Function at 0x1012274
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x1018144]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
cmp eax, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x20c], ebx
mov dword [ebp - 0x21c], ebx
je 0x10122de
cmp dword [ebp + 8], ebx
mov dword [eax], ebx
je 0x10122cb
push 7
jmp 0x10122e0
cmp ecx, ebx
je 0x10122de
cmp edx, ebx
je 0x10122de
cmp esi, ebx
jne 0x10122f0
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1012301
push 6
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100abd2
leave
ret 0x18
push dword [ebp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_IsBadWritePtr]
test eax, eax
jne 0x10122de
mov edi, dword [ebp + 0x10]
push 1
call fcn.01011074
test eax, eax
jne 0x101230f
inc eax
jmp 0x10122e1
push 0xf003f
call fcn.0100daeb
cmp eax, ebx
mov dword [ebp - 0x220], eax
je 0x10124c5
cmp edi, 1
mov dword [ebp - 0x214], edi
jbe 0x101233b
add edi, 0xfffffffe
mov dword [ebp - 0x214], edi
lea ecx, [ebp - 0x23c]
push ecx
lea ecx, [ebp - 0x228]
push ecx
push ebx
push 8
push ebx
push 0x1001f40
push ebx
push 0x1019588
push eax
mov dword [ebp - 0x210], 2
mov dword [ebp - 0x218], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10124b9
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x224], 0x101
push dword [ebp - 0x228]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x21c]
cmp eax, ebx
jne 0x101240a
mov edi, dword [ebp - 0x224]
lea edi, [edi + edi + 2]
add dword [ebp - 0x210], edi
cmp dword [ebp - 0x20c], ebx
jne 0x1012377
cmp edi, dword [ebp - 0x214]
jbe 0x10123db
mov dword [ebp - 0x20c], 2
jmp 0x1012377
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.ntdll.dll_wcscpy]
mov eax, dword [ebp - 0x224]
sub dword [ebp - 0x214], edi
lea esi, [esi + eax*2]
mov word [esi], bx
inc esi
pop ecx
inc esi
inc dword [ebp - 0x218]
pop ecx
jmp 0x1012377
cmp eax, 0x103
push dword [ebp - 0x228]
je 0x101242c
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x220]
call esi
jmp 0x10124c5
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x220]
call edi
push 1
call fcn.010110d1
push 2
pop ecx
cmp dword [ebp - 0x210], ecx
jne 0x101246d
push 4
pop eax
cmp dword [ebp + 0x10], eax
mov dword [ebp - 0x210], eax
jae 0x1012464
mov dword [ebp - 0x20c], ecx
jmp 0x101246d
cmp esi, ebx
je 0x101246d
mov word [esi], bx
add esi, ecx
cmp dword [ebp - 0x20c], ebx
mov eax, dword [ebp - 0x218]
mov edx, dword [ebp - 0x234]
mov dword [edx], eax
mov edx, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x210]
mov dword [edx], eax
jne 0x10124a0
cmp esi, ebx
je 0x1012498
mov word [esi], bx
mov edx, dword [ebp - 0x238]
mov dword [edx], eax
cmp dword [ebp - 0x230], ebx
mov eax, ecx
je 0x10122e1
mov eax, dword [ebp - 0x20c]
jmp 0x10122e1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
call fcn.010110d1
push 0x1b
jmp 0x10122e0