Function at 0x1000875c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1000a138
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xd28
push edi
lea eax, [ebp - 0x3b8]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100087a0
jmp 0x10008b06
lea eax, [ebp - 0x3ac]
push eax
call fcn.100086d2
add esp, 4
mov dword [ebp - 0x3b0], 1
push 0x100fd70c
lea ecx, [ebp - 0x3bc]
call fcn.10008f9c
mov dword [ebp - 4], 0
mov dword [ebp - 0x3b4], 0
jmp 0x100087eb
mov ecx, dword [ebp - 0x3b4]
add ecx, 1
mov dword [ebp - 0x3b4], ecx
mov byte [ebp - 0xbe0], 0
mov ecx, 0x207
xor eax, eax
lea edi, [ebp - 0xbdf]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0xcec], 0x105
mov dword [ebp - 0xcf4], 0x820
lea edx, [ebp - 0xcf4]
push edx
lea eax, [ebp - 0xbe0]
push eax
lea ecx, [ebp - 0xcf0]
push ecx
push 0
lea edx, [ebp - 0xcec]
push edx
lea eax, [ebp - 0xce8]
push eax
mov ecx, dword [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x3b8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x3c0], eax
cmp dword [ebp - 0x3c0], 0
je 0x1000887b
cmp dword [ebp - 0x3c0], 0x103
je 0x10008876
mov dword [ebp - 0x3b0], 0
jmp 0x10008ae7
push 0x80
lea eax, [ebp - 0xce8]
push eax
lea ecx, [ebp - 0x3ac]
push ecx
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
push 0x208
lea edx, [ebp - 0xbe0]
push edx
lea eax, [ebp - 0x32c]
push eax
call dword [sym.imp.MSVCRT.dll_strncpy]
add esp, 0xc
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3bc]
call sub.MFC42.DLL_CString::operator_2
mov edx, dword [ebp + 8]
mov dword [ebp - 0xd0c], edx
mov eax, dword [ebp - 0xd0c]
sub eax, 0x80000000
mov dword [ebp - 0xd0c], eax
cmp dword [ebp - 0xd0c], 5
ja case.0x100088ef.4
mov ecx, dword [ebp - 0xd0c]
jmp dword [ecx*4 + 0x10008b15]
lea edx, [ebp - 0x3bc]
push edx
push str.HKEY_CLASSES_ROOT_
lea eax, [ebp - 0xcf8]
push eax
call sub.MFC42.DLL_operator
mov dword [ebp - 0xd10], eax
mov ecx, dword [ebp - 0xd10]
mov dword [ebp - 0xd14], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0xd14]
push edx
lea ecx, [ebp - 0x3bc]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcf8]
call sub.MFC42.DLL_CString::CString
jmp case.0x100088ef.4
lea eax, [ebp - 0x3bc]
push eax
push str.HKEY_CURRENT_USER_
lea ecx, [ebp - 0xcfc]
push ecx
call sub.MFC42.DLL_operator
mov dword [ebp - 0xd18], eax
mov edx, dword [ebp - 0xd18]
mov dword [ebp - 0xd1c], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0xd1c]
push eax
lea ecx, [ebp - 0x3bc]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xcfc]
call sub.MFC42.DLL_CString::CString
jmp case.0x100088ef.4
lea ecx, [ebp - 0x3bc]
push ecx
push str.HKEY_LOCAL_MACHINE_
lea edx, [ebp - 0xd00]
push edx
call sub.MFC42.DLL_operator
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0xd20]
mov dword [ebp - 0xd24], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0xd24]
push ecx
lea ecx, [ebp - 0x3bc]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd00]
call sub.MFC42.DLL_CString::CString
jmp case.0x100088ef.4
lea edx, [ebp - 0x3bc]
push edx
push str.HKEY_USERS_
lea eax, [ebp - 0xd04]
push eax
call sub.MFC42.DLL_operator
mov dword [ebp - 0xd28], eax
mov ecx, dword [ebp - 0xd28]
mov dword [ebp - 0xd2c], ecx
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0xd2c]
push edx
lea ecx, [ebp - 0x3bc]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd04]
call sub.MFC42.DLL_CString::CString
jmp case.0x100088ef.4
lea eax, [ebp - 0x3bc]
push eax
push str.HKEY_CURRENT_CONFIG_
lea ecx, [ebp - 0xd08]
push ecx
call sub.MFC42.DLL_operator
mov dword [ebp - 0xd30], eax
mov edx, dword [ebp - 0xd30]
mov dword [ebp - 0xd34], edx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xd34]
push eax
lea ecx, [ebp - 0x3bc]
call sub.MFC42.DLL_CString::operator_1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xd08]
call sub.MFC42.DLL_CString::CString
lea ecx, [ebp - 0x3bc]
call fcn.10007960
push eax
lea ecx, [ebp - 0x124]
push ecx
call sub.MSVCRT.dll_strcpy
add esp, 8
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0
push 0
lea ecx, [ebp - 0x3ac]
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp + 0x14]
call dword [ecx + 0x4c4]
jmp 0x100087dc
mov edx, dword [ebp - 0x3b8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3bc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret