Function at 0xce7a62
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2dc
mov eax, dword [0xd08954]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
lea esi, [ebp + 0xc]
mov dword [ebp - 0x2dc], eax
lea edi, [ebp - 0x2bc]
xor eax, eax
movsd dword es:[edi], dword [esi]
push 0x27
mov word [ebp - 0x2ac], ax
mov word [ebp - 0x54], ax
movsd dword es:[edi], dword [esi]
mov word [ebp - 0xa4], ax
lea eax, [ebp - 0xa4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
push edi
push eax
lea eax, [ebp - 0x2bc]
xor esi, esi
and dword [ebp - 0x2c4], esi
push eax
mov dword [ebp - 0x2c8], esi
call dword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
cmp eax, edi
je 0xce7ad8
mov ebx, 0x8000ffff
jmp 0xce7d96
and dword [ebp - 0x2c0], esi
lea eax, [ebp - 0x2c0]
push eax
mov edx, edi
lea ecx, [ebp - 0xa4]
call fcn.00bb5829
mov ebx, eax
test ebx, ebx
js 0xce7d96
mov eax, dword [ebp - 0x2c0]
add eax, 0xfffffffe
cmp eax, 0x24
ja 0xce7b57
lea eax, [ebp - 0xa2]
mov edx, edi
push eax
lea ecx, [ebp - 0x54]
call fcn.00b7db60
mov ebx, eax
test ebx, ebx
js 0xce7d96
lea eax, [ebp - 0x2c0]
mov edx, edi
push eax
lea ecx, [ebp - 0x54]
call fcn.00bb5829
mov ebx, eax
test ebx, ebx
js 0xce7d96
mov ecx, dword [ebp - 0x2c0]
lea eax, [ecx - 2]
cmp eax, 0x24
ja 0xce7ace
xor eax, eax
mov word [ebp + ecx*2 - 0x56], ax
jmp 0xce7b5c
mov ebx, 0x8000ffff
test ebx, ebx
js 0xce7d96
lea eax, [ebp - 0x54]
push eax
push 0xb268b0
push 0xb26910
lea eax, [ebp - 0x2ac]
push 0x104
push eax
call fcn.00b55e8f
mov ebx, eax
add esp, 0x14
test ebx, ebx
js 0xce7d96
lea eax, [ebp - 0x2c4]
mov edx, 0x20019
push eax
lea ecx, [ebp - 0x2ac]
call fcn.00bbfb00
mov ebx, eax
test ebx, ebx
js 0xce7d96
mov edi, dword [ebp - 0x2c4]
lea eax, [ebp - 0x2d4]
push eax
xor ecx, ecx
mov dword [ebp - 0x2d4], 4
lea eax, [ebp - 0x2cc]
mov dword [ebp - 0x2cc], ecx
push eax
push ecx
push 0x18
push 0xb2691c
push ecx
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
je 0xce7c01
jle 0xce7d77
movzx ebx, bx
or ebx, 0x80070000
jmp 0xce7d77
push 0xb28bd8
push 0x704
call fcn.00bc1282
pop ecx
pop ecx
test eax, eax
je 0xce7c1f
mov ecx, eax
call fcn.00ce8eb4
jmp 0xce7c21
xor eax, eax
test eax, eax
je 0xce7d72
mov edx, eax
lea ecx, [ebp - 0x2c8]
call fcn.00caab04
mov esi, dword [ebp - 0x2c8]
test esi, esi
je 0xce7d72
lea eax, [ebp - 0x2bc]
mov ecx, esi
push eax
call fcn.00ce976d
mov ebx, eax
test ebx, ebx
js 0xce7d77
mov eax, dword [ebp - 0x2cc]
xor ecx, ecx
mov dword [esi + 0x34], eax
lea eax, [ebp - 0x2d8]
push eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x2d0], ecx
push eax
push ecx
push 0x18
push 0xb268f0
push ecx
push dword [ebp - 0x2c4]
mov dword [ebp - 0x2d8], 4
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
mov ebx, eax
test ebx, ebx
jne 0xce7bed
mov eax, dword [ebp - 0x2d0]
mov ecx, esi
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x2ac]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ce9838
mov ebx, eax
test ebx, ebx
js 0xce7d77
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ce958b
mov ebx, eax
test ebx, ebx
js 0xce7d77
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ce96e3
mov ebx, eax
test ebx, ebx
js 0xce7d77
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ce9990
mov ebx, eax
test ebx, ebx
js 0xce7d77
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ce98c2
mov ebx, eax
test ebx, ebx
js 0xce7d77
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ce9a22
mov ebx, eax
test ebx, ebx
js 0xce7d77
lea eax, [ebp - 0x2ac]
mov ecx, esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00ce9615
mov ebx, eax
test ebx, ebx
js 0xce7d77
mov ecx, dword [ebp - 0x2dc]
mov eax, esi
xor esi, esi
mov dword [ecx], eax
jmp 0xce7d77
mov ebx, 0x8007000e
test edi, edi
je 0xce7d82
push edi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
je 0xce7d96
mov eax, dword [esi]
push esi
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0xd0cffc]
call esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00bc0ea0
mov esp, ebp
pop ebp
ret 0x14