Function at 0x10017789
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x1006b1fc]
xor eax, ebp
mov dword [ebp + 0x7b4], eax
push ebx
push esi
push edi
call fcn.100179cc
xor eax, eax
lea ecx, [ebp - 0x80]
mov esi, 0x20019
mov dword [ebp - 0x80], eax
push esi
push 0x10050ac0
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
call fcn.10006b74
mov ebx, dword [ebp - 0x80]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100179a7
push esi
push 0x10050acc
push ebx
lea ecx, [ebp - 0x70]
call fcn.10006b74
test eax, eax
jne 0x1001799c
push esi
push 0x10050ad8
push dword [ebp - 0x70]
lea ecx, [ebp - 0x58]
call fcn.10006b74
mov esi, dword [ebp - 0x58]
test eax, eax
jne 0x10017995
and dword [ebp - 0x74], 0
lea eax, [ebp + 0x3b4]
push 0x400
push 0
push eax
call fcn.10022670
push 0x400
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.10022670
add esp, 0x18
lea eax, [ebp + 0x3b4]
push 0x400
push eax
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x10017995
mov edi, dword [ebp - 0x74]
lea ecx, [ebp + 0x3b4]
xor edx, edx
lea ebx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001787a
sub ecx, ebx
lea ebx, [ebp - 0x4c]
mov al, byte [ebp + edx + 0x3b4]
cmp al, 0x2e
je 0x10017894
mov byte [ebx], al
inc ebx
inc edx
cmp edx, ecx
jbe 0x10017886
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x64], str.NODOTVERSION
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100178ae
sub ecx, edx
lea ebx, [ecx + 1]
cmp ebx, 0x3fffffff
jle 0x100178c6
xor eax, eax
jmp 0x100178dd
lea eax, [ebx + ebx]
call fcn.1001f330
mov eax, esp
lea ecx, [ebp - 0x4c]
push 3
push ebx
push ecx
push eax
call fcn.10003a80
push 0x50
mov dword [ebp - 0x60], eax
pop eax
mov dword [ebp - 0x5c], str.CLSID_STRING
call fcn.1001f330
mov eax, esp
push 3
push 0x27
push 0x10050504
push eax
call fcn.10003a80
and dword [ebp - 0x54], 0
and dword [ebp - 0x50], 0
mov dword [ebp - 0x58], eax
call fcn.1001ae95
test eax, eax
je 0x10017926
lea eax, [ebp - 0x64]
push eax
push 1
push 0x67
push 0x1006d188
call fcn.1000e875
call fcn.1001af96
test eax, eax
je 0x10017938
cmp dword [ebp + 0x7c4], 0
je 0x1001794a
lea eax, [ebp - 0x64]
push eax
push 1
push 0x68
push 0x1006d188
call fcn.1000e875
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, 0x400
lea eax, [ebp + 0x3b4]
push ebx
push 0
push eax
call fcn.10022670
push ebx
lea eax, [ebp - 0x4c]
push 0
push eax
call fcn.10022670
add esp, 0x18
lea eax, [ebp + 0x3b4]
inc edi
push ebx
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x1001786f
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x80]
test esi, esi
je 0x1001799c
push esi
call edi
cmp dword [ebp - 0x70], 0
je 0x100179a7
push dword [ebp - 0x70]
call edi
test ebx, ebx
je 0x100179ae
push ebx
call edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x7b4]
xor ecx, ebp
call fcn.1001f12f
add ebp, 0x7b8
leave
ret