Function at 0x10043f6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
push 1
mov dword [ebp - 0xa70], edi
mov dword [ebp - 0xa80], edi
mov dword [ebp - 0xa7c], 0x104
mov dword [ebp - 0xa6c], edi
mov dword [ebp - 0xa78], edi
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 0xa70]
push eax
push 0x20019
push edi
lea eax, [esi + 0x618]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov dword [ebp - 0xa74], eax
jne 0x100464c
push ebx
lea eax, [ebp - 0xa8c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x414]
push eax
push edi
push dword [ebp - 0xa70]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1004645
mov ebx, dword [sym.imp.MSVCR80.dll_wcsncpy]
lea eax, [ebp - 0xa6c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa70]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov dword [ebp - 0xa74], eax
jne 0x100464b
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa84]
push eax
push edi
push 0x100190c
push dword [ebp - 0xa6c]
mov dword [ebp - 0xa78], 0x208
mov word [ebp - 0x20c], di
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10045e9
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1004516
sub eax, edx
sar eax, 1
je 0x10045e9
lea eax, [ebp - 0xa78]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xa84]
push eax
push edi
push 0x1001a64
push dword [ebp - 0xa6c]
mov dword [ebp - 0xa78], 0x654
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
push 0x103
jne 0x10045c2
lea eax, [ebp - 0xa64]
push eax
lea eax, [esi + 0xa28]
push eax
call ebx
push 0x103
lea eax, [ebp - 0x95c]
push eax
lea eax, [esi + 0xe9c]
push eax
mov word [esi + 0xc2e], di
call ebx
push 0x27
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 0x10a4]
push eax
mov word [esi + 0x10a2], di
call ebx
push esi
push 1
push SysStringLen
mov word [esi + 0x10f2], di
call fcn.01005fef
add esp, 0x30
jmp 0x10045e9
lea eax, [ebp - 0x414]
push eax
lea eax, [esi + 0xa28]
push eax
call ebx
push esi
push 1
push SysStringLen
mov word [esi + 0xc2e], di
call fcn.01005ea5
add esp, 0x18
cmp dword [ebp - 0xa6c], edi
je 0x1004603
push dword [ebp - 0xa6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0xa6c], edi
inc dword [ebp - 0xa80]
lea eax, [ebp - 0xa8c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0xa7c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa80]
mov dword [ebp - 0xa7c], 0x104
push dword [ebp - 0xa70]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x100449f
mov dword [ebp - 0xa74], edi
pop ebx
cmp dword [ebp - 0xa6c], edi
je 0x1004660
push dword [ebp - 0xa6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xa70], edi
pop edi
pop esi
je 0x1004676
push dword [ebp - 0xa70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa74]
xor ecx, ebp
call fcn.01006b3a
leave
ret