Function at 0x1007288
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x854
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
xor eax, eax
push esi
mov edi, edx
mov dword [ebp - 0x830], ebx
mov dword [ebp - 0x82c], ebx
mov dword [ebp - 0x824], ebx
mov dword [ebp - 0x828], ebx
mov dword [ebp - 0x820], ebx
mov dword [ebp - 0x850], 0x58
mov dword [ebp - 0x840], ebx
mov dword [ebp - 0x84c], ebx
mov word [ebp - 0x204], ax
call fcn.01009dc6
call fcn.010099e9
mov ecx, eax
mov dword [ebp - 0x848], ecx
cmp ecx, ebx
jne 0x1007302
push 8
pop ebx
jmp 0x10075dc
push esi
call fcn.01006c0d
test eax, eax
je 0x1007319
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10075dc
lea eax, [ebp - 0x830]
push eax
mov ecx, edi
call fcn.01006db5
mov ebx, eax
test ebx, ebx
je 0x100734f
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x5208
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
jmp 0x10075b5
lea eax, [ebp - 0x82c]
push eax
push 0x20019
push 0
push 0x10032e0
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x1007387
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x526c
jmp 0x100733e
and dword [ebp - 0x838], 0
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov edi, 0xff
push 0x104
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x838]
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp ebx, 0x103
je 0x10076b7
test ebx, ebx
jne 0x1007714
lea eax, [ebp - 0x824]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x81c]
push eax
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x1007726
and dword [ebp - 0x83c], eax
push 0x104
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x83c]
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp ebx, 0x103
je 0x1007699
test ebx, ebx
jne 0x1007759
lea eax, [ebp - 0x828]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x100776b
and dword [ebp - 0x844], eax
push 0x104
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0x844]
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
cmp ebx, 0x103
je 0x100767b
test ebx, ebx
jne 0x1007788
inc dword [ebp - 0x84c]
lea eax, [ebp - 0x820]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x614]
push eax
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x100779a
push dword [ebp - 0x848]
push dword [ebp - 0x820]
call fcn.010060fa
test eax, eax
push edi
lea eax, [ebp - 0x204]
push eax
je 0x1007640
push 0x5528
push dword [0x100e874]
call esi
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x204]
push eax
push 2
call fcn.01004bfe
add esp, 0x14
inc dword [ebp - 0x840]
lea eax, [ebp - 0x850]
push eax
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x854]
push eax
push ebx
push 0x10032c8
push dword [ebp - 0x820]
mov dword [ebp - 0x850], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test ebx, ebx
jne 0x1007562
or dword [ebp - 0x834], 0x400
jmp 0x100756c
mov dword [ebp - 0x834], 0x400
push edi
lea eax, [ebp - 0x204]
push eax
push 0x558c
push dword [0x100e874]
call esi
push dword [ebp - 0x834]
lea eax, [ebp - 0x204]
push eax
push 2
call fcn.01004bfe
add esp, 0xc
test ebx, ebx
je 0x100765d
push edi
lea eax, [ebp - 0x204]
push eax
push 0x55f0
push dword [0x100e874]
call esi
lea eax, [ebp - 0x204]
push eax
push ebx
push 4
call fcn.01004ca7
add esp, 0xc
cmp dword [ebp - 0x830], 0
je 0x10075dc
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
cmp dword [ebp - 0x82c], edi
je 0x10075f4
push dword [ebp - 0x82c]
call esi
cmp dword [ebp - 0x824], edi
je 0x1007604
push dword [ebp - 0x824]
call esi
cmp dword [ebp - 0x828], edi
je 0x1007614
push dword [ebp - 0x828]
call esi
cmp dword [ebp - 0x820], edi
je 0x1007624
push dword [ebp - 0x820]
call esi
cmp dword [ebp - 0x848], edi
je 0x1007703
push dword [ebp - 0x848]
call fcn.01009a29
jmp 0x1007703
push 0x5654
push dword [0x100e874]
call esi
lea eax, [ebp - 0x204]
push eax
push 2
call fcn.01004bfe
pop ecx
pop ecx
push dword [ebp - 0x820]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x820], 0
inc dword [ebp - 0x844]
jmp 0x1007461
push dword [ebp - 0x828]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x828], 0
inc dword [ebp - 0x83c]
jmp 0x10073fd
push dword [ebp - 0x824]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x824], 0
inc dword [ebp - 0x838]
jmp 0x1007399
push dword [ebp - 0x82c]
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x830]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x204]
push eax
push 0x56b8
push dword [0x100e874]
call esi
push dword [ebp - 0x84c]
lea eax, [ebp - 0x204]
push dword [ebp - 0x840]
push eax
push 2
call fcn.01004bfe
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01008d3f
leave
ret
push edi
lea eax, [ebp - 0x204]
push eax
push 0x52d0
jmp 0x10075ad
push edi
lea eax, [ebp - 0x204]
push eax
push 0x5334
push dword [0x100e874]
call esi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 4
call fcn.01004ca7
add esp, 0x10
jmp 0x10075c7
push edi
lea eax, [ebp - 0x204]
push eax
push 0x5398
jmp 0x10075ad
push edi
lea eax, [ebp - 0x204]
push eax
push 0x53fc
push dword [0x100e874]
call esi
lea eax, [ebp - 0x40c]
jmp 0x1007741
push edi
lea eax, [ebp - 0x204]
push eax
push 0x5460
jmp 0x10075ad
push edi
lea eax, [ebp - 0x204]
push eax
push 0x54c4
push dword [0x100e874]
call esi
lea eax, [ebp - 0x614]
jmp 0x1007741