Function at 0x10026d35
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x108]
sub esp, 0x108
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x10026fe7
cmp dword [eax + 4], edi
je 0x10026fe7
test byte [eax + 0x1c], 0x20
je 0x10026fe7
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x10026ec6
cmp dword [ebp + 0x10], edi
je 0x10026ec6
push 0x24
push esi
push str.HKEY_CLASSES_ROOT
mov dword [ebp + 8], edi
call fcn.10132596
add esp, 0xc
mov ebx, closesocket
test eax, eax
jne 0x10026dab
push str.HKEY_CLASSES_ROOT_
mov dword [ebp + 8], ebx
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0xa
push esi
push str.HKCR
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x10026dd0
push str.HKCR_
mov dword [ebp + 8], ebx
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x24
push esi
push str.HKEY_CURRENT_USER
call fcn.10132596
add esp, 0xc
mov ebx, reloc.WS2_32.dll_accept
test eax, eax
jne 0x10026dfa
push str.HKEY_CURRENT_USER_
mov dword [ebp + 8], ebx
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0xa
push esi
push str.HKCU
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x10026e1f
push str.HKCU_
mov dword [ebp + 8], ebx
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x26
push esi
push str.HKEY_LOCAL_MACHINE
call fcn.10132596
add esp, 0xc
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
test eax, eax
jne 0x10026e49
push str.HKEY_LOCAL_MACHINE_
mov dword [ebp + 8], ebx
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0xa
push esi
push str.HKLM
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x10026e6e
push str.HKLM_
mov dword [ebp + 8], ebx
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x16
push esi
push str.HKEY_USERS
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x10026e97
push str.HKEY_USERS_
mov dword [ebp + 8], reloc.WS2_32.dll_closesocket
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x28
push esi
push str.HKEY_CURRENT_CONFIG
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x10026ec0
push str.HKEY_CURRENT_CONFIG_
mov dword [ebp + 8], reloc.WS2_32.dll_getpeername
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
cmp dword [ebp + 8], 0
jne 0x10026ed5
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x10026ff1
mov ebx, dword [ebp + 0x14]
xor eax, eax
inc eax
mov word [ebx], ax
lea eax, [ebp + 0xc]
push eax
push 0x20019
xor esi, esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp + 0xc], esi
jne 0x10026f08
push 0xe00b1016
mov eax, 0x1018a8fc
jmp 0x10026ff1
push esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0xc]
call esi
push 4
pop edi
cmp dword [ebp - 4], edi
jne 0x10026f4a
lea eax, [ebp + 8]
push eax
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 8], edi
push dword [ebp + 0xc]
call esi
push 3
pop eax
mov word [ebx], ax
mov eax, dword [ebp + 0x14]
mov dword [ebx + 8], eax
cmp dword [ebp - 4], 1
jne 0x10026fda
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
add dword [ebp + 8], edi
mov eax, dword [ebp + 8]
xor ecx, ecx
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.101317de
pop ecx
mov edi, eax
lea eax, [ebp + 8]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push edi
lea eax, [ebp - 0x108]
call fcn.1000c50e
push dword [eax]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
lea eax, [ebp - 0x104]
cmp dword [ebp - 0x108], eax
je 0x10026fca
push dword [ebp - 0x108]
call fcn.10133c16
pop ecx
push 8
pop eax
push edi
mov word [ebx], ax
mov dword [ebx + 8], esi
call fcn.101317e9
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10027000
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
pop edi
pop esi
pop ebx
leave
ret 0x10