Function at 0x105dd77
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], ebx
je 0x105de03
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test byte [ebp + 0x10], 1
je 0x105ddd4
cmp eax, 2
je 0x105ddbf
cmp eax, 3
jne 0x105ddd4
cmp eax, ebx
jle 0x105ddcd
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x105df88
cmp eax, ebx
je 0x105de09
jle 0x105dde4
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0xc]
mov edi, eax
push 0x102f8a4
push 1
push edi
push 0x4000000
call fcn.01050085
add esp, 0x14
jmp 0x105df88
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x105debf
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0105e0cc
mov edi, eax
cmp edi, ebx
jge 0x105de31
push 0x102f9fc
push 1
push edi
jmp 0x105de80
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x105de92
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 1
je 0x105df08
cmp dword [ebp - 0xc], 2
je 0x105df08
push 0x102f9d4
mov eax, 0x8007000d
push 1
mov edi, eax
push eax
push 0x4000000
call fcn.01050085
add esp, 0x10
jmp 0x105df87
cmp eax, 0xea
je 0x105de5d
test byte [ebp + 0x10], 1
je 0x105dea4
cmp eax, 2
je 0x105dee0
cmp eax, ebx
jle 0x105deb2
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x102f980
jmp 0x105df5d
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test byte [ebp + 0x10], 1
je 0x105deea
cmp eax, 2
jne 0x105deea
mov edi, 0x80070002
jmp 0x105df87
cmp eax, ebx
je 0x105de5d
jle 0x105defe
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x102f930
jmp 0x105df5d
cmp dword [ebp - 0x14], ebx
jne 0x105df71
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
inc eax
push eax
push esi
mov dword [ebp - 0x10], eax
call fcn.0105e192
mov edi, eax
cmp edi, ebx
jge 0x105df2e
push dword [ebp + 0x14]
push 0x102f8f8
jmp 0x105df5f
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x105df71
jle 0x105df55
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x102f8d4
mov edi, eax
push 1
push edi
push 0x4000000
call fcn.01050085
add esp, 0x14
jmp 0x105df87
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov word [eax + edx*2 - 4], cx
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
mov word [eax + edx*2 - 2], cx
pop esi
cmp dword [ebp + 0xc], ebx
je 0x105df9b
cmp dword [ebp - 4], ebx
je 0x105df9b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0x14