Function at 0x10007557
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x90]
sub esp, 0x110
mov eax, dword [0x1001a144]
xor eax, ebp
mov dword [ebp + 0x8c], eax
push ebx
push esi
xor ebx, ebx
push edi
mov byte [0x1001c3e0], 0x53
mov byte [0x1001c3ec], 0x72
mov byte [0x1001c3e5], 0x61
mov byte [0x1001c3ea], 0x69
mov byte [0x1001c405], 0x4d
mov byte [0x1001c3f4], 0x6e
mov byte [0x1001c3e8], 0x5c
mov byte [0x1001c403], 0x72
mov byte [0x1001c3fc], 0x45
mov byte [0x1001c3ff], 0x6c
mov byte [0x1001c3ef], 0x6f
mov byte [0x1001c3f3], 0x49
mov byte [0x1001c3e1], 0x6f
mov byte [0x1001c3e6], 0x72
mov byte [0x1001c3ed], 0x6f
mov byte [0x1001c3e3], 0x74
mov byte [0x1001c3f6], 0x65
mov byte [0x1001c404], 0x5c
mov byte [0x1001c3e7], 0x65
mov byte [0x1001c3eb], 0x63
mov byte [0x1001c400], 0x6f
mov byte [0x1001c407], 0x69
mov byte [0x1001c408], 0x6e
mov byte [0x1001c3f2], 0x5c
mov byte [0x1001c402], 0x65
mov byte [0x1001c3e9], 0x4d
mov byte [0x1001c3e4], 0x77
mov byte [0x1001c409], bl
mov byte [0x1001c406], 0x61
mov byte [0x1001c3f5], 0x74
mov byte [0x1001c3fb], 0x20
mov byte [0x1001c401], 0x72
mov byte [0x1001c3ee], 0x73
mov byte [0x1001c3f0], 0x66
mov byte [0x1001c3fa], 0x74
mov byte [0x1001c3f7], 0x72
mov byte [0x1001c3fd], 0x78
mov byte [0x1001c3f8], 0x6e
mov byte [0x1001c3e2], 0x66
mov byte [0x1001c3f1], 0x74
mov byte [0x1001c3f9], 0x65
mov byte [0x1001c3fe], 0x70
mov byte [0x1001c440], 0x74
mov byte [0x1001c44d], 0x45
mov byte [0x1001c434], 0x72
mov byte [0x1001c428], 0x77
mov byte [0x1001c415], 0x41
mov byte [0x1001c419], 0x4d
mov byte [0x1001c435], 0x73
mov byte [0x1001c417], 0x45
mov byte [0x1001c43e], 0x50
mov byte [0x1001c439], 0x5c
mov byte [0x1001c410], 0x53
mov byte [0x1001c41d], 0x6f
mov byte [0x1001c421], 0x74
mov byte [0x1001c42e], 0x72
mov byte [0x1001c432], 0x56
mov byte [0x1001c449], 0x4f
mov byte [0x1001c43b], 0x70
mov byte [0x1001c43a], 0x41
mov byte [0x1001c444], 0x49
mov byte [0x1001c433], 0x65
mov byte [0x1001c430], 0x6e
mov byte [0x1001c44e], 0x58
mov byte [0x1001c423], 0x57
mov byte [0x1001c431], 0x74
mov byte [0x1001c42f], 0x65
mov byte [0x1001c41a], 0x69
mov byte [0x1001c447], 0x50
mov byte [0x1001c418], 0x5c
mov byte [0x1001c42a], 0x5c
mov byte [0x1001c446], 0x58
mov byte [0x1001c41e], 0x73
mov byte [0x1001c445], 0x45
mov byte [0x1001c42b], 0x43
mov byte [0x1001c426], 0x64
mov byte [0x1001c44a], 0x52
mov byte [0x1001c41f], 0x6f
mov byte [0x1001c438], 0x6e
mov byte [0x1001c414], 0x57
mov byte [0x1001c437], 0x6f
mov byte [0x1001c44f], 0x45
mov byte [0x1001c443], 0x5c
mov byte [0x1001c424], 0x69
mov byte [0x1001c42d], 0x72
mov byte [0x1001c420], 0x66
mov byte [0x1001c413], 0x54
mov byte [0x1001c42c], 0x75
mov byte [0x1001c442], 0x73
mov byte [0x1001c43d], 0x20
mov byte [0x1001c450], bl
mov byte [0x1001c429], 0x73
mov byte [0x1001c412], 0x46
mov byte [0x1001c436], 0x69
mov byte [0x1001c416], 0x52
