Function at 0x1042037
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
lea ecx, [ebp - 0x938]
mov dword [ebp - 0x908], esi
call fcn.01039115
mov eax, dword [ebp + 0xc]
mov dword [0x1049414], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1049410], eax
call fcn.0103f44a
lea eax, [ebp - 0x938]
push eax
call fcn.01040cfa
test eax, eax
je 0x10424b0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x910]
push eax
push 0x20019
push esi
push dword [0x10472a0]
mov dword [ebp - 0x904], esi
push 0x80000002
mov dword [ebp - 0x90c], esi
mov dword [ebp - 0x910], esi
call ebx
test eax, eax
jne 0x10424b0
cmp dword [ebp + 8], esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jne 0x10421a8
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x10077d4
push dword [ebp - 0x910]
call ebx
test eax, eax
jne 0x10421a8
lea ecx, [ebp - 0x974]
call fcn.010391cc
lea ecx, [ebp - 0x974]
call fcn.01039202
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
jmp 0x104217b
inc dword [ebp - 0x90c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x974]
push eax
call fcn.01033d95
test eax, eax
jne 0x1042191
lea eax, [ebp - 0x974]
push eax
call fcn.01041134
test eax, eax
je 0x104215b
lea eax, [ebp - 0x974]
push eax
lea eax, [ebp - 0x938]
push eax
call fcn.0103cac3
lea ecx, [ebp - 0x974]
call fcn.01039202
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], 0x10
call edi
test eax, eax
je 0x104211e
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x974]
call fcn.01039202
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x1007868
push dword [ebp - 0x910]
call ebx
test eax, eax
push 0x64
pop ebx
jne 0x104223c
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x900]
push eax
mov dword [ebp - 0x90c], esi
push esi
jmp 0x104221e
inc dword [ebp - 0x90c]
lea eax, [ebp - 0x900]
push eax
call fcn.010417f3
test eax, eax
je 0x1042206
lea eax, [ebp - 0x900]
push eax
call fcn.010433f1
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x900]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], ebx
call edi
test eax, eax
je 0x10421e4
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], esi
jne 0x10424a3
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x10077b0
push dword [ebp - 0x910]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104231e
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x90c], esi
push esi
jmp 0x10422fc
inc dword [ebp - 0x90c]
push 0x208
lea eax, [ebp - 0x708]
push eax
mov eax, 0x12c
push eax
lea ecx, [ebp - 0x424]
push ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.01041ae9
test eax, eax
je 0x10422e4
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x91c]
lea eax, [ebp - 0xec]
push eax
call fcn.0103a124
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], ebx
call edi
test eax, eax
je 0x1042286
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x10077c4
push dword [ebp - 0x910]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10424a3
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x90c], esi
push esi
jmp 0x1042481
inc dword [ebp - 0x90c]
mov eax, 0x208
push eax
lea ecx, [ebp - 0x708]
push ecx
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.01041d9b
test eax, eax
je 0x1042469
lea eax, [ebp - 0x914]
push eax
push 1
push esi
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x908]
mov dword [ebp - 0x914], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x104243d
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x918]
push eax
push esi
push 0x100a3ac
push dword [ebp - 0x914]
mov dword [ebp - 0x904], 0x20a
mov dword [ebp - 0x918], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1042431
cmp dword [ebp - 0x918], 1
jne 0x1042431
lea eax, [ebp - 0x2f8]
push 0x10024b0
push eax
mov word [ebp - 0xf0], si
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1042431
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1042469
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x934]
lea eax, [ebp - 0x708]
push dword [ebp - 0x938]
push eax
lea eax, [ebp - 0x500]
push eax
push dword [ebp - 0x91c]
lea eax, [ebp - 0xec]
push eax
call fcn.0103a6a6
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], ebx
call edi
test eax, eax
je 0x1042362
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x910]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
lea ecx, [ebp - 0x938]
call fcn.01039136
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 0xc