Function at 0x1007854
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc2c
mov eax, dword [0x1011360]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0xc20], eax
mov eax, dword [section..data]
push esi
mov dword [ebp - 0xc24], edx
mov byte [ebp - 0xc05], 0
lea ecx, [eax + 2]
push edi
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x100789f
sub eax, ecx
mov ecx, edx
sar eax, 1
lea esi, [ecx + 2]
mov di, word [ecx]
inc ecx
inc ecx
test di, di
jne 0x10078b2
sub ecx, esi
sar ecx, 1
push 0x10040b0
push edx
lea esi, [ecx + eax + 1]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10078e0
add esi, 0xb
mov byte [ebp - 0xc05], 1
add esi, esi
push esi
call dword [sym.imp.msvcrt.dll_malloc]
mov ebx, eax
test ebx, ebx
pop ecx
jne 0x10078fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1007c12
push esi
push 0
push ebx
call sub.msvcrt.dll_memset
mov ecx, dword [section..data]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1007912
sub eax, edx
sar eax, 1
mov esi, eax
lea edi, [esi + esi]
push edi
push ecx
push ebx
mov dword [ebp - 0xc10], esi
call sub.msvcrt.dll_memcpy
add esp, 0xc
cmp byte [ebp - 0xc05], 0
je 0x100795a
push 5
add edi, ebx
add dword [ebp - 0xc10], 0xb
pop ecx
mov esi, 0x1003f9c
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 0xc10]
mov eax, dword [ebp - 0xc24]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1007963
sub eax, edx
sar eax, 1
add eax, eax
push eax
push dword [ebp - 0xc24]
lea eax, [ebx + esi*2]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0xc20]
add esp, 0xc
xor edi, edi
mov dword [eax], edi
lea eax, [ebp - 0xc18]
push eax
push 3
push edi
push ebx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x1007c12
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc28]
push eax
push edi
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc04]
push eax
mov dword [ebp - 0xc10], edi
mov ebx, 0x400
push edi
jmp 0x1007be4
push dword [0x1011004]
mov esi, dword [sym.imp.msvcrt.dll__wcsicmp]
inc dword [ebp - 0xc10]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007a2d
push 4
pop eax
cmp dword [ebp - 0xc0c], eax
jbe 0x1007a15
mov dword [ebp - 0xc0c], eax
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0xc20]
jmp 0x1007b7e
push dword [0x1011008]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007a5d
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0xc14]
add eax, 0x30
jmp 0x1007b12
push dword [0x101100c]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007a8d
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0xc14]
add eax, 0x38
jmp 0x1007b12
push dword [0x1011010]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007aba
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0xc14]
add eax, 0x34
jmp 0x1007b12
push dword [0x1011014]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007ae7
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0xc14]
add eax, 0x44
jmp 0x1007b12
push dword [0x101101c]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007b15
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0xc14]
add eax, 0x48
push eax
jmp 0x1007b7e
push dword [0x1011020]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007b50
push 4
pop eax
cmp dword [ebp - 0xc0c], eax
jbe 0x1007b3b
mov dword [ebp - 0xc0c], eax
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0xc2c]
jmp 0x1007b7e
push dword [0x1011018]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
jne 0x1007b88
push dword [ebp - 0xc0c]
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 0xc14]
mov ecx, dword [eax + 0x6c]
add ecx, eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
jmp 0x1007bba
cmp byte [ebp - 0xc05], 0
jne 0x1007bba
push dword [0x1011024]
lea eax, [ebp - 0xc04]
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x1007bba
lea eax, [ebp - 0xc04]
push eax
push 0x10040d0
call dword [sym.imp.msvcrt.dll_wprintf]
pop ecx
pop ecx
lea eax, [ebp - 0xc0c]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xc28]
push eax
push edi
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0xc04]
push eax
push dword [ebp - 0xc10]
push dword [ebp - 0xc18]
mov dword [ebp - 0xc1c], ebx
mov dword [ebp - 0xc0c], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10079e3
push dword [ebp - 0xc18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100b502
leave
ret 0x10