Function at 0x1001d62e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10c
mov eax, 0x10047bfd
call fcn.10047302
mov dword [ebp - 0x98], edx
mov ebx, ecx
mov dword [ebp - 0x74], ebx
mov esi, dword [ebp + 0x20]
lea edi, [ebp - 0x64]
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x7c], esi
lea esi, [ebp + 0x30]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x6c], ecx
mov ecx, dword [ebp + 0x28]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp + 0x10]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x80], ecx
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp + 0x18]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xac], ecx
xor ecx, ecx
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp + 0x1c]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x68], ecx
mov edi, ecx
push eax
lea ecx, [ebp - 0xc4]
call fcn.1001a0fd
xor eax, eax
mov dword [ebp - 4], eax
push 0x40
push eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x54]
push eax
call sub.msvcrt.dll_memset
xor eax, eax
add esp, 0xc
mov ecx, 0x10002084
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x94], eax
call fcn.1002d054
mov edx, 0x100024a0
mov dword [ebp - 0xe4], eax
push edx
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0xe0], edx
mov dword [ebp - 0xdc], ecx
xor ecx, ecx
push 0x10001c9c
push ecx
push 4
mov dword [ebp - 0xd8], ecx
call fcn.1002d079
add esp, 0x14
mov byte [ebp - 4], 1
test ebx, ebx
je 0x1001dc24
cmp dword [ebp + 0xc], edi
je 0x1001dc24
cmp dword [ebp - 0xa4], edi
je 0x1001dc24
mov esi, dword [ebp - 0x6c]
test esi, esi
je 0x1001dc24
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x1001dc13
xor ecx, ecx
cmp word [eax], cx
je 0x1001dc13
mov eax, dword [ebp - 0xac]
test eax, eax
je 0x1001d76a
mov dword [eax], ecx
cmp byte [0x1004e804], cl
je 0x1001d7a5
push 0x1000204c
push 0x10002490
push 0x4bd
mov ecx, 0x10002084
mov edi, 0xc0000008
call fcn.1002d054
push eax
push edi
push 4
push 0x10002030
push 0
push 4
call fcn.1002d079
add esp, 0x24
lea eax, [ebp - 0x88]
or edi, 0x10000000
push eax
lea edx, [ebp - 0x9c]
mov dword [ebp - 0xb4], edi
mov ecx, ebx
call fcn.1001dfb4
mov edi, eax
mov dword [ebp - 0x68], edi
test edi, edi
jns 0x1001d7ff
push 0x1000204c
push 0x10001f48
push 0x4c5
mov ecx, 0x10002084
call fcn.1002d054
push eax
push edi
push 2
pop ebx
push ebx
push 0x10002030
push 0
push ebx
call fcn.1002d079
jmp 0x1001dc5b
lea eax, [ebp - 0x94]
push eax
push 0x20119
push 0
push 0x100024c0
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
push 2
pop ebx
test eax, eax
jne 0x1001d887
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], 4
push eax
xor ecx, ecx
lea eax, [ebp - 0xa0]
push eax
push ecx
push 0x18
push 0x10002504
push ecx
push dword [ebp - 0x94]
mov dword [ebp - 0xa0], ecx
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x1001d87b
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x1001d875
cmp eax, 1
je 0x1001d875
cmp eax, ebx
je 0x1001d875
cmp eax, 3
jne 0x1001d87b
mov dword [ebp - 0x8c], eax
push dword [ebp - 0x94]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
lea edi, [ebp - 0xf8]
mov dword [ebp - 0xd0], eax
xor edx, edx
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0xfc], eax
xor eax, eax
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x118], 4
mov dword [ebp - 0x114], 0x2710
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x100], edx
stosd dword es:[edi], eax
mov dword [ebp - 0xd4], 1
mov dword [ebp - 0xc8], 0x1000253c
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp - 0x7c]
test edi, edi
je 0x1001da05
test ecx, ecx
je 0x1001da05
mov eax, dword [ecx]
test eax, eax
je 0x1001da05
cmp dword [eax + 0x10], edx
je 0x1001da05
mov ecx, dword [ebp - 0x74]
push 0x20
pop edx
push edx
mov eax, dword [ecx]
push 0x40
push ecx
mov dword [ebp - 0x90], edx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1004f3f8]
call esi
mov dword [ebp - 0x8c], eax
test eax, eax
jne 0x1001d977
push 0x1000204c
push 0x10001f48
push 0x50f
mov esi, 0x8007000e
mov dword [ebp - 0x68], esi
mov ecx, 0x10002084
call fcn.1002d054
push eax
push esi
jmp 0x1001dc4a
lea ecx, [ebp - 0x90]
call fcn.1002f950
mov esi, eax
mov dword [ebp - 0x68], esi
test esi, esi
jns 0x1001d99c
push 0x1000204c
push 0x10001f48
push 0x512
jmp 0x1001d966
mov esi, dword [edi + 4]
mov eax, dword [ebp - 0x8c]
mov dword [edi + 0x14], eax
push 0x20
pop edx
mov dword [edi + 0x10], edx
test esi, esi
je 0x1001d9db
