Function at 0x10071aa
Capabilities:
Query or enumerate registry value

Disassembly:
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x234]
call fcn.01003520
jmp 0x100736a
push 0x240
push 0x10073d0
call fcn.010027c0
mov dword [ebp - 0x234], ecx
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x23c], eax
xor ebx, ebx
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x244], 0x104
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x238]
push eax
push 0x20019
push ebx
push esi
push dword [ecx + 0x7c]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0x240], eax
cmp eax, ebx
jne 0x101fec3
mov edi, 0x2000
push edi
mov ecx, dword [ebp - 0x234]
call fcn.01003587
mov dword [ebp - 0x230], eax
cmp eax, ebx
je 0x101ff05
mov ebx, dword [ebp - 0x230]
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], edi
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 0x230]
lea eax, [ebp - 0x22c]
push eax
push 0
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x248]
push dword [ebp - 0x238]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueW]
test eax, eax
jne 0x1007e64
xor esi, esi
cmp dword [ebp - 0x244], esi
je 0x100736a
mov word [ebx + 0x1ffe], ax
cmp dword [ebp - 0x22c], 1
jne 0x10073ec
cmp dword [ebp + 0xc], esi
jne 0x10073ec
mov dword [ebp - 0x22c], esi
cmp dword [ebp - 0x22c], esi
jne 0x100735d
push 0xffffffffffffffff
push 0x10073c0
push 0xffffffffffffffff
lea eax, [ebp - 0x224]
push eax
push 1
push 0x7f
mov esi, dword [sym.imp.KERNEL32.dll_CompareStringW]
call esi
cmp eax, 2
je 0x101ffac
push 0xffffffffffffffff
push 0x10073b0
push 0xffffffffffffffff
lea eax, [ebp - 0x224]
push eax
push 1
push 0x7f
call esi
cmp eax, 2
je 0x101ffac
push 0xffffffffffffffff
push 0x1007398
push 0xffffffffffffffff
lea eax, [ebp - 0x224]
push eax
push 1
push 0x7f
call esi
cmp eax, 2
je 0x101ffac
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1007348
test byte [eax + 0x1c], 0x20
je 0x1007348
cmp byte [eax + 0x19], 5
jae 0x101ff8e
push 1
push ebx
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x23c]
call fcn.010074d4
cmp dword [ebp - 0x228], 0
jne 0x100718e
inc dword [ebp - 0x248]
mov ebx, dword [ebp - 0x230]
mov dword [ebp - 0x250], ebx
mov eax, 0x1000
add eax, eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x244], 0x104
jmp 0x100724e
cmp dword [ebp - 0x22c], 2
je 0x1007401
or dword [ebp - 0x22c], 0xffffffff
jmp 0x10072bd
cmp dword [ebp + 0xc], 1
jne 0x10073f5
push edi
mov ecx, dword [ebp - 0x234]
call fcn.01003587
mov dword [ebp - 0x228], eax
cmp eax, esi
je 0x100743f
push 0x1000
push eax
push ebx
mov eax, dword [ebp - 0x23c]
push dword [eax]
call fcn.01007465
mov esi, eax
cmp esi, 0x1000
ja 0x101ff4a
xor esi, esi
cmp dword [ebp - 0x228], esi
je 0x10073f5
mov dword [ebp - 0x22c], esi
mov ebx, dword [ebp - 0x228]
mov dword [ebp - 0x250], ebx
jmp 0x10072bd
xor ebx, ebx
mov dword [ebp - 4], 0xfffffffe
call 0x1007e85
mov eax, dword [ebp - 0x240]
call fcn.01002808
ret 0xc
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1007e66
test byte [eax + 0x1c], 0x20
je 0x1007e66
cmp byte [eax + 0x19], 2
jb 0x1007e66
push dword [ebp - 0x240]
push esi
push 0x100186c
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100d355
jmp 0x1007e66
mov dword [ebp - 0x240], 0xe
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x1007e66
test byte [eax + 0x1c], 0x20
je 0x1007e66
cmp byte [eax + 0x19], 2
jb 0x1007e66
push 0x100186c
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001848
jmp 0x1007e66
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x234]
call fcn.01003520
lea eax, [esi + esi]
push eax
mov ecx, dword [ebp - 0x234]
call fcn.01003587
mov dword [ebp - 0x228], eax
test eax, eax
je 0x100743f
push esi
push eax
push ebx
mov eax, dword [ebp - 0x23c]
push dword [eax]
call fcn.01007465
jmp 0x100743f
lea ecx, [ebp - 0x224]
push ecx
push 0x100186c
push 0x35
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010020c5
jmp 0x1007348
mov eax, dword [0x1040184]
cmp eax, 0x1040184
je 0x101ffdd
test byte [eax + 0x1c], 0x20
je 0x101ffdd
cmp byte [eax + 0x19], 5
jb 0x101ffdd
lea ecx, [ebp - 0x224]
push ecx
push 0x100186c
push 0x34
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010020c5
push ebx
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x23c]
call fcn.0102bb0f
jmp 0x100735d