Function at 0x1001b058
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2f9c]
mov eax, 0x301c
call fcn.1003c230
mov eax, dword [0x10095dec]
xor eax, ebp
mov dword [ebp + 0x2f98], eax
mov eax, dword [ebp + 0x2fa4]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
xor eax, eax
mov edi, 0xffe
xor esi, esi
push edi
mov word [ebp + 0x1f98], ax
lea eax, [ebp + 0x1f9a]
push esi
push eax
mov dword [ebp - 0x70], esi
call fcn.1003c260
xor eax, eax
push edi
mov word [ebp + 0xf98], ax
lea eax, [ebp + 0xf9a]
push esi
push eax
call fcn.1003c260
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
mov edi, 0x800
push 0x20019
mov dword [ebp - 0x6c], edi
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push esi
cmp dword [ebp + 0x2fac], esi
je 0x1001b1ac
push 0x10076914
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b2af
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push esi
jmp 0x1001b196
lea eax, [ebp + 0x1f98]
push eax
push 0x10076954
push 0x10076994
lea eax, [ebp + 0xf98]
push edi
push eax
call fcn.1005e425
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
lea eax, [ebp + 0xf98]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b17e
mov eax, dword [ebp + 0x2fa8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x80]
push eax
push esi
push 0x100769a0
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001b17e
push dword [ebp + 0x2fa8]
push dword [ebp - 0x74]
call fcn.1001b018
pop ecx
pop ecx
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1001b10a
jmp 0x1001b2af
push 0x100769c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b2af
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push esi
jmp 0x1001b29e
lea eax, [ebp + 0x1f98]
push eax
push 0x10076a18
push 0x100769b4
lea eax, [ebp + 0xf98]
push edi
push eax
call fcn.1005e425
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
lea eax, [ebp + 0xf98]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b286
push 0xffe
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.1003c260
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push 0x10076a70
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001b286
cmp dword [ebp - 0x6c], esi
jbe 0x1001b286
mov eax, dword [ebp + 0x2fa8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x80]
push eax
push esi
push 0x10076a88
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001b286
push dword [ebp + 0x2fa8]
push dword [ebp - 0x74]
call fcn.1001b018
pop ecx
pop ecx
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1001b1d5
mov eax, dword [ebp - 0x74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x1001b2b5
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp + 0x2f98]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.1003c09c
add ebp, 0x2f9c
leave
ret