cmp dword [edi], 0
jbe 0x1001d9db
cmp dword [edi], edx
je 0x1001d9d1
push 0x1000204c
push 0x10001f48
mov esi, 0x8004857d
push 0x51b
jmp 0x1001d963
push 8
pop ecx
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
jmp 0x1001d9e1
mov edx, dword [ebp - 0xa8]
mov esi, eax
lea edi, [ebp - 0x54]
push 8
lea eax, [ebp - 0x54]
add edi, edx
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x80]
mov dword [ebp - 0x78], eax
lea eax, [edx + 0x20]
mov dword [ebp - 0x84], eax
push dword [ebp - 0x88]
lea eax, [ebp - 0x84]
push dword [ebp - 0x9c]
push ecx
push dword [ebp - 0x78]
push eax
push dword [ebp - 0xc4]
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x98]
push dword [ebp - 0xb4]
push dword [ebp - 0xb8]
call dword [sym.imp.webauthn.dll_WebAuthNCtapGetAssertion]
mov esi, eax
mov dword [ebp - 0x68], esi
test esi, esi
jns 0x1001da7d
mov edx, dword [ebp - 0x80]
mov ecx, esi
call fcn.1001df14
mov esi, eax
mov dword [ebp - 0x68], esi
test esi, esi
jns 0x1001da7d
push 0x1000204c
push 0x10001f48
push 0x53f
jmp 0x1001d966
test edi, edi
je 0x1001db5c
cmp dword [ebp - 0x78], 0
mov esi, dword [ebp - 0x74]
je 0x1001daa0
cmp dword [ebp - 0x84], 0
jne 0x1001daa7
mov edx, edi
mov ecx, esi
call fcn.10019589
cmp dword [ebp - 0x84], 0
jbe 0x1001db5c
xor eax, eax
mov dword [ebp - 0x7c], eax
cmp dword [edi + 4], eax
je 0x1001db06
cmp dword [edi], eax
jbe 0x1001db06
push 0x20
pop ecx
mov dword [edi + 8], ecx
mov eax, dword [esi]
push ecx
push 0x40
push esi
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1004f3f8]
call esi
mov dword [edi + 0xc], eax
test eax, eax
jne 0x1001daef
push 0x1000204c
push 0x10001f48
push 0x556
jmp 0x1001d95e
push dword [edi + 8]
push dword [ebp - 0x78]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [edi + 8]
add esp, 0xc
mov dword [ebp - 0x7c], eax
xor eax, eax
cmp dword [edi + 0x14], eax
je 0x1001db5c
cmp dword [edi + 0x10], eax
jbe 0x1001db5c
mov ecx, dword [ebp - 0x74]
push 0x20
pop edx
mov dword [edi + 0x18], edx
mov eax, dword [ecx]
push edx
push 0x40
push ecx
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x1004f3f8]
call esi
mov ecx, eax
mov dword [edi + 0x1c], ecx
test ecx, ecx
jne 0x1001db49
push 0x1000204c
push 0x10001f48
push 0x564
jmp 0x1001d95e
push dword [edi + 0x18]
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x78]
push eax
push ecx
call sub.msvcrt.dll_memcpy
add esp, 0xc
mov esi, dword [ebp - 0x6c]
mov eax, dword [esi]
test eax, eax
jne 0x1001db8d
push 0x1000204c
push 0x10001f48
mov edi, 0x80048573
mov ecx, 0x10002084
push 0x56d
mov dword [ebp - 0x68], edi
call fcn.1002d054
push eax
push edi
jmp 0x1001d7ec
mov ecx, dword [ebp - 0xbc]
test ecx, ecx
je 0x1001dbd5
cmp dword [ebp + 0x14], 0
jbe 0x1001dbd5
push ecx
push dword [ebp + 0x14]
push eax
lea eax, [ebp - 0xd4]
push eax
push dword [ebp - 0x98]
call dword [sym.imp.webauthn.dll_WebAuthNCtapVerifyGetAssertion]
mov esi, eax
mov dword [ebp - 0x68], esi
test esi, esi
jns 0x1001dbd2
push 0x1000204c
push 0x10001f48
push 0x578
jmp 0x1001d966
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0xac]
test ecx, ecx
je 0x1001dc5e
mov eax, dword [esi]
push ecx
lea ecx, [ebp - 0x6d]
mov byte [ebp - 0x6d], 0
push ecx
push dword [eax + 8]
push dword [eax + 4]
call dword [sym.imp.webauthn.dll_WebAuthNCtapParseAuthenticatorData]
mov esi, eax
mov dword [ebp - 0x68], esi
test esi, esi
jns 0x1001dc78
push 0x1000204c
push 0x10001f48
push 0x583
jmp 0x1001d966
push 0x1000204c
push 0x10001f48
push 0x4b2
jmp 0x1001dc33
push 0x1000204c
push 0x10001f48
push 0x4ac
mov esi, 0x80070057
mov ecx, 0x10002084
mov dword [ebp - 0x68], esi
call fcn.1002d054
push eax
push esi
push 2
pop ebx
push ebx
push 0x10002030
push 0
push ebx
call fcn.1002d079
mov esi, dword [ebp - 0x6c]
add esp, 0x24
cmp dword [ebp - 0x68], 0
jge 0x1001dc78
test esi, esi
je 0x1001dc78
cmp dword [esi], 0
je 0x1001dc78
push dword [esi]
call dword [sym.imp.webauthn.dll_WebAuthNFreeAssertion]
and dword [esi], 0
mov ecx, dword [ebp - 0x74]
test ecx, ecx
je 0x1001dcb2
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x1001dcb2
mov edx, dword [ebp - 0x9c]
test edx, edx
je 0x1001dc9c
mov byte [eax], 0
inc eax
sub edx, 1
jne 0x1001dc93
mov eax, dword [ecx]
push dword [ebp - 0x88]
push ecx
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x1004f3f8]
call esi
mov esi, dword [ebp - 0x68]
lea ecx, [ebp - 0xe4]
call fcn.100185c5
lea ecx, [ebp - 0xc4]
call fcn.1001a15b
mov eax, esi
call fcn.100472b1
ret 0x38