Function at 0x109e4ce
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x605c
call fcn.0107a6d0
mov eax, dword [0x10e607c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x6020], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
push eax
mov dword [ebp - 0x6028], edi
mov dword [ebp - 0x6038], eax
mov dword [ebp - 0x6040], esi
mov dword [ebp - 0x602c], esi
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6034], esi
mov dword [ebp - 0x6024], esi
mov dword [ebp - 0x6010], esi
mov dword [ebp - 0x6014], esi
call fcn.010ac884
test byte [edi + 0x60], 0x80
mov ebx, eax
mov dword [ebp - 0x6048], ebx
je 0x109e55e
push ebx
call fcn.010ac90e
push eax
push esi
push edi
call fcn.010acba1
push eax
mov dword [ebp - 0x6040], eax
call fcn.010ac90e
jmp 0x109e560
mov eax, ebx
cmp ebx, esi
je 0x109edc0
cmp eax, esi
je 0x109edc0
push eax
push 0x1011cb8
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x2000000
jne 0x109ec3f
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011e10
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x109ec3f
lea eax, [ebp - 0x6030]
push eax
lea eax, [ebp - 0x6034]
push eax
push esi
push esi
push 0x1011e00
push dword [ebp - 0x600c]
mov dword [ebp - 0x6030], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x600c]
mov dword [ebp - 0x6018], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6018], esi
jne 0x109ec3f
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
je 0x109e68b
push 0x1012078
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1012038
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x109e68b
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.0109dc38
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1011db0
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1012038
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x109e709
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.0109dc38
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
pop ecx
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6010], esi
je 0x109e7a8
push 0x1012078
lea eax, [ebp - 0x2004]
push 0x1012000
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x109e7a8
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x109e7a8
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.0109dc38
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1011db0
lea eax, [ebp - 0x2004]
push 0x1012000
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x109e828
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x109e828
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.0109dc38
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp - 0x6018], esi
pop ecx
jne 0x109ec3f
mov eax, dword [ebp - 0x602c]
jmp 0x109ec31
mov eax, dword [ebp - 0x6010]
cmp word [eax], si
je 0x109ec3f
push 0x1011fd8
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x1011fd8
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x109e8b1
push 0x1011fd8
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2]
push eax
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1012038
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
jmp 0x109e8cc
push dword [ebp - 0x6010]
lea eax, [ebp - 0x2004]
push 0x1011fb4
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push dword [ebp - 0x6010]
lea eax, [ebp - 0x6004]
push 0x1011fa0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x1011f90
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x109ec1a
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
cmp word [ecx + eax*2 - 2], 0x2a
lea eax, [ebp - 0x2004]
jne 0x109ec01
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov word [ebp + eax*2 - 0x2008], si
lea eax, [ebp - 0x6004]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
mov word [ebp + eax*2 - 0x6008], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6030]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x109ec1a
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6044]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x6004]
push eax
push 0x80000002
call edi
cmp eax, esi
jne 0x109ebc4
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6014], esi
mov dword [ebp - 0x6024], esi
cmp dword [ebp - 0x6014], esi
je 0x109e9cb
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
lea eax, [ebp - 0x605c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x6054]
push eax
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6024]
mov dword [ebp - 0x6054], 0x1000
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x109eb9e
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6044]
call edi
cmp eax, esi
je 0x109ea34
mov dword [ebp - 0x6014], esi
cmp eax, esi
mov dword [ebp - 0x6008], esi
jne 0x109eaad
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push 4
push 0x100210c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x109ebd2
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push esi
push 0x100210c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x109ebd2
mov dword [ebp - 0x6008], esi
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x604c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x1011f84
push dword [ebp - 0x6014]
mov dword [ebp - 0x6018], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x109eb6c
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x603c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x1011f84
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x109eb6c
mov eax, dword [ebp - 0x604c]
cmp eax, dword [ebp - 0x603c]
jae 0x109eb6c
lea eax, [ebp - 0x6004]
push 0x1011f40
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x109eb4f
lea eax, [ebp - 0x4004]
push 0x1011f34
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x109eb6c
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.0109db9a
mov dword [ebp - 0x6018], esi
cmp dword [ebp - 0x6008], esi
je 0x109eb8c
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6008], esi
inc dword [ebp - 0x6024]
cmp dword [ebp - 0x6018], esi
je 0x109e9b1
cmp dword [ebp - 0x6014], esi
je 0x109ebb8
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6030]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x109ec1a
cmp dword [ebp - 0x601c], 1
jne 0x109eaad
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.0109db9a
jmp 0x109eb72
push dword [ebp - 0x6038]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.0109e349
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2 + 2]
cmp eax, esi
mov dword [ebp - 0x6010], eax
jne 0x109e84c
cmp word [0x10f5ef0], si
je 0x109ecde
push 0x5c
push 0x10f5ef0
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x109ec64
mov eax, 0x10f5ef0
add eax, 2
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x109ec7b
mov eax, 0x10f5ef0
add eax, 2
push eax
push dword [ebp - 0x6034]
mov dword [ebp - 0x603c], eax
lea eax, [ebp - 0x2004]
push 0x1011ef0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push dword [ebp - 0x603c]
lea eax, [ebp - 0x6004]
push 0x1011eb0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
push dword [ebp - 0x6038]
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.0109e349
mov word [0x10f5ef0], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011ea0
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x109ed8c
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011cb8
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x109ed80
cmp dword [0x10eae50], esi
je 0x109ed74
push esi
push esi
push dword [ebp - 0x600c]
push dword [ebp - 0x6014]
call sub.SYSSETUP.dll_AsrRestorePlugPlayRegistryData
test eax, eax
jne 0x109ed74
push esi
push esi
push esi
call fcn.01053123
push 0xe27
xor edi, edi
inc edi
push edi
push edi
push esi
call fcn.01053123
push 8
push esi
call fcn.01053123
add esp, 0x24
mov dword [0x10e93f0], edi
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x602c]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
pop ecx
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x1011cb8
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x6048]
jmp 0x109edc7
mov esi, dword [sym.imp.msvcrt.dll_free]
push ebx
call esi
push dword [ebp - 0x6040]
call esi
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01078836
leave
ret 8