Function at 0x10280ba
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x1053d10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
cmp eax, esi
push edi
mov dword [ebp - 0x63c], ecx
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0x638], esi
je 0x10284be
lea eax, [ebp - 0x628]
push eax
push 0x20019
push esi
push 0x1002e08
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102849a
cmp dword [ebp - 0x628], esi
je 0x102849a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea eax, [ebp - 0x644]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x628]
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x630], 0x104
call ebx
mov edi, 0x1007604
jmp 0x10283d9
mov ecx, 0x100770c
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1028194
cmp dx, si
je 0x1028190
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1028194
add eax, 4
add ecx, 4
cmp dx, si
jne 0x102816e
xor eax, eax
jmp 0x1028199
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x10283a3
mov ecx, 0x1002d94
lea eax, [ebp - 0x210]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10281d2
cmp dx, si
je 0x10281ce
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10281d2
add eax, 4
add ecx, 4
cmp dx, si
jne 0x10281ac
xor eax, eax
jmp 0x10281d7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0x10283a3
lea eax, [ebp - 0x210]
push 0x10076f0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10283a3
lea eax, [ebp - 0x210]
push 0x10076c8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10283a3
lea eax, [ebp - 0x210]
push 0x10076a4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10283a3
lea eax, [ebp - 0x210]
push 0x1007694
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10283a3
lea eax, [ebp - 0x210]
push 0x1007678
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10283a3
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x62c]
lea eax, [ebp - 0x620]
push 0x1007664
push 0x208
push eax
mov dword [ebp - 0x624], esi
call fcn.010184d0
add esp, 0x14
cmp eax, esi
jl 0x10283f7
cmp dword [ebp - 0x638], esi
jne 0x10282c4
push dword [ebp - 0x62c]
call fcn.0101d961
test eax, eax
je 0x1028438
mov dword [ebp - 0x638], 1
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.0104339f
cmp eax, esi
jl 0x1028370
mov ecx, dword [ebp - 0x63c]
push 1
push dword [ebp - 0x624]
lea eax, [ebp - 0x210]
push eax
call fcn.01027f84
test eax, eax
jne 0x102832b
mov eax, dword [section..data]
cmp eax, section..data
je 0x102832b
test byte [eax + 0x1c], 2
je 0x102832b
lea ecx, [ebp - 0x620]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push edi
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101ffb8
mov ecx, dword [ebp - 0x624]
mov eax, dword [ecx]
push esi
call dword [eax + 0x10]
cmp eax, esi
jge 0x1028363
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1028363
test byte [ecx + 0x1c], 2
je 0x1028363
push eax
push 0x1007638
push edi
push 0xd
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040d30
mov ecx, dword [ebp - 0x624]
mov eax, dword [ecx]
call dword [eax + 0x18]
jmp 0x1028393
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1028393
test byte [ecx + 0x1c], 2
je 0x1028393
push eax
push edi
push 0xe
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101420b
mov eax, dword [ebp - 0x624]
cmp eax, esi
je 0x10283a3
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
inc dword [ebp - 0x634]
lea eax, [ebp - 0x644]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x634]
mov dword [ebp - 0x630], 0x104
push dword [ebp - 0x628]
call ebx
test eax, eax
je 0x1028163
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x102846c
inc eax
jmp 0x10284c0
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x102841f
test byte [ecx + 0x1c], 2
je 0x102841f
push eax
push 0x1002b18
push edi
push 0xa
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01040d30
mov eax, dword [ebp - 0x624]
cmp eax, esi
je 0x10284be
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10284be
mov eax, dword [section..data]
cmp eax, section..data
je 0x102845e
test byte [eax + 0x1c], 2
je 0x102845e
push dword [ebp - 0x62c]
push edi
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01013fed
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x102841f
mov eax, dword [section..data]
cmp eax, section..data
je 0x10284be
test byte [eax + 0x1c], 2
je 0x10284be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov eax, dword [section..data]
push edi
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101420b
jmp 0x10284be
mov eax, dword [section..data]
cmp eax, section..data
je 0x10284be
test byte [eax + 0x1c], 2
je 0x10284be
push 0x1007604
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010141c0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0103563d
leave
ret 4