Function at 0x105c950
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push dword [0x1072c9c]
mov edi, 0x95
push 0x100b2bc
xor esi, esi
xor ebx, ebx
lea eax, [ebp - 0x25c]
push edi
inc ebx
push eax
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x270], esi
call fcn.0103592d
add esp, 0x14
test eax, eax
jge 0x105c9b4
xor eax, eax
jmp 0x105cbc8
lea eax, [ebp - 0x270]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105cbbb
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push esi
push 0x100b2a4
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
jne 0x105ca75
cmp dword [ebp - 0x268], ebx
jne 0x105ca75
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01035831
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x105ca48
xor ecx, ecx
mov word [eax], cx
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.01065462
test eax, eax
je 0x105ca64
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x105ca75
inc ebx
inc ebx
jmp 0x105ca24
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0x100b294
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105cb0b
cmp dword [ebp - 0x268], 1
jne 0x105cb0b
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01035831
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x105cade
xor ecx, ecx
mov word [eax], cx
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.01065ade
test eax, eax
je 0x105cafa
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x105cb0b
inc ebx
inc ebx
jmp 0x105caba
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0x100b280
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105cba1
cmp dword [ebp - 0x268], 1
jne 0x105cba1
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01035831
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x105cb74
xor ecx, ecx
mov word [eax], cx
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.01065ac3
test eax, eax
je 0x105cb90
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x105cba1
inc ebx
inc ebx
jmp 0x105cb50
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x260]
jne 0x105cbc0
push 2
pop eax
jmp 0x105cbc8
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret 4