Function at 0x7de1aef7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x30], esi
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
stosd dword es:[edi], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
cmp dword [ebp + 8], esi
je 0x7de1b0f0
cmp dword [ebp + 0xc], esi
je 0x7de1b0f0
mov edi, dword [ebp + 0x10]
lea eax, [edi - 0x125]
cmp eax, 0x7ffffed2
ja 0x7de1b0f0
push ebx
push dword [ebp + 8]
call fcn.7de1ac86
push 4
push 0x1000
lea edi, [edi + edi + 0x10]
push edi
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], edi
call fcn.7dd71833
mov ebx, eax
cmp ebx, esi
jne 0x7de1af75
mov dword [ebp + 0xc], 0x8007000e
jmp 0x7de1b0b2
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x7de1af7e
mov dword [eax], esi
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov word [ecx], ax
mov dword [ebp - 0x30], 0x18
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0x40
mov dword [ebp - 0x28], 0x7de1b104
cmp dword [ebp - 8], esi
jne 0x7de1afaa
mov dword [ebp - 0x28], 0x7de1b0fc
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ntdll.dll_NtOpenKey]
cmp eax, esi
jge 0x7de1afd1
or eax, 0x10000000
mov dword [ebp + 0xc], eax
jmp 0x7de1b0b2
cmp dword [ebp - 8], esi
jne 0x7de1afdd
mov eax, 0x7de1b10c
jmp 0x7de1afe9
mov eax, 0x7de1b114
mov dword [ebp - 0x10], 1
lea ecx, [ebp - 0xc]
push ecx
push edi
mov edi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
push ebx
push 2
push eax
push dword [ebp - 4]
call edi
test eax, eax
jl 0x7de1b0ab
cmp dword [ebx + 4], 1
jne 0x7de1b0ab
lea esi, [ebx + 0xc]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.7dd73da0
mov dword [ebp + 0xc], eax
test eax, eax
jge 0x7de1b037
push eax
push 0x7de1b12c
push 0
call fcn.7de1abb3
add esp, 0xc
jmp 0x7de1b0a7
cmp dword [ebp - 8], 0
je 0x7de1b06a
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push ebx
push 2
push 0x7de1b11c
push dword [ebp - 4]
call edi
test eax, eax
jl 0x7de1b06a
cmp dword [ebx + 4], 4
jne 0x7de1b06a
xor eax, eax
cmp byte [esi], al
sete al
mov dword [ebp - 0x10], eax
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push ebx
push 2
push 0x7de1b124
push dword [ebp - 4]
call edi
test eax, eax
jl 0x7de1b0a3
cmp dword [ebx + 4], 1
jne 0x7de1b0a3
cmp word [esi], 0x31
jne 0x7de1b0a3
push dword [ebp + 8]
call fcn.7de1ad18
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
and dword [ebp + 0xc], 0
xor esi, esi
jmp 0x7de1b0b2
mov dword [ebp + 0xc], 0x80070490
mov eax, dword [ebp + 0x14]
cmp eax, esi
je 0x7de1b0be
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
cmp eax, esi
je 0x7de1b0ca
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
cmp dword [ebp - 4], esi
je 0x7de1b0da
push dword [ebp - 4]
call sub.API_MS_Win_Core_Handle_L1_1_0.dll_CloseHandle
mov dword [ebp - 4], esi
cmp ebx, esi
je 0x7de1b0ea
push 0x8000
push esi
push ebx
call fcn.7dd7184b
mov eax, dword [ebp + 0xc]
pop ebx
jmp 0x7de1b0f5
mov eax, 0x80070057
pop edi
pop esi
leave
ret 0x14