mov byte [0x1001c425], 0x6e
mov byte [0x1001c44c], 0x2e
mov byte [0x1001c441], 0x68
mov byte [0x1001c448], 0x4c
mov byte [0x1001c43f], 0x61
mov byte [0x1001c422], 0x5c
mov byte [0x1001c427], 0x6f
mov byte [0x1001c43c], 0x70
mov byte [0x1001c411], 0x4f
mov byte [0x1001c41c], 0x72
mov byte [0x1001c41b], 0x63
mov byte [0x1001c44b], 0x45
mov byte [0x1001c483], 0x64
mov byte [0x1001c48b], 0x65
mov byte [0x1001c482], 0x6e
mov byte [0x1001c489], 0x74
mov byte [0x1001c480], 0x57
mov byte [0x1001c485], 0x77
mov byte [0x1001c481], 0x69
mov byte [0x1001c48c], bl
mov byte [0x1001c486], 0x20
mov byte [0x1001c484], 0x6f
mov byte [0x1001c488], 0x69
mov byte [0x1001c48a], 0x6c
mov byte [0x1001c487], 0x74
mov byte [0x1001c45e], 0x74
mov byte [0x1001c45d], 0x6e
mov byte [0x1001c455], 0x69
mov byte [0x1001c469], 0x6f
mov byte [0x1001c46a], 0x72
mov byte [0x1001c475], 0x44
mov byte [0x1001c47a], 0x75
mov byte [0x1001c478], 0x63
mov byte [0x1001c45f], 0x65
mov byte [0x1001c458], 0x6f
mov byte [0x1001c46f], 0x69
mov byte [0x1001c46e], 0x46
mov byte [0x1001c464], 0x20
mov byte [0x1001c474], 0x67
mov byte [0x1001c47b], 0x6e
mov byte [0x1001c465], 0x45
mov byte [0x1001c456], 0x6e
mov byte [0x1001c473], 0x6e
mov byte [0x1001c47c], 0x74
mov byte [0x1001c46d], 0x20
mov byte [0x1001c470], 0x6e
mov byte [0x1001c468], 0x6c
mov byte [0x1001c463], 0x74
mov byte [0x1001c457], 0x64
mov byte [0x1001c466], 0x78
mov byte [0x1001c477], 0x73
mov byte [0x1001c46b], 0x65
mov byte [0x1001c479], 0x6f
mov byte [0x1001c454], 0x57
mov byte [0x1001c471], 0x64
mov byte [0x1001c461], 0x6e
mov byte [0x1001c45c], 0x49
mov byte [0x1001c472], 0x69
mov byte [0x1001c462], 0x65
mov byte [0x1001c476], 0x69
mov byte [0x1001c467], 0x70
mov byte [0x1001c459], 0x77
mov byte [0x1001c45b], 0x20
mov byte [0x1001c460], 0x72
mov byte [0x1001c47d], bl
mov byte [0x1001c45a], 0x73
mov byte [0x1001c46c], 0x72
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
cmp eax, 0x3e8
jae 0x100079f3
mov dword [0x1001a0e8], eax
push 0x103
lea eax, [ebp - 0x77]
push ebx
push eax
mov byte [ebp - 0x78], bl
call fcn.1000aae0
mov esi, 0x104
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.10007052
add esp, 0x14
test eax, eax
je 0x10007a36
push esi
push ebx
mov edi, 0x1001c490
push edi
call fcn.1000aae0
lea eax, [ebp - 0x78]
push eax
push esi
push edi
call fcn.1000ab5a
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
mov edi, 0x1001c598
push edi
lea eax, [ebp - 0x7c]
push eax
push ebx
push 0x1001c410
push 0x80000002
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x80], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x10007a6e
push edi
call fcn.10009fc0
pop ecx
test eax, eax
ja 0x10007a79
push esi
push ebx
push edi
call fcn.1000aae0
add esp, 0xc
mov ecx, dword [ebp + 0x8c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000a7f9
add ebp, 0x90
leave
ret