Function at 0x1099256
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x605c
call fcn.01077a20
mov eax, dword [0x10de03c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x6020], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
push eax
mov dword [ebp - 0x6028], edi
mov dword [ebp - 0x6038], eax
mov dword [ebp - 0x6040], esi
mov dword [ebp - 0x602c], esi
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6034], esi
mov dword [ebp - 0x6024], esi
mov dword [ebp - 0x6010], esi
mov dword [ebp - 0x6014], esi
call fcn.010a73da
test byte [edi + 0x60], 0x80
mov ebx, eax
mov dword [ebp - 0x6048], ebx
je 0x10992e6
push ebx
call fcn.010a7464
push eax
push esi
push edi
call fcn.010a76f7
push eax
mov dword [ebp - 0x6040], eax
call fcn.010a7464
jmp 0x10992e8
mov eax, ebx
cmp ebx, esi
je 0x1099b14
cmp eax, esi
je 0x1099b14
push eax
push 0x10113d8
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x2000000
jne 0x1099993
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011530
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x1099993
lea eax, [ebp - 0x6030]
push eax
lea eax, [ebp - 0x6034]
push eax
push esi
push esi
push 0x1011520
push dword [ebp - 0x600c]
mov dword [ebp - 0x6030], reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x600c]
mov dword [ebp - 0x6018], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6018], esi
jne 0x1099993
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
je 0x1099413
push 0x1011748
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1011708
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099413
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114d0
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1011708
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x1099491
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
pop ecx
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6010], esi
je 0x1099530
push 0x1011748
lea eax, [ebp - 0x2004]
push 0x10116d0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x1099530
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x1099530
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114d0
lea eax, [ebp - 0x2004]
push 0x10116d0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x10995b0
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x10995b0
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp - 0x6018], esi
pop ecx
jne 0x1099993
mov eax, dword [ebp - 0x602c]
jmp 0x1099985
mov eax, dword [ebp - 0x6010]
cmp word [eax], si
je 0x1099993
push 0x10116a8
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x10116a8
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x1099639
push 0x10116a8
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2]
push eax
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1011708
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
jmp 0x1099654
push dword [ebp - 0x6010]
lea eax, [ebp - 0x2004]
push 0x1011684
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push dword [ebp - 0x6010]
lea eax, [ebp - 0x6004]
push 0x1011670
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x1011660
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x109996e
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
cmp word [ecx + eax*2 - 2], 0x2a
lea eax, [ebp - 0x2004]
jne 0x1099955
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov word [ebp + eax*2 - reloc.ADVAPI32.dll_RegDeleteValueW], si
lea eax, [ebp - 0x6004]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
mov word [ebp + eax*2 - reloc.ADVAPI32.dll_RegDeleteValueW], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6030]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
call edi
test eax, eax
jne 0x109996e
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6044]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x6004]
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
call edi
cmp eax, esi
jne 0x1099918
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6014], esi
mov dword [ebp - 0x6024], esi
cmp dword [ebp - 0x6014], esi
je 0x1099753
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
lea eax, [ebp - 0x605c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x6054]
push eax
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6024]
mov dword [ebp - 0x6054], reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10998f2
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6044]
call edi
cmp eax, esi
je 0x10997bc
mov dword [ebp - 0x6014], esi
cmp eax, esi
mov dword [ebp - 0x6008], esi
jne 0x1099835
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push 4
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099926
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push esi
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099926
mov dword [ebp - 0x6008], esi
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x604c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x1011654
push dword [ebp - 0x6014]
mov dword [ebp - 0x6018], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10998c0
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x603c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x1011654
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10998c0
mov eax, dword [ebp - 0x604c]
cmp eax, dword [ebp - 0x603c]
jae 0x10998c0
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.01098971
mov dword [ebp - 0x6018], esi
cmp dword [ebp - 0x6008], esi
je 0x10998e0
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6008], esi
inc dword [ebp - 0x6024]
cmp dword [ebp - 0x6018], esi
je 0x1099739
cmp dword [ebp - 0x6014], esi
je 0x109990c
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6030]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x109996e
cmp dword [ebp - 0x601c], 1
jne 0x1099835
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.01098971
jmp 0x10998c6
push dword [ebp - 0x6038]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.010990d8
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2 + 2]
cmp eax, esi
mov dword [ebp - 0x6010], eax
jne 0x10995d4
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], si
je 0x1099a32
push 0x5c
push 0x10ecaf8
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x10999b8
mov eax, 0x10ecaf8
add eax, 2
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x10999cf
mov eax, 0x10ecaf8
add eax, 2
push eax
push dword [ebp - 0x6034]
mov dword [ebp - 0x603c], eax
lea eax, [ebp - 0x2004]
push 0x1011610
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push dword [ebp - 0x603c]
lea eax, [ebp - 0x6004]
push 0x10115d0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
push dword [ebp - 0x6038]
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.010990d8
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10115c0
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099ae0
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10113d8
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099ad4
cmp dword [0x10e2588], esi
je 0x1099ac8
push esi
push esi
push dword [ebp - 0x600c]
push dword [ebp - 0x6014]
call fcn.010cb5e2
test eax, eax
jne 0x1099ac8
push esi
push esi
push esi
call fcn.01050ed2
push 0xe27
xor edi, edi
inc edi
push edi
push edi
push esi
call fcn.01050ed2
push 8
push esi
call fcn.01050ed2
add esp, 0x24
mov dword [0x10e0f40], edi
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x602c]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
pop ecx
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x10113d8
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x6048]
jmp 0x1099b1b
mov esi, dword [sym.imp.msvcrt.dll_free]
push ebx
call esi
push dword [ebp - 0x6040]
call esi
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075bbb
leave
ret 8