Function at 0x100a704
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x578
mov eax, 0x104459c
call fcn.0100798e
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x530], eax
mov dword [eax], esi
lea eax, [ebp - 0x518]
push eax
push 0x20019
push esi
push 0x100a650
push 0x80000001
mov dword [ebp - 0x518], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100a960
cmp dword [ebp - 0x518], esi
je 0x100a960
lea eax, [ebp - 0x584]
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x514], esi
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x540], 0x10
mov dword [ebp - 0x544], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], esi
mov dword [ebp - 0x528], esi
push 0x80
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x528]
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
jne 0x100a91e
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x110]
push 0x100af28
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
cmp eax, 1
jne 0x100a90c
mov eax, dword [ebp - 0x52c]
cmp eax, dword [ebp - 0x514]
jne 0x1012c6c
inc dword [ebp - 0x514]
lea eax, [ebp - 0x51c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x518]
mov dword [ebp - 0x51c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100a90c
cmp dword [ebp - 0x51c], esi
je 0x100a90c
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x534]
push eax
push esi
push 0x1009e88
push dword [ebp - 0x51c]
mov dword [ebp - 0x524], 4
call edi
cmp eax, esi
jne 0x100a900
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x538]
jne 0x100a900
cmp dword [ebp + 8], esi
je 0x100a968
xor eax, eax
push 0x3fe
mov word [ebp - 0x510], ax
lea eax, [ebp - 0x50e]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x534]
push eax
push esi
push 0x100cd1c
push dword [ebp - 0x51c]
mov dword [ebp - 0x524], 0x400
call edi
cmp eax, esi
jne 0x100a900
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x510]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10127d2
cmp dx, si
je 0x100a8fa
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10127d2
add ecx, 4
add eax, 4
cmp dx, si
jne 0x100a8d0
xor eax, eax
cmp eax, esi
je 0x100a968
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x528]
cmp dword [ebp - 0x520], esi
je 0x100a78e
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x544]
cmp dword [ebp - 0x520], esi
je 0x101b7ba
mov eax, dword [ebp - 0x52c]
mov edx, dword [ebp - 0x530]
mov dword [edx], eax
or dword [ebp - 4], 0xffffffff
cmp ecx, esi
je 0x100a960
lea eax, [ebp - 0x584]
cmp ecx, eax
jne 0x101b7eb
call fcn.010079cb
ret 0xc
mov dword [ebp - 0x520], 1
jmp 0x100a900
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x100a8fc
push 1
push eax
lea ecx, [ebp - 0x584]
call fcn.01012c84
jmp 0x100a7f1
xor eax, eax
cmp dword [ebp - 0x53c], esi
jbe 0x101b7d8
mov edx, dword [ecx + eax*4]
cmp edx, dword [ebp - 0x514]
je 0x101b7f7
inc eax
cmp eax, dword [ebp - 0x53c]
jb 0x101b7c4
mov eax, dword [ebp - 0x530]
mov edx, dword [ebp - 0x514]
mov dword [eax], edx
jmp 0x100a94a
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x100a960
inc dword [ebp - 0x514]
jmp 0x101b7ba