Function at 0x10537e9
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x538], ecx
xor ecx, ecx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x534], ecx
mov dword [ebp - 0x52c], ecx
mov ebx, 0x2001f
cmp eax, ecx
je 0x105383e
lea edx, [ebp - 0x52c]
push edx
push ebx
push ecx
push eax
push 0x80000000
jmp 0x1053871
lea eax, [ebp - 0x534]
push eax
push ebx
push ecx
push 0x10073b8
push 0x80000000
call edi
mov esi, eax
test esi, esi
jne 0x1053935
lea eax, [ebp - 0x52c]
push eax
push ebx
push esi
push 0x1008608
push dword [ebp - 0x534]
call edi
mov esi, eax
test esi, esi
jne 0x1053935
mov dword [ebp - 0x528], 0x80
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x524], eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x520]
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x1053929
inc dword [ebp - 0x520]
lea eax, [ebp - 0x524]
push eax
push ebx
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x52c]
mov dword [ebp - 0x528], 0x80
call edi
mov esi, eax
test esi, esi
jne 0x1053929
push dword [ebp - 0x524]
mov ecx, dword [ebp - 0x538]
call fcn.01053468
test eax, eax
jge 0x1053916
lea eax, [ebp - 0x104]
push eax
push 0x1008ddc
push 4
call fcn.01055c69
add esp, 0xc
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1053893
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x534], 0
je 0x105394a
push dword [ebp - 0x534]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1053974
cmp esi, 0x103
je 0x1053974
test esi, esi
jg 0x1053962
mov dword [ebp - 0x530], esi
jmp 0x1053974
mov eax, esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x538]
cmp dword [eax + 0x1c], 3
jne 0x1053af1
push 0x10085ec
push 0x10073b8
push 0x100286c
lea eax, [ebp - 0x51c]
push 0x105
push eax
call fcn.0103590d
add esp, 0x14
test eax, eax
jl 0x1053b11
and dword [ebp - 0x520], 0
lea eax, [ebp - 0x520]
push eax
push ebx
push 0
lea eax, [ebp - 0x51c]
push eax
push 0x80000000
call edi
test eax, eax
jne 0x1053b11
mov dword [ebp - 0x540], 0x80
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x528]
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x1053ae5
inc dword [ebp - 0x528]
lea eax, [ebp - 0x524]
push eax
push ebx
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x520]
mov dword [ebp - 0x540], 0x80
call edi
mov esi, eax
test esi, esi
jne 0x1053ae5
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x53c]
push eax
push 0
push 0x10077c4
push dword [ebp - 0x524]
inc esi
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x544], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1053ad2
cmp dword [ebp - 0x53c], esi
jne 0x1053ad2
mov ecx, dword [ebp - 0x538]
lea eax, [ebp - 0x310]
push eax
call fcn.0104cb5c
test eax, eax
jne 0x1053ad2
push dword [ebp - 0x524]
mov ecx, dword [ebp - 0x538]
call fcn.01053468
test eax, eax
jge 0x1053ad2
lea eax, [ebp - 0x104]
push eax
push 0x1008db4
push 4
call fcn.01055c69
add esp, 0xc
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10539ec
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1053b11
cmp esi, 0x103
je 0x1053b11
test esi, esi
jle 0x1053b0f
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x1053b1d
xor esi, esi
cmp dword [ebp - 0x530], esi
jl 0x1053b26
jmp 0x1053b2c
cmp dword [ebp - 0x530], 0
jge 0x1053b2c
mov esi, dword [ebp - 0x530]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 4