Function at 0x1000ea40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x74
push 0xffffffffffffffff
push 0x10021ac6
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1002b024]
xor eax, ebp
mov dword [ebp + 0x70], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
test byte [0x1002d238], 1
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x1c], eax
mov dword [ebp + 0x20], ecx
jne 0x1000eba7
or dword [0x1002d238], 1
xor edi, edi
mov dword [ebp - 4], edi
xor edx, edx
mov ebx, 7
push 4
mov eax, str.HKCU
mov esi, 0x1002d19c
mov dword [0x1002d198], 0x80000001
mov dword [0x1002d1b4], ebx
mov dword [0x1002d1b0], edi
mov word [0x1002d1a0], dx
call fcn.100020c0
mov byte [ebp - 4], 1
xor eax, eax
mov word [0x1002d1c0], ax
push 4
mov eax, str.HKLM
mov esi, 0x1002d1bc
mov dword [0x1002d1b8], 0x80000002
mov dword [0x1002d1d4], ebx
mov dword [0x1002d1d0], edi
call fcn.100020c0
mov byte [ebp - 4], 2
xor ecx, ecx
push 4
mov eax, str.HKCR
mov esi, 0x1002d1dc
mov dword [0x1002d1d8], 0x80000000
mov dword [0x1002d1f4], ebx
mov dword [0x1002d1f0], edi
mov word [0x1002d1e0], cx
call fcn.100020c0
mov byte [ebp - 4], 3
xor edx, edx
push 0xa
mov eax, str.HKEY_USERS
mov esi, 0x1002d1fc
mov dword [0x1002d1f8], 0x80000003
mov dword [0x1002d214], ebx
mov dword [0x1002d210], edi
mov word [0x1002d200], dx
call fcn.100020c0
mov byte [ebp - 4], 4
xor eax, eax
mov word [0x1002d220], ax
push 0x13
mov eax, str.HKEY_CURRENT_CONFIG
mov esi, 0x1002d21c
mov dword [0x1002d218], 0x80000005
mov dword [0x1002d234], ebx
mov dword [0x1002d230], edi
call fcn.100020c0
push 0x10022b10
call fcn.100131c4
add esp, 4
jmp 0x1000ebae
mov ebx, 7
xor edi, edi
xor ecx, ecx
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x30], edi
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x6c], ebx
mov dword [ebp + 0x68], edi
mov word [ebp + 0x58], cx
mov dword [ebp - 4], 5
xor edx, edx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x4c], edi
mov word [ebp + 0x3c], dx
mov eax, dword [ebp + 0x20]
or ebx, 0xffffffff
mov dword [ebp + 0x28], ebx
mov byte [ebp - 4], 7
call fcn.1000f2b0
mov eax, dword [ebp + 0x1c]
push ebx
push edi
lea ecx, [ebp + 0x54]
call fcn.10002250
cmp dword [ebp + 0x68], edi
jne 0x1000ec0b
push 0x10026b2c
lea eax, [ebp]
push eax
mov dword [ebp], ebx
call fcn.10014cdc
lea ecx, [ebp + 0x54]
push ecx
lea esi, [ebp - 0x30]
call fcn.1000e680
add esp, 4
push ebx
push edi
lea ecx, [ebp + 0x54]
mov byte [ebp - 4], 8
call fcn.10002250
mov byte [ebp - 4], 7
cmp dword [ebp - 0x18], 8
jb 0x1000ec3e
mov edx, dword [ebp - 0x2c]
push edx
call fcn.10012c74
add esp, 4
lea edi, [ebp + 0x54]
call fcn.1000e370
xor ebx, ebx
jmp 0x1000ec50
cmp ebx, 5
jae 0x1000ecfe
mov esi, ebx
shl esi, 5
add esi, 0x1002d198
mov eax, dword [esi + 0x18]
mov ecx, eax
or edi, 0xffffffff
mov dword [ebp + 0x1c], esi
cmp ecx, 0xffffffff
jae 0x1000ec76
mov edi, ecx
cmp dword [esi + 0x1c], 8
