx
sqrtps xmm4, xmmword [edx + 0x7a4fcbd7]
push eax
cdq
test byte [esi - 0x29], dl
cli
mov cl, 0xd5
cwde
jmp 0x418c343b
stc
fcomp st(1)
jns 0x7c83ba26
mov ebx, 0x16a9e465
adc dword [eax], ebp
stosb byte es:[edi], al
push cs
pop ebx
div dword [edi + esi]
mov dh, 0x5b
xchg ebp, eax
nop
inc esi
fdiv st(6), st(0)
lodsb al, byte [esi]
insb byte es:[edi], dx
call 0xe9f49ac5
add dword [edi - 0x5b50e384], edi
sal dword [eax - 0xd], 1
lahf
mov byte [eax + 0x5fe1cffd], 0x3c
jno 0x7c83baed
dec edi
push ebx
pop ebp
push ds
shl dword ss:[esp + edi + 0x13ddc81d], cl
mov word [eax + 0x583e7e3f], fs
jnp 0x7c83ba2f
loope 0x7c83baf9
popfd
sbb cl, ch
mov dword [edi], ecx
shr dword [edi], 1
cli
jl 0x7c83baab
mov dh, ah
mov dh, ah
invalid
xchg ebp, eax
cmp al, 0x37
aas
cdq
jmp 0x7c83baaa
or eax, 0xf4d52fbe
push esp
scasd eax, dword es:[edi]
loop 0x7c83bb3b
xor al, 0x3f
cmc
jne 0x7c83bb29
adc eax, 0xbbea133f
stc
retf
fcmovnbe st(0), st(6)
out dx, eax
popal
jg 0x7c83bb62
push 0x2f
sub edx, dword [eax + 1]
les esp, [eax + 0x25b2f7e8]
sub dword [ecx - 0x3f0422a1], 0
aas
test eax, 0xc0fbdd5f
add byte [edi], bh
nop
inc ebp
pop ecx
mov esi, 0xb7f27b00
dec eax
jno 0x7c83bb34
inc ecx
out dx, eax
add dh, byte [edx]
arpl bx, sp
int1
pop edi
mov ah, byte [eax + 0x3a]
xchg edx, eax
cli
imul edx, dword [ecx - 0x59], 0x22
cmp ecx, dword [ebx]
and ebp, edx
mov ebp, dword [edi + 0x72]
push cs
mov esi, 0x215053d5
pop es
ror dh, 1
xor cl, byte [esi + 0x26]
push ds
dec esi
push ecx
xor al, 7
out dx, eax
pop esp
sbb ecx, ebp
rcl al, cl
add byte [edi + 0x14], 0x15
pushfd
imul esp, dword [0x9900f9f0], 0x6071505f
movsb byte es:[edi], byte [esi]
jmp 0xeb890250