Function at 0x10486b2
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x10619c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push edi
xor edi, edi
xor ecx, ecx
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
mov word [ebp - 0x20c], cx
cmp eax, edi
jne 0x104871a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1048710
test byte [eax + 0x1c], 4
je 0x1048710
push 0x100c014
push 0x100c038
push 0x5f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010170e7
mov ebx, 0x80070057
jmp 0x10489e6
push esi
push 0x858
mov dword [eax], edi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, edi
je 0x1048737
mov ecx, eax
call fcn.010475a6
mov esi, eax
jmp 0x1048739
xor esi, esi
cmp esi, edi
jne 0x1048770
mov eax, dword [section..data]
cmp eax, section..data
je 0x1048766
test byte [eax + 0x1c], 4
je 0x1048766
push 0x100c4c8
push 0x100c038
push 0x60
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010170e7
mov ebx, 0x8007000e
jmp 0x10489e5
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push 0x20019
push edi
push 0x100c398
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1048799
xor ebx, ebx
inc ebx
jmp 0x10489d4
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push dword [ebp - 0x210]
call fcn.010469cf
push dword [ebp - 0x21c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x2c]
mov ebx, eax
cmp ebx, edi
jge 0x10487f8
mov eax, dword [section..data]
cmp eax, section..data
je 0x10489ce
test byte [eax + 0x1c], 4
je 0x10489ce
push ebx
push 0x100c6fc
push 0x100c038
push 0x61
jmp 0x1048993
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
je 0x1048816
or dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 1
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
je 0x1048816
and dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 0xfffffffe
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
mov edi, 0x208
push edi
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push dword [ebp - 0x210]
call fcn.01046b1a
mov eax, dword [esi]
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
mov ecx, esi
call dword [eax + 0x14]
mov ebx, eax
test ebx, ebx
jge 0x104887c
mov eax, dword [section..data]
cmp eax, section..data
je 0x10489ce
test byte [eax + 0x1c], 4
je 0x10489ce
push ebx
push 0x100c488
push 0x100c038
push 0x62
jmp 0x1048993
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 0
je 0x104889c
or dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 2
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 0
je 0x104889c
and dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 0xfffffffd
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
lea eax, reloc.Secur32.dll_LsaDeregisterLogonProcess
push eax
push dword [ebp - 0x210]
call fcn.01046c95
push dword [ebp - 0x21c]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x8c]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jge 0x1048900
mov eax, dword [section..data]
cmp eax, section..data
je 0x10489ce
test byte [eax + 0x1c], 4
je 0x10489ce
push ebx
push 0x100c6d0
push 0x100c038
push 0x63
jmp 0x1048993
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
je 0x104891e
or dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 4
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
je 0x104891e
and dword [esi + reloc.Secur32.dll_LsaDeregisterLogonProcess], 0xfffffffb
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
push eax
push 0x100c6b4
push dword [ebp - 0x210]
mov dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10489a0
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], 1
jne 0x10489a0
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], eax
jbe 0x10489a0
mov eax, dword [esi]
lea ecx, reloc.Secur32.dll_LsaDeregisterLogonProcess
push ecx
mov ecx, esi
call dword [eax + 0x58]
mov ebx, eax
test ebx, ebx
jge 0x10489c7
mov eax, dword [section..data]
cmp eax, section..data
je 0x10489ce
test byte [eax + 0x1c], 4
je 0x10489ce
push ebx
push 0x100c448
push 0x100c038
push 0x64
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0104e22f
jmp 0x10489ce
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x10489c7
test byte [ecx + 0x1c], 1
je 0x10489c7
push eax
push 0x100c038
push 0x65
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.0101b900
mov dword [esi + 8], 1
xor edi, edi
cmp ebx, edi
je 0x10489dd
mov eax, dword [esi]
mov ecx, esi
call dword [eax + reloc.Secur32.dll_QuerySecurityPackageInfoW]
jmp 0x10489e5
mov eax, dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess]
mov dword [eax], esi
pop esi
cmp dword [ebp - reloc.Secur32.dll_LsaDeregisterLogonProcess], edi
je 0x10489fa
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01041ea8
leave
ret 4