Function at 0x1004bb5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x1010060]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0xa0]
mov dword [ebp - 0x108], eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0xf8], eax
lea eax, [ebp - 0x90]
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0xa4]
mov dword [ebp - 0xe8], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0xe0], eax
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xd8], eax
push ebx
lea eax, [ebp - 0x94]
mov dword [ebp - 0xd0], eax
push esi
xor esi, esi
lea eax, [ebp - 0xb0]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc8], eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x70], esi
mov dword [ebp - 0xb8], esi
mov dword [ebp - 0x88], esi
mov dword [ebp - 0x84], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x54], 0x80000002
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x50], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x78], esi
mov dword [ebp - 0xac], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0x7c], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0xb4], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0xb0], esi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x10c], 0x1f43
mov dword [ebp - 0x104], 0x1f44
mov dword [ebp - 0xfc], 0x1f45
mov dword [ebp - 0xf4], 0x1f55
mov dword [ebp - 0xec], 0x1f46
mov dword [ebp - 0xe4], 0x1f47
mov dword [ebp - 0xdc], 0x1f48
mov dword [ebp - 0xd4], 0x1f49
mov dword [ebp - 0xcc], 0x1f4a
mov dword [ebp - 0xc4], 0x1f4b
mov dword [ebp - 0xc0], eax
xor ebx, ebx
push dword [ebp + ebx*8 - 0x108]
push dword [ebp + ebx*8 - 0x10c]
push 0x800
call fcn.0100c9f1
add esp, 0xc
test eax, eax
je 0x1004d96
inc ebx
cmp ebx, 0xa
jb 0x1004d2c
push 0x2a
pop ebx
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x100173c
push edi
call fcn.01003218
cmp al, 1
jne 0x1004dc7
push dword [ebp - 0x74]
push edi
call fcn.01003267
mov eax, dword [ebp - 0x78]
cmp eax, esi
jne 0x1004db3
push 0x641
call fcn.0100c967
mov dword [ebp - 0x6c], 1
mov edi, 0x80070057
jmp 0x1005273
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jg 0x1004da7
mov edi, eax
jmp 0x1005273
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004da0
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1004db6
sub eax, edx
sar eax, 1
lea ebx, [eax + 0x2b]
lea eax, [ebx + ebx]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x5c], eax
cmp eax, esi
je 0x1005332
push 0x10016e8
push ebx
push eax
call fcn.01003fae
mov edi, eax
cmp edi, esi
jl 0x1005265
cmp dword [ebp - 0x78], esi
je 0x1004e27
push 0x10016e4
push ebx
push dword [ebp - 0x5c]
call fcn.01004023
mov edi, eax
cmp edi, esi
jl 0x1005265
push dword [ebp - 0x78]
push ebx
push dword [ebp - 0x5c]
call fcn.01004023
mov edi, eax
cmp edi, esi
jl 0x1005265
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0xac]
push eax
push 0x10013fc
push dword [ebp - 0x40]
call fcn.01003218
cmp al, 1
jne 0x1004e78
push dword [ebp - 0x74]
push dword [ebp - 0x40]
call fcn.01003267
lea eax, [ebp - 0x80]
push eax
push 0x80000002
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, esi
je 0x1004e72
jg 0x1005317
jmp 0x1005321
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x54], eax
push dword [ebp - 0x40]
call fcn.010032aa
mov edi, eax
cmp edi, esi
jl 0x1005265
lea eax, [ebp - 0x64]
push eax
push 1
push esi
push dword [ebp - 0x5c]
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1004e67
push esi
push esi
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x1004e67
cmp dword [ebp - 0x70], esi
jne 0x1004ed1
mov edi, 0x80070103
jmp 0x1005265
add dword [ebp - 0x48], 2
mov eax, dword [ebp - 0x48]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push 0x40
call edi
mov dword [ebp - 0x50], eax
cmp eax, esi
je 0x1005332
push dword [ebp - 0x60]
push 0x40
call edi
mov dword [ebp - 0x44], eax
cmp eax, esi
je 0x1005332
mov edi, dword [ebp - 0x48]
add edi, 3
push 0xfffffffffffffff5
mov dword [ebp - 0xbc], edi
lea ebx, [edi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x4c], eax
cmp eax, 0xffffffff
jne 0x1004f2e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jmp 0x1004e67
push 0x10012ac
push dword [ebp - 0x4c]
call fcn.01003553
push dword [ebp - 0x7c]
push ebx
push dword [ebp - 0xa8]
push edi
push dword [ebp - 0xa0]
push esi
push dword [ebp - 0x4c]
call fcn.01004a0c
mov eax, dword [ebp - 0x7c]
xor ebx, ebx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x1004f5d
sub eax, ecx
sar eax, 1
lea eax, [eax + edi + 0x17]
test eax, eax
jbe 0x1004f9d
push 0x10016e0
push dword [ebp - 0x4c]
call fcn.01003553
mov eax, dword [ebp - 0x7c]
inc ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1004f87
sub eax, edx
sar eax, 1
lea eax, [edi + eax + 0x17]
cmp ebx, eax
jb 0x1004f73
push 0x10016d8
push dword [ebp - 0x4c]
call fcn.01003553
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x70], esi
jbe 0x1005256
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x60]
mov edi, dword [ebp - 0x44]
