Function at 0x104cfaf
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x10b5894]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
xor ebx, ebx
cmp eax, edi
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x230], ecx
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x240], ebx
je 0x104d03f
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x104cff8
sub eax, edx
sar eax, 1
mov dword [ebp - 0x240], eax
lea eax, [eax + eax + 2]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 0x224], eax
jne 0x104d039
mov eax, 0x8007000e
push eax
push 0x7240138
mov edi, eax
call fcn.0107ae44
jmp 0x104d37c
mov ebx, dword [ebp - 0x240]
push esi
mov esi, 0x105
push esi
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], edi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x104d112
cmp dword [ebp - 0x224], 0
je 0x104d0a0
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebx + 1]
push eax
push dword [ebp - 0x224]
call fcn.0104c3e4
mov eax, dword [ebp - 0x224]
and word [eax + ebx*2], 0
push eax
push dword [ebp - 0x250]
call fcn.0107d890
test eax, eax
jne 0x104d0fe
mov eax, dword [ebp - 0x22c]
test eax, eax
jne 0x104d0cf
push 0x1003d24
call fcn.0108880b
mov dword [esp], 0x2e3
call fcn.0107a681
push eax
call fcn.0108880b
mov dword [esp], 0x1003d24
jmp 0x104d0df
push 5
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x104d0e5
push 0x1003d24
call fcn.0108880b
pop ecx
lea eax, [ebp - 0x220]
push eax
push 0x1001bc8
call fcn.0108880b
inc dword [ebp - 0x22c]
pop ecx
pop ecx
inc dword [ebp - 0x228]
push esi
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x228]
push dword [ebp - 0x23c]
mov dword [ebp - 0x238], esi
call edi
test eax, eax
je 0x104d065
cmp eax, 0x103
je 0x104d13a
push eax
push 0x72f0138
call fcn.0107ae44
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor eax, eax
mov dword [ebp - 0x254], 8
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x230]
lea ecx, [ebp - 0x234]
push ecx
push eax
mov dword [ebp - 0x244], eax
lea eax, [ebp - 0x248]
push eax
xor edi, edi
push edi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x238], esi
push dword [ebp - 0x23c]
call ebx
cmp eax, edi
je 0x104d244
cmp eax, 0xea
jne 0x104d352
mov eax, dword [ebp - 0x234]
add eax, 6
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
mov dword [ebp - 0x244], edi
je 0x104d361
lea eax, [ebp - 0x14]
cmp eax, dword [ebp - 0x230]
je 0x104d1f5
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x254], eax
lea eax, [ebp - 0x234]
push eax
push edi
lea eax, [ebp - 0x248]
push eax
push 0
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x228]
mov dword [ebp - 0x230], edi
push dword [ebp - 0x23c]
mov dword [ebp - 0x238], esi
call ebx
mov edi, eax
test edi, edi
jne 0x104d370
mov ecx, dword [ebp - 0x244]
test ecx, ecx
je 0x104d25c
mov edx, dword [ebp - 0x234]
xor eax, eax
lea edi, [ecx + edx]
stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp dword [ebp - 0x224], 0
je 0x104d2a1
mov edi, dword [ebp - 0x240]
push edi
lea eax, [ebp - 0x220]
push eax
lea eax, [edi + 1]
push eax
push dword [ebp - 0x224]
call fcn.0104c3e4
mov eax, dword [ebp - 0x224]
and word [eax + edi*2], 0
push eax
push dword [ebp - 0x250]
call fcn.0107d890
test eax, eax
jne 0x104d347
mov eax, dword [ebp - 0x22c]
test eax, eax
jne 0x104d2d1
mov edi, 0x1003d24
push edi
call fcn.0108880b
mov dword [esp], 0x2e4
call fcn.0107a681
push eax
call fcn.0108880b
push edi
call fcn.0108880b
pop ecx
jmp 0x104d2ef
cmp dword [ebp - 0x24c], 0
jne 0x104d2e5
push 5
xor edx, edx
pop ecx
div ecx
test edx, edx
jne 0x104d2f0
push 0x1003d24
call fcn.0108880b
pop ecx
lea eax, [ebp - 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x104d2f9
lea ecx, [ebp - 0x24c]
push ecx
push dword [ebp - 0x244]
sub eax, edx
push dword [ebp - 0x234]
sar eax, 1
push 0x19
pop ecx
push ecx
pop edx
sub edx, eax
cmp ecx, eax
sbb eax, eax
not eax
and eax, edx
push eax
push 1
push 1
push dword [ebp - 0x248]
lea eax, [ebp - 0x220]
push eax
push eax
call fcn.0104c611
inc dword [ebp - 0x22c]
inc dword [ebp - 0x228]
jmp 0x104d15e
cmp eax, 0x103
je 0x104d37b
push eax
push 0x75b0138
jmp 0x104d376
mov eax, 0x8007000e
push eax
mov edi, eax
push 0x7640138
jmp 0x104d376
push edi
push 0x76e0138
call fcn.0107ae44
pop esi
cmp dword [ebp - 0x230], 0
je 0x104d39c
lea eax, [ebp - 0x14]
cmp eax, dword [ebp - 0x230]
je 0x104d39c
push dword [ebp - 0x230]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x224], 0
je 0x104d3b1
push dword [ebp - 0x224]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call fcn.010a47cf
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01068363
leave
ret 8