Function at 0x4010d4ba
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
dec eax
mov dword [ebp - 0x20], eax
push 9
push 0x4010da84
lea eax, [ebp - 0x420]
push 0x4010da7c
push eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x14], edi
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
lea eax, [ebp - 0xc]
push eax
push 0x20019
lea eax, [ebp - 0x420]
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x4010d77f
lea eax, [ebp - 8]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x18]
push edi
push eax
mov esi, 0x4010da70
push edi
push esi
push dword [ebp - 0xc]
call ebx
cmp eax, edi
jne 0x4010d77f
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_malloc]
cmp eax, edi
pop ecx
mov dword [ebp - 4], eax
je 0x4010d77f
mov ecx, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push dword [ebp - 4]
push eax
push 0
push esi
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x4010d77f
mov ebx, dword [ebp - 4]
jmp 0x4010d5c0
mov esi, dword [sym.imp.MSVCRT.dll_isdigit]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x4010da68
push ebx
call edi
test eax, eax
je 0x4010d5e7
push 0x4010da5c
push ebx
call edi
test eax, eax
je 0x4010d61e
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [ebx + ecx + 1]
cmp byte [ebx], 0
je 0x4010d640
cmp ebx, dword [ebp - 4]
jbe 0x4010d58c
movsx eax, byte [ebx - 2]
mov esi, dword [sym.imp.MSVCRT.dll_isdigit]
lea edi, [ebx - 2]
push eax
call esi
test eax, eax
pop ecx
je 0x4010d592
movsx eax, byte [edi - 1]
dec edi
push eax
jmp 0x4010d5d8
lea edi, [ebx - 2]
movsx eax, byte [edi]
push eax
call esi
test eax, eax
pop ecx
je 0x4010d5f8
dec edi
jmp 0x4010d5ea
inc edi
or ecx, 0xffffffff
xor eax, eax
lea edx, [ebp - 0x420]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
jmp 0x4010d5b0
lea edi, [ebx - 2]
movsx eax, byte [edi]
push eax
call esi
test eax, eax
pop ecx
je 0x4010d62f
dec edi
jmp 0x4010d621
inc edi
push edi
call dword [sym.imp.MSVCRT.dll_atol]
pop ecx
mov dword [ebp - 0x10], eax
jmp 0x4010d5b0
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
mov eax, 0xc800
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.MSVCRT.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 4], eax
je 0x4010d77f
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edx, ecx
xor eax, eax
mov edi, esi
mov ebx, 0xea
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [ebp - 8]
mov edi, dword [ebp - 8]
push eax
lea eax, [ebp - 0x18]
push esi
push eax
lea eax, [ebp - 0x420]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40110940
cmp dword [ebp - 8], eax
jbe 0x40110940
cmp word [esi], 0x50
jne 0x40110940
cmp word [esi + 2], 0x45
jne 0x40110940
cmp word [esi + 4], 0x52
jne 0x40110940
cmp word [esi + 6], 0x46
jne 0x40110940
mov eax, dword [esi + 0x18]
add eax, esi
xor esi, esi
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0x20]
add ecx, eax
test edx, edx
jbe 0x4010d705
mov edi, dword [ebp - 0x10]
cmp dword [ecx + 4], edi
je 0x4010d7a6
add ecx, 0x28
inc esi
cmp esi, edx
jb 0x4010d6f1
mov ecx, dword [eax + 0x28]
mov edx, dword [ebp - 0x20]
cmp edx, ecx
mov dword [ebp + 0xc], edx
jb 0x4010d715
mov dword [ebp + 0xc], ecx
mov esi, dword [eax + 4]
add esi, eax
cmp dword [ebp + 0xc], 0
jbe 0x4010d77f
mov eax, dword [ebp + 8]
lea edi, [eax + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov ebx, dword [esi + 0x10]
add ebx, esi
cmp byte [ebx + 1], 0
jne 0x401109ce
cmp byte [ebx + 2], 0
je 0x401109ce
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_wcscpy]
pop ecx
pop ecx
mov eax, dword [esi]
mov ecx, dword [ebp - 0x1c]
and dword [edi - 4], 0
and dword [edi - 8], 0
mov edx, dword [ebp + 8]
add eax, esi
mov ecx, dword [ecx + eax]
test ecx, ecx
mov dword [edx], ecx
je 0x4010d7b1
mov esi, dword [eax]
mov ecx, 0x358
add edx, ecx
add edi, ecx
add esi, eax
dec dword [ebp - 0x10]
mov dword [ebp + 8], edx
jne 0x4010d72c
cmp dword [ebp - 4], 0
je 0x4010d78f
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
cmp dword [ebp - 0xc], 0
je 0x4010d79e
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ecx + 0x24]
mov dword [ebp - 0x1c], ecx
jmp 0x4010d705
mov dword [edx], 0xfffffffe
jmp 0x4010d76a
cmp eax, ebx
jne 0x40110980
cmp edi, dword [ebp - 8]
jbe 0x40110999
cmp eax, ebx
jne 0x40110980
add dword [ebp - 8], 0x6400
push dword [ebp - 8]
push esi
call dword [sym.imp.MSVCRT.dll_realloc]
pop ecx
mov edi, eax
pop ecx
xor eax, eax
mov ecx, dword [ebp - 8]
mov dword [ebp - 4], edi
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov esi, dword [ebp - 4]
jmp 0x4010d682
cmp eax, 0xc0000005
jne 0x4010d77f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jle 0x40110978
jmp 0x4010d77f
cmp word [esi], 0x50
jne 0x4010d77f
mov eax, dword [ebp - 4]
cmp word [eax + 2], 0x45
jne 0x4010d77f
cmp word [eax + 4], 0x52
jne 0x4010d77f
cmp word [eax + 6], 0x46
jne 0x4010d77f
mov esi, eax
jmp 0x4010d6de
push ebx
call dword [sym.imp.MSVCRT.dll__mbstrlen]
pop ecx
push eax
push ebx
push edi
call dword [sym.imp.MSVCRT.dll_mbstowcs]
add esp, 0xc
jmp 0x4010d74f