Function at 0x10004818
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x270
mov eax, 0x1004811c
call fcn.10026412
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x248], eax
mov dword [ebp - 0x238], ecx
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], ecx
mov edi, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x228], ecx
mov dword [ebp - 0x224], ecx
mov esi, ecx
mov dword [ebp - 0x218], ecx
mov eax, vtable.CArray_class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t_____class_ATL::CStringT_wchar_t__class_StrTraitMFC_wchar_t__class_ATL::ChTraitsCRT_wchar_t____const__.0
mov dword [ebp - 0x244], 0xff
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], ecx
mov dword [ebp - 0x264], ecx
mov dword [ebp - 0x268], ecx
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x26c], esi
mov dword [ebp - 0x260], eax
mov eax, ecx
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x254], ecx
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x258], eax
push 0x20019
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
push SysReAllocStringLen
lea ecx, [ebp - 0x238]
mov byte [ebp - 4], 3
call fcn.10004db1
mov ebx, dword [ebp - 0x238]
test eax, eax
jne 0x10004af7
mov eax, esi
lea ecx, [ebp - 0x27c]
push ecx
xor ecx, ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x10004ad7
test eax, eax
mov eax, dword [ebp - 0x218]
jne 0x100048f3
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x23c]
call fcn.10001421
lea eax, [ebp - 0x23c]
mov byte [ebp - 4], 4
push eax
mov eax, dword [ebp - 0x248]
mov ecx, eax
push dword [eax + 8]
call fcn.10005556
mov ecx, dword [ebp - 0x23c]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.10005108
push 0x2001f
lea eax, [ebp - 0x210]
push eax
push reloc.WS2_32.dll_closesocket
lea ecx, [ebp - 0x22c]
call fcn.10004db1
test eax, eax
je 0x10004a9b
push 0x20019
lea eax, [ebp - 0x210]
push eax
push ebx
lea ecx, [ebp - 0x22c]
call fcn.10004db1
test eax, eax
jne 0x10004a93
lea ecx, [ebp - 0x214]
call fcn.100014cb
lea eax, [ebp - 0x240]
mov byte [ebp - 4], 5
push eax
push 0
mov edi, str.ProfileImagePath
lea ecx, [ebp - 0x22c]
push edi
call fcn.10004fd2
test eax, eax
jne 0x10004a81
lea eax, [ebp - 0x240]
push eax
push dword [ebp - 0x240]
lea ecx, [ebp - 0x214]
call fcn.10004eec
push eax
push edi
lea ecx, [ebp - 0x22c]
call fcn.10004fd2
push 0xffffffffffffffff
lea ecx, [ebp - 0x214]
call fcn.10005120
push str.NTUSER.DAT
lea ecx, [ebp - 0x214]
call fcn.1000234a
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x260]
call fcn.10005556
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x220]
call fcn.10001421
lea eax, [ebp - 0x220]
mov byte [ebp - 4], 6
push eax
push esi
lea ecx, [ebp - 0x274]
call fcn.10005556
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.10005108
mov eax, dword [ebp - 0x258]
mov esi, dword [ebp - 0x26c]
mov dword [ebp - 0x21c], eax
mov ecx, dword [ebp - 0x214]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.10005108
mov edi, dword [ebp - 0x22c]
jmp 0x10004abb
mov edi, dword [ebp - 0x22c]
test edi, edi
je 0x10004ab4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
mov dword [ebp - 0x22c], edi
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x244], 0xff
mov dword [ebp - 0x218], eax
jmp 0x100048f3
mov dword [ebp - 0x214], esi
test ebx, ebx
je 0x10004af0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov dword [ebp - 0x238], ebx
and dword [ebp - 0x234], 0
push 1
push str.SeRestorePrivilege
call fcn.10004cf0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10004b9a
push 1
push str.SeBackupPrivilege
call fcn.10004cf0
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10004b9a
and dword [ebp - 0x220], eax
cmp dword [ebp - 0x214], eax
jle 0x10004b9a
mov ebx, dword [ebp - 0x220]
mov edi, dword [ebp - 0x214]
push ebx
lea ecx, [ebp - 0x260]
call fcn.10002a28
push ebx
lea ecx, [ebp - 0x274]
mov esi, eax
call fcn.10002a28
push dword [esi]
push dword [eax]
push reloc.WS2_32.dll_closesocket
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov esi, eax
test esi, esi
jne 0x10004b89
mov ecx, dword [ebp - 0x248]
push ebx
call fcn.10002a28
push eax
mov eax, dword [ebp - 0x24c]
mov ecx, eax
push dword [eax + 8]
call fcn.10005556
inc ebx
cmp ebx, edi
jl 0x10004b3d
mov edi, dword [ebp - 0x22c]
mov ebx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x10004bdf
cmp dword [ebp - 0x21c], 0
jle 0x10004bd8
mov ebx, dword [ebp - 0x21c]
mov edi, eax
push 0
mov ecx, edi
call fcn.100017f0
add edi, 4
sub ebx, 1
jne 0x10004bb5
mov edi, dword [ebp - 0x22c]
mov ebx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x25c]
push eax
call fcn.10017949
pop ecx
mov eax, dword [ebp - 0x270]
test eax, eax
je 0x10004c24
cmp dword [ebp - 0x214], 0
jle 0x10004c1d
mov ebx, dword [ebp - 0x214]
mov edi, eax
push 0
mov ecx, edi
call fcn.100017f0
add edi, 4
sub ebx, 1
jne 0x10004bfa
mov edi, dword [ebp - 0x22c]
mov ebx, dword [ebp - 0x238]
mov eax, dword [ebp - 0x270]
push eax
call fcn.10017949
pop ecx
test edi, edi
je 0x10004c2f
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x10004c3a
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
call fcn.100263c1
ret