Function at 0x100d35f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x1035030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
xor eax, eax
push 0x3e
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push edi
push eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x68], edi
mov dword [ebp - 0x48], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
push 0xf003f
push edi
push 0x1002cd8
push 0x80000002
mov dword [ebp - 0x58], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x64], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
je 0x100d431
cmp eax, 2
jne 0x100d3f9
xor esi, esi
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100d61f
test byte [eax + 0x1c], 4
je 0x100d61f
push 0x1002b5c
push 0x66
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004e8e
jmp 0x100d61f
cmp eax, edi
mov esi, eax
jle 0x100d40b
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x100d677
test byte [ecx + 0x1c], 1
je 0x100d677
push eax
push 0x1002b5c
push 0x67
jmp 0x100d480
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x60]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, edi
je 0x100d490
mov esi, eax
jle 0x100d45c
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x100d677
test byte [ecx + 0x1c], 1
je 0x100d677
push eax
push 0x1002b5c
push 0x68
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
jmp 0x100d677
cmp dword [ebp - 0x60], edi
jne 0x100d4bd
xor esi, esi
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100d61f
test byte [eax + 0x1c], 4
je 0x100d61f
push 0x1002b5c
push 0x69
jmp 0x100d3e9
mov dword [ebp - 0x54], edi
cmp dword [ebp - 0x60], edi
jbe 0x100d5d8
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push 0x20
pop ebx
lea eax, [ebp - 0x48]
push eax
xor esi, esi
push esi
lea eax, [ebp - 0x64]
push eax
push esi
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x54]
mov dword [ebp - 0x58], ebx
push dword [ebp - 0x50]
mov dword [ebp - 0x48], esi
call edi
cmp eax, esi
jne 0x100d745
cmp dword [ebp - 0x48], esi
je 0x100d747
push dword [ebp - 0x48]
call fcn.01011bcc
mov esi, eax
pop ecx
mov dword [ebp - 0x68], esi
test esi, esi
je 0x100d5df
lea eax, [ebp - 0x48]
push eax
push esi
lea eax, [ebp - 0x64]
push eax
push 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x54]
mov dword [ebp - 0x58], ebx
push dword [ebp - 0x50]
call edi
test eax, eax
jne 0x100d63e
lea eax, [ebp - 0x4c]
push eax
push 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntExW]
test eax, eax
je 0x100d67d
mov eax, dword [ebp - 0x64]
dec eax
je 0x100d5b1
dec eax
dec eax
je 0x100d5a0
dec eax
je 0x100d587
sub eax, 7
jne 0x100d5c7
cmp dword [ebp - 0x48], 8
jne 0x100d6ba
push dword [esi + 4]
mov ecx, dword [ebp - 0x5c]
push dword [esi]
push dword [ebp - 0x4c]
call fcn.0100c0e1
jmp 0x100d5bd
cmp dword [ebp - 0x48], 4
jne 0x100d6f3
push dword [esi]
mov ecx, dword [ebp - 0x5c]
push dword [ebp - 0x4c]
call fcn.0100c067
jmp 0x100d5bd
mov ecx, dword [ebp - 0x5c]
push esi
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
call fcn.0100c163
jmp 0x100d5bd
mov ecx, dword [ebp - 0x5c]
push esi
push dword [ebp - 0x4c]
call fcn.0100d249
mov esi, eax
test esi, esi
jl 0x100d71e
inc dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x60]
jb 0x100d4d2
xor edi, edi
xor esi, esi
jmp 0x100d677
mov esi, 0x8007000e
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100d60f
test byte [eax + 0x1c], 1
je 0x100d60f
lea ecx, [ebp - 0x44]
push ecx
push dword [ebp - 0x48]
push 0x1002b5c
push 0x6b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100503a
xor edi, edi
cmp dword [ebp - 0x68], edi
je 0x100d61f
push dword [ebp - 0x68]
call fcn.01011bdc
pop ecx
cmp dword [ebp - 0x50], edi
je 0x100d62d
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01011f27
leave
ret
mov esi, eax
jle 0x100d64e
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x100d675
test byte [ecx + 0x1c], 1
je 0x100d675
push eax
push 0x1002b5c
push 0x6c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01004eb4
xor edi, edi
cmp esi, edi
jge 0x100d61f
jmp 0x100d611
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100d691
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100d675
test byte [eax + 0x1c], 1
je 0x100d675
push esi
push 0x1002b5c
push 0x6d
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x100d675
mov esi, 0x80004005
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100d60f
test byte [eax + 0x1c], 1
je 0x100d60f
push dword [ebp - 0x4c]
push 0x1002b5c
push 0x6f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01004eb4
jmp 0x100d60f
mov esi, 0x80004005
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100d60f
test byte [eax + 0x1c], 1
je 0x100d60f
push dword [ebp - 0x4c]
push 0x1002b5c
push 0x6e
jmp 0x100d6e3
mov eax, dword [0x1035014]
cmp eax, 0x1035014
je 0x100d675
test byte [eax + 0x1c], 1
je 0x100d675
push esi
push 0x1002b5c
push 0x70
jmp 0x100d6ad
jg 0x100d74b
mov esi, eax
jmp 0x100d759
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
mov ecx, dword [0x1035014]
cmp ecx, 0x1035014
je 0x100d675
test byte [ecx + 0x1c], 1
je 0x100d675
push eax
push 0x1002b5c
push 0x6a
jmp 0x100d66a