jb 0x1000ec81
mov ecx, dword [esi + 8]
jmp 0x1000ec84
lea ecx, [esi + 8]
push ecx
lea ecx, [ebp + 0x54]
call fcn.1000c320
test eax, eax
jne 0x1000ed18
mov edi, dword [esi + 0x18]
mov eax, dword [ebp + 0x68]
lea ecx, [edi + 1]
cmp eax, ecx
ja 0x1000ecb6
mov edx, dword [ebp + 0x28]
push 0x10026b2c
lea eax, [ebp + 0x14]
push eax
mov dword [ebp + 0x14], edx
call fcn.10014cdc
cmp eax, edi
ja 0x1000ecbf
call fcn.1001cb56
cmp dword [ebp + 0x6c], 8
mov eax, dword [ebp + 0x58]
jae 0x1000eccb
lea eax, [ebp + 0x58]
cmp word [eax + edi*2], 0x5c
je 0x1000ece6
mov ecx, dword [ebp + 0x28]
push 0x10026b2c
lea edx, [ebp - 0x14]
push edx
mov dword [ebp - 0x14], ecx
call fcn.10014cdc
mov esi, dword [esi + 0x18]
lea eax, [esi + 1]
xor ebx, ebx
lea esi, [ebp + 0x54]
call fcn.100021b0
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov dword [ebp + 0x30], ecx
cmp dword [ebp + 0x30], 0
jne 0x1000ed1e
mov edx, dword [ebp + 0x28]
push 0x10026b2c
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], edx
call fcn.10014cdc
inc ebx
jmp 0x1000ec50
lea ecx, [ebp + 0x18]
push ecx
lea edi, [ebp + 0x54]
call fcn.1000f1f0
mov esi, dword [eax]
mov edi, dword [eax + 4]
cmp esi, 0xfffffffc
je 0x1000ed54
test esi, esi
jne 0x1000ed3d
call fcn.1001346d
cmp dword [esi + 0x18], 8
jb 0x1000ed48
mov eax, dword [esi + 4]
jmp 0x1000ed4b
lea eax, [esi + 4]
cmp edi, eax
ja 0x1000ed54
call fcn.1001346d
sub edi, 2
cmp esi, 0xfffffffc
je 0x1000ed82
test esi, esi
jne 0x1000ed65
call fcn.1001346d
cmp dword [esi + 0x18], 8
jb 0x1000ed70
mov eax, dword [esi + 4]
jmp 0x1000ed73
lea eax, [esi + 4]
mov edx, dword [esi + 0x14]
lea eax, [eax + edx*2]
cmp edi, eax
jb 0x1000ed82
call fcn.1001346d
cmp word [edi], 0x5c
jne 0x1000edf1
mov edi, dword [ebp + 0x6c]
mov edx, dword [ebp + 0x58]
mov eax, edx
cmp edi, 8
jae 0x1000ed98
lea eax, [ebp + 0x58]
mov ecx, dword [ebp + 0x68]
lea esi, [eax + ecx*2]
test esi, esi
je 0x1000edc1
mov eax, edx
cmp edi, 8
jae 0x1000edac
lea eax, [ebp + 0x58]
cmp eax, esi
ja 0x1000edc1
mov eax, edx
cmp edi, 8
jae 0x1000edba
lea eax, [ebp + 0x58]
lea ecx, [eax + ecx*2]
cmp esi, ecx
jbe 0x1000edc6
call fcn.1001346d
lea eax, [ebp - 0x38]
lea edx, [ebp + 0x54]
push eax
lea eax, [ebp + 0x18]
mov dword [ebp + 0x18], edx
mov dword [ebp + 0x1c], esi
call fcn.1000f250
mov ecx, dword [eax + 4]
mov edx, dword [eax]
push ecx
push edx
lea eax, [ebp + 0x18]
push eax
lea ecx, [ebp + 0x54]
push ecx
call fcn.1000f110
jmp 0x1000ee62
lea edi, [ebp + 0x1c]
lea ebx, [ebp + 0x54]
mov dword [ebp + 0x1c], 0x5c
call fcn.1000f300
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1000ee22
push eax
push 0
lea eax, [ebp + 0x54]
lea ecx, [ebp + 0x38]
call fcn.10002250
lea edi, [ebp + 0x54]
call fcn.100040e0
jmp 0x1000ee62
lea edx, [ebp + 0x54]
lea ecx, [ebx + 1]
push edx
lea esi, [ebp - 0x30]
call fcn.1000b2e0
push 0xffffffffffffffff
push 0
lea ecx, [ebp + 0x38]
mov byte [ebp - 4], 9
call fcn.10002250
mov byte [ebp - 4], 7
cmp dword [ebp - 0x18], 8
jb 0x1000ee57
mov eax, dword [ebp - 0x2c]
push eax
call fcn.10012c74
add esp, 4
or eax, 0xffffffff
lea esi, [ebp + 0x54]
call fcn.100021b0
mov edi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x58]
mov esi, 8
cmp dword [ebp + 0x6c], esi
jae 0x1000ee75
lea eax, [ebp + 0x58]
mov edx, dword [ebp + 0x30]
lea ecx, [ebp + 0x24]
push ecx
push 0x20019
xor ebx, ebx
push ebx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000eeef
mov ecx, dword [ebp + 0x24]
cmp ecx, ebx
je 0x1000eeef
mov eax, dword [ebp + 0x3c]
mov dword [ebp + 0x30], ebx
cmp dword [ebp + 0x50], esi
jae 0x1000eea5
lea eax, [ebp + 0x3c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp + 0x30]
push edx
push ebx
push ebx
push ebx
push eax
push ecx
call esi
cmp eax, ebx
je 0x1000ef6f
cmp eax, 2
jne 0x1000ef5b
cmp dword [ebp + 0x30], ebx
jne 0x1000ef5b
cmp dword [ebp + 0x4c], ebx
jne 0x1000ef5b
push eax
lea eax, [ebp + 0x37]
mov ecx, edi
mov byte [ebp + 0x37], 0
call fcn.1000f430
mov dword [ebp + 0x2c], 1
mov eax, dword [ebp + 0x24]
xor edi, edi
cmp eax, edi
je 0x1000ef02
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x24], edi
mov esi, 8
cmp dword [ebp + 0x50], esi
jb 0x1000ef18
mov edx, dword [ebp + 0x3c]
push edx
call fcn.10012c74
add esp, 4
xor eax, eax
mov dword [ebp + 0x50], 7
mov dword [ebp + 0x4c], edi
mov word [ebp + 0x3c], ax
cmp dword [ebp + 0x6c], esi
jb 0x1000ef39
mov ecx, dword [ebp + 0x58]
push ecx
call fcn.10012c74
add esp, 4
mov eax, dword [ebp + 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x70]
xor ecx, ebp
call fcn.10012c7f
add ebp, 0x74
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x28]
push 0x10026b2c
lea ecx, [ebp + 8]
push ecx
mov dword [ebp + 8], eax
call fcn.10014cdc
mov eax, dword [ebp + 0x30]
cmp eax, ebx
jbe 0x1000eeef
push eax
lea eax, [ebp + 0x37]
mov ecx, edi
mov dword [ebp + 0x2c], ebx
mov byte [ebp + 0x37], 0
call fcn.1000f430
mov edx, dword [edi + 0x10]
sub edx, dword [edi + 0xc]
jne 0x1000ef99
call fcn.1001346d
cmp dword [ebp + 0x50], 8
mov ecx, dword [edi + 0xc]
mov eax, dword [ebp + 0x3c]
jae 0x1000efa8
lea eax, [ebp + 0x3c]
lea edx, [ebp + 0x30]
push edx
mov edx, dword [ebp + 0x24]
push ecx
lea ecx, [ebp + 0x2c]
push ecx
push ebx
push eax
push edx
call esi
cmp eax, ebx
je 0x1000efd1
mov eax, dword [ebp + 0x28]
push 0x10026b2c
lea ecx, [ebp + 4]
push ecx
mov dword [ebp + 4], eax
call fcn.10014cdc
mov ecx, dword [ebp + 0x2c]
lea eax, [ecx - 1]
cmp eax, 0xa
ja case.0x1000efe3.6
movzx edx, byte [eax + 0x1000f024]
jmp dword [edx*4 + 0x1000f01c]
mov dword [ebp + 0x2c], ecx
jmp 0x1000eeef
mov eax, dword [ebp + 0x28]
push 0x10026b2c
lea ecx, [ebp + 0x10]
push ecx
mov dword [ebp + 0x10], eax
call fcn.10014cdc
mov eax, dword [ebp + 0x20]
mov dword [ebp + 0x2c], 0
call fcn.1000f2b0
mov eax, 0x1000eeef
ret