mov dword [ebp - 0x88], eax
add eax, eax
push eax
push esi
push dword [ebp - 0x50]
mov dword [ebp - 0x84], ecx
call sub.msvcrt.dll_memset
push dword [ebp - 0x60]
push esi
push edi
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x84]
push eax
push edi
lea eax, [ebp - 0xb8]
push eax
push esi
lea eax, [ebp - 0x88]
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x40]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1005315
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x48]
ja 0x1005328
mov eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x60]
ja 0x1005328
mov ecx, dword [ebp - 0xb8]
dec ecx
je 0x100520a
dec ecx
je 0x1005202
dec ecx
je 0x1005178
dec ecx
je 0x100514a
sub ecx, 3
je 0x100506b
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x9c]
jmp 0x1005170
xor eax, eax
mov dword [ebp - 0x3c], esi
mov word [ebp - 0xc], ax
mov word [ebp - 0xa], ax
mov word [ebp - 8], ax
mov ecx, edi
cmp ax, word [edi]
je 0x10050be
mov eax, ecx
lea edi, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, si
jne 0x1005088
mov edx, dword [ebp - 0x3c]
sub eax, edi
sar eax, 1
lea eax, [edx + eax*2 + 6]
mov dword [ebp - 0x3c], eax
mov eax, ecx
lea edx, [eax + 2]
mov di, word [eax]
inc eax
inc eax
cmp di, si
jne 0x10050a5
sub eax, edx
sar eax, 1
lea ecx, [ecx + eax*2 + 2]
xor eax, eax
cmp ax, word [ecx]
jne 0x1005083
add dword [ebp - 0x3c], 2
push dword [ebp - 0x3c]
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x38], eax
cmp eax, esi
je 0x1005332
mov ebx, dword [ebp - 0x44]
mov dword [ebp - 0x58], 1
jmp 0x1005138
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
call fcn.01004064
mov edi, eax
cmp edi, esi
jl 0x1005265
push ebx
push dword [ebp - 0x3c]
push dword [ebp - 0x38]
call fcn.01004064
mov edi, eax
cmp edi, esi
jl 0x1005265
push 0x2c
pop eax
mov word [ebp - 0xc], ax
push 0x20
pop eax
mov word [ebp - 0xa], ax
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1005126
sub eax, edx
sar eax, 1
lea ebx, [ebx + eax*2 + 2]
xor eax, eax
cmp ax, word [ebx]
jne 0x10050e4
mov eax, dword [ebp - 0xb4]
jmp 0x1005213
cmp eax, 4
jb 0x1005328
push 0xa
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.msvcrt.dll__ltow]
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0x3c], eax
add esp, 0xc
lea eax, [ebp - 0x34]
mov dword [ebp - 0x38], eax
jmp 0x1005216
lea ebx, [eax + eax]
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x3c], eax
lea edi, [ebx + ebx]
lea eax, [edi + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x38], eax
cmp eax, esi
je 0x1005332
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x38]
lea ecx, [edi + eax]
mov dword [ebp - 0x58], 1
mov dword [ebp - 0x68], eax
cmp eax, ecx
jae 0x1005216
mov dword [ebp - 0x54], edi
inc ebx
mov eax, dword [ebp - 0x8c]
movzx eax, byte [eax]
push eax
push 0x10016cc
push ebx
push dword [ebp - 0x68]
call fcn.010049d1
mov edi, eax
add esp, 0x10
cmp edi, esi
jl 0x1005265
add dword [ebp - 0x68], 4
sub dword [ebp - 0x54], 4
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x54]
dec ebx
dec ebx
inc dword [ebp - 0x8c]
add eax, ecx
cmp ecx, eax
jb 0x10051bf
jmp 0x1005216
mov eax, dword [ebp - 0x94]
jmp 0x1005210
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
mov eax, dword [ebp - 0xbc]
lea ecx, [eax + 0x14]
push ecx
push dword [ebp - 0x3c]
push eax
push dword [ebp - 0x50]
push esi
push dword [ebp - 0x4c]
call fcn.01004a0c
cmp dword [ebp - 0x58], esi
je 0x1005244
push dword [ebp - 0x38]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x58], esi
inc dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], esi
cmp eax, dword [ebp - 0x70]
jb 0x1004fb6
push 0x10012ac
push dword [ebp - 0x4c]
call fcn.01003553
xor edi, edi
cmp dword [ebp - 0x5c], esi
je 0x1005273
push dword [ebp - 0x5c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor ebx, ebx
mov eax, dword [ebp + ebx*8 - 0x108]
cmp dword [eax], esi
je 0x1005288
push dword [eax]
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc ebx
cmp ebx, 0xa
jb 0x1005275
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x64], esi
je 0x100529e
push dword [ebp - 0x64]
call ebx
cmp dword [ebp - 0x80], esi
je 0x10052a8
push dword [ebp - 0x80]
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x50], esi
je 0x10052b8
push dword [ebp - 0x50]
call ebx
cmp dword [ebp - 0x44], esi
je 0x10052c2
push dword [ebp - 0x44]
call ebx
cmp dword [ebp - 0x58], esi
je 0x10052d1
cmp dword [ebp - 0x38], esi
je 0x10052d1
push dword [ebp - 0x38]
call ebx
cmp edi, esi
jge 0x1005302
cmp dword [ebp - 0x6c], esi
jne 0x1005302
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.0100d212
test eax, eax
jl 0x1005302
push dword [ebp - 0x6c]
push 0x1001330
push 0x579
call fcn.0100ca2c
add esp, 0xc
push dword [ebp - 0x6c]
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100bee5
leave
ret 4
jle 0x1005321
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1005265
mov edi, 0x8000ffff
jmp 0x1005265
mov edi, 0x8007000e
jmp 0x1005265