Function at 0x10046dd
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 1
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
add esi, 0x618
push esi
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov esi, dword [ebp + 8]
jne 0x1004753
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1001bdc
push dword [ebp - 4]
mov dword [ebp - 8], 0xf90
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ebx, eax
mov word [esi + 0xf8e], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x1004980
push 0x1001bc8
mov edi, 0x84
push edi
lea eax, [esi + 4]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001bb0
push edi
lea eax, [esi + 0x10c]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
mov eax, dword [ebp + 0xc]
add eax, 0x820
push eax
push edi
lea eax, [esi + 0x21c]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001ba0
push edi
lea eax, [esi + 0x324]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b90
push edi
lea eax, [esi + 0x42c]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b7c
push edi
lea eax, [esi + 0x534]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b5c
push edi
lea eax, [esi + 0x648]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001ba0
push edi
lea eax, [esi + 0x768]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001b10
push 0x28
lea eax, [esi + 0x870]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001ac0
push 0x28
lea eax, [esi + 0x8c0]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a70
push 0x28
lea eax, [esi + 0x910]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0x960]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xa68]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xc78]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xb70]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xd80]
push eax
call fcn.01002aa5
mov ebx, eax
test ebx, ebx
jl 0x100499d
push 0x1001a10
push edi
lea eax, [esi + 0xe88]
push eax
call fcn.01002aa5
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x100499d
mov dword [esi + 0x214], 8
mov dword [esi + 0x218], eax
mov dword [esi + 0x63c], eax
mov dword [esi + 0x640], eax
mov dword [esi + 0x644], eax
mov dword [esi + 0x750], eax
mov dword [esi + 0x754], eax
mov dword [esi + 0x758], eax
mov dword [esi + 0x75c], eax
mov dword [esi + 0x760], eax
mov dword [esi + 0x764], eax
xor ebx, ebx
jmp 0x100499d
add esi, 0x324
cmp word [esi], di
jne 0x100499d
push 0x1001ba0
push 0x84
push esi
call fcn.01002aa5
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret