Function at 0x105a16e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x10b5894]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x410], 0
push esi
mov esi, dword [ebp + 0xc]
push edi
lea ecx, [ebp - 0x410]
push ecx
push 9
push 0
mov dword [ebp - 0x418], eax
mov eax, dword [ebp + 0x10]
push esi
push eax
mov dword [ebp - 0x41c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x105a1d6
push edi
push 0x1010938
call fcn.0107a7e2
push edi
push 0x3a4013a
push esi
call fcn.0107ae7f
jmp 0x105a4a7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x1010920
push dword [ebp - 0x410]
mov ebx, 0x400
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x105a22d
push edi
push 0x1010900
call fcn.0107a7e2
push edi
push 0x3b4013a
push 0x1010920
jmp 0x105a4a1
mov eax, dword [ebp - 0x40c]
shr eax, 1
and word [ebp + eax*2 - 0x408], 0
push 0x897
call fcn.0107a681
push eax
call fcn.0108880b
push dword [ebp - 0x41c]
push dword [ebp - 0x418]
push 0x10108ec
call fcn.0108880b
add esp, 0x10
push 0x892
call fcn.0107a681
push eax
call fcn.0108880b
lea eax, [ebp - 0x408]
push eax
push 0x10080b8
call fcn.0108880b
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x10108dc
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
je 0x105a2d6
push edi
push 0x1010900
call fcn.0107a7e2
push edi
push 0x3c8013a
push 0x10108dc
jmp 0x105a4a1
mov eax, dword [ebp - 0x40c]
shr eax, 1
and word [ebp + eax*2 - 0x408], 0
lea eax, [ebp - 0x408]
push eax
push 0x898
call fcn.0107a681
push eax
call fcn.0108880b
push 0x1003d24
call fcn.0108880b
add esp, 0xc
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0x10108cc
push dword [ebp - 0x410]
mov dword [ebp - 0x40c], ebx
call esi
mov edi, eax
test edi, edi
jne 0x105a37d
mov eax, dword [ebp - 0x40c]
shr eax, 1
and word [ebp + eax*2 - 0x408], di
lea eax, [ebp - 0x408]
push eax
push 0x1001ba4
call fcn.0108880b
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.01059fe6
mov edi, eax
test edi, edi
je 0x105a3a5
push edi
push 0x3de013a
call fcn.0107ae44
jmp 0x105a3a5
cmp edi, 2
jne 0x105a478
push 0x884
call fcn.0107a681
push eax
call fcn.0108880b
mov dword [esp], 0x1003d24
call fcn.0108880b
pop ecx
xor edi, edi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x408]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x40c], ebx
push 0
mov ebx, 0x10108b4
push ebx
push dword [ebp - 0x410]
call esi
mov esi, eax
test esi, esi
jne 0x105a41f
mov eax, dword [ebp - 0x40c]
shr eax, 1
and word [ebp + eax*2 - 0x408], si
lea eax, [ebp - 0x408]
push eax
push 0x1001ba4
call fcn.0108880b
pop ecx
pop ecx
lea eax, [ebp - 0x408]
push eax
call fcn.01059f7b
mov esi, eax
test esi, esi
je 0x105a443
push esi
push 0x3fc013a
lea eax, [ebp - 0x408]
push eax
call fcn.0107ae7f
jmp 0x105a443
cmp esi, 2
jne 0x105a44b
push 0x886
call fcn.0107a681
push eax
call fcn.0108880b
mov dword [esp], 0x1003d24
call fcn.0108880b
pop ecx
xor esi, esi
test edi, edi
jne 0x105a4a6
mov edi, esi
jmp 0x105a4a6
push esi
push 0x885
call fcn.0107a681
push eax
call fcn.0108880b
push 0x1003d24
call fcn.0108880b
add esp, 0xc
test edi, edi
jne 0x105a46f
mov edi, esi
push esi
push 0x40c013a
push ebx
jmp 0x105a4a1
push edi
push 0x885
call fcn.0107a681
push eax
call fcn.0108880b
push 0x1003d24
call fcn.0108880b
add esp, 0xc
push edi
push 0x3ea013a
push 0x10108cc
call fcn.0107ae7f
pop ebx
push 0x1003d24
call fcn.0108880b
cmp dword [ebp - 0x410], 0
pop ecx
je 0x105a4c7
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.01068363
leave
ret 0xc