Function at 0x100dc61
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x102e050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
push eax
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], esi
call fcn.0101d46b
xor edi, edi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
cmp ebx, edi
je 0x100dcb5
cmp esi, edi
je 0x100dcb5
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
mov dword [esi], edi
call fcn.0101cecf
mov esi, eax
jmp 0x100dcba
mov esi, 0x80070057
cmp esi, edi
jl 0x100dd09
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0101cebc
test eax, eax
je 0x100dcdc
push edi
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call fcn.0101d5db
mov esi, eax
cmp esi, edi
jl 0x100dd09
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push 0x20019
push edi
push 0x10023e8
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x100dd07
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
cmp esi, edi
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
jl 0x100dd40
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
push edi
push edi
push edi
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
jle 0x100dd3e
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x20c], ax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push edi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push ebx
mov word [ebp - 0x414], ax
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
jmp 0x100de71
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
cmp eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
jae 0x100de92
push edi
push edi
push edi
push edi
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push eax
push dword [ebp - 0x420]
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x104
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], 0x208
mov dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
mov ebx, 0x80070000
jle 0x100dddc
and eax, 0xffff
or eax, ebx
mov esi, eax
cmp esi, edi
jl 0x100de60
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push 0x20019
push edi
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jle 0x100de0e
and eax, 0xffff
or eax, ebx
mov esi, eax
cmp esi, edi
jl 0x100de60
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
push ecx
push edi
push edi
push 0x10023d4
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, edi
jle 0x100de41
and eax, 0xffff
or eax, ebx
mov esi, eax
cmp esi, edi
jl 0x100de60
push dword [ebp - 0x418]
lea eax, reloc.NETAPI32.dll_NetApiBufferFree
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x100de7b
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0100ae9c
inc dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
cmp esi, edi
jge 0x100dd81
jmp 0x100de92
mov eax, dword [ebp - reloc.NETAPI32.dll_NetApiBufferFree]
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
mov dword [eax], 1
call fcn.0100ae9c
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0100ae9c
lea ecx, reloc.NETAPI32.dll_NetApiBufferFree
call fcn.0101cff5
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01007c80
leave
ret 0xc