Function at 0x10990c8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x605c
call fcn.01077950
mov eax, dword [0x10de03c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x6020], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
push eax
mov dword [ebp - 0x6028], edi
mov dword [ebp - 0x6038], eax
mov dword [ebp - 0x6040], esi
mov dword [ebp - 0x602c], esi
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6034], esi
mov dword [ebp - 0x6024], esi
mov dword [ebp - 0x6010], esi
mov dword [ebp - 0x6014], esi
call fcn.010a721f
test byte [edi + 0x60], 0x80
mov ebx, eax
mov dword [ebp - 0x6048], ebx
je 0x1099158
push ebx
call fcn.010a72a9
push eax
push esi
push edi
call fcn.010a753c
push eax
mov dword [ebp - 0x6040], eax
call fcn.010a72a9
jmp 0x109915a
mov eax, ebx
cmp ebx, esi
je 0x1099986
cmp eax, esi
je 0x1099986
push eax
push 0x10113c0
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x2000000
jne 0x1099805
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011518
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x1099805
lea eax, [ebp - 0x6030]
push eax
lea eax, [ebp - 0x6034]
push eax
push esi
push esi
push 0x1011508
push dword [ebp - 0x600c]
mov dword [ebp - 0x6030], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x600c]
mov dword [ebp - 0x6018], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6018], esi
jne 0x1099805
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
je 0x1099285
push 0x1011730
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x10116f0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099285
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114b8
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x10116f0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x1099303
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
pop ecx
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6010], esi
je 0x10993a2
push 0x1011730
lea eax, [ebp - 0x2004]
push 0x10116b8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x10993a2
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x10993a2
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114b8
lea eax, [ebp - 0x2004]
push 0x10116b8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x1099422
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x1099422
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp - 0x6018], esi
pop ecx
jne 0x1099805
mov eax, dword [ebp - 0x602c]
jmp 0x10997f7
mov eax, dword [ebp - 0x6010]
cmp word [eax], si
je 0x1099805
push 0x1011690
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x1011690
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x10994ab
push 0x1011690
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2]
push eax
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x10116f0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
jmp 0x10994c6
push dword [ebp - 0x6010]
lea eax, [ebp - 0x2004]
push 0x101166c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push dword [ebp - 0x6010]
lea eax, [ebp - 0x6004]
push 0x1011658
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x1011648
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x10997e0
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
cmp word [ecx + eax*2 - 2], 0x2a
lea eax, [ebp - 0x2004]
jne 0x10997c7
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov word [ebp + eax*2 - 0x2008], si
lea eax, [ebp - 0x6004]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
mov word [ebp + eax*2 - 0x6008], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6030]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x10997e0
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6044]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x6004]
push eax
push 0x80000002
call edi
cmp eax, esi
jne 0x109978a
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6014], esi
mov dword [ebp - 0x6024], esi
cmp dword [ebp - 0x6014], esi
je 0x10995c5
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
lea eax, [ebp - 0x605c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x6054]
push eax
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6024]
mov dword [ebp - 0x6054], 0x1000
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1099764
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6044]
call edi
cmp eax, esi
je 0x109962e
mov dword [ebp - 0x6014], esi
cmp eax, esi
mov dword [ebp - 0x6008], esi
jne 0x10996a7
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push 4
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099798
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push esi
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099798
mov dword [ebp - 0x6008], esi
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x604c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x101163c
push dword [ebp - 0x6014]
mov dword [ebp - 0x6018], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1099732
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x603c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x101163c
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1099732
mov eax, dword [ebp - 0x604c]
cmp eax, dword [ebp - 0x603c]
jae 0x1099732
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.010987e3
mov dword [ebp - 0x6018], esi
cmp dword [ebp - 0x6008], esi
je 0x1099752
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6008], esi
inc dword [ebp - 0x6024]
cmp dword [ebp - 0x6018], esi
je 0x10995ab
cmp dword [ebp - 0x6014], esi
je 0x109977e
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6030]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10997e0
cmp dword [ebp - 0x601c], 1
jne 0x10996a7
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.010987e3
jmp 0x1099738
push dword [ebp - 0x6038]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.01098f4a
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2 + 2]
cmp eax, esi
mov dword [ebp - 0x6010], eax
jne 0x1099446
cmp word [0x10ecaf0], si
je 0x10998a4
push 0x5c
push 0x10ecaf0
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x109982a
mov eax, 0x10ecaf0
add eax, 2
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x1099841
mov eax, 0x10ecaf0
add eax, 2
push eax
push dword [ebp - 0x6034]
mov dword [ebp - 0x603c], eax
lea eax, [ebp - 0x2004]
push 0x10115f8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push dword [ebp - 0x603c]
lea eax, [ebp - 0x6004]
push 0x10115b8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
push dword [ebp - 0x6038]
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.01098f4a
mov word [0x10ecaf0], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10115a8
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099952
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10113c0
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099946
cmp dword [0x10e2588], esi
je 0x109993a
push esi
push esi
push dword [ebp - 0x600c]
push dword [ebp - 0x6014]
call sub.SYSSETUP.dll_AsrRestorePlugPlayRegistryData
test eax, eax
jne 0x109993a
push esi
push esi
push esi
call fcn.01050ebf
push 0xe27
xor edi, edi
inc edi
push edi
push edi
push esi
call fcn.01050ebf
push 8
push esi
call fcn.01050ebf
add esp, 0x24
mov dword [0x10e0f40], edi
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x602c]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
pop ecx
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x10113c0
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x6048]
jmp 0x109998d
mov esi, dword [sym.imp.msvcrt.dll_free]
push ebx
call esi
push dword [ebp - 0x6040]
call esi
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075aef
leave
ret 8