Function at 0x1001cfa
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x648
mov eax, dword [0x1007024]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp + 0x14]
push 0x7e
xor esi, esi
pop ecx
mov dword [ebp - 0x63c], eax
xor eax, eax
mov dword [ebp - 0x204], esi
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push 0x7f
stosw word es:[edi], ax
pop ecx
xor eax, eax
push 0x7f
mov dword [ebp - 0x404], esi
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 0x604], esi
lea edi, [ebp - 0x600]
rep stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x614], esi
mov dword [ebp - 0x61c], esi
mov dword [ebp - 0x610], esi
mov dword [ebp - 0x60c], esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
call edi
test eax, eax
je 0x1001dbc
push ebx
call fcn.0100542d
test eax, eax
jne 0x1001dbc
push ebx
lea eax, [ebp - 0x204]
push 0x1001378
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x61c]
push eax
push 0x80000002
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, esi
je 0x1001dea
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01003127
jmp 0x100235e
lea eax, [ebp - 0x610]
push eax
push 0x20019
push esi
push 0x1001320
push dword [ebp - 0x61c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1001e30
mov ecx, eax
dec ecx
dec ecx
je 0x1001e15
push eax
jmp 0x1001e1a
push 0x3f7
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01003127
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10023ac
cmp dword [ebp - 0x618], esi
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x628], esi
mov dword [ebp - 0x608], esi
mov dword [ebp - 0x614], 0x100
mov dword [ebp - 0x634], esi
mov dword [ebp - 0x620], esi
mov dword [ebp - 0x624], esi
je 0x1001e7c
push dword [ebp - 0x618]
call edi
test eax, eax
mov dword [ebp - 0x62c], 1
jne 0x1001e82
mov dword [ebp - 0x62c], esi
cmp dword [ebp - 0x638], esi
je 0x1001ea0
push dword [ebp - 0x638]
call edi
test eax, eax
mov dword [ebp - 0x630], 1
jne 0x1001ea6
mov dword [ebp - 0x630], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x404]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x648]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x404]
push eax
push esi
push dword [ebp - 0x610]
call ebx
cmp eax, esi
jne 0x1002181
xor edi, edi
inc edi
cmp dword [ebp - 0x62c], edi
jne 0x1001f0d
push esi
push edi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x618]
call fcn.01003955
test eax, eax
jne 0x1001f0d
mov dword [ebp - 0x634], edi
cmp dword [ebp - 0x630], edi
jne 0x100209e
cmp dword [ebp - 0x620], esi
jne 0x100209e
lea eax, [ebp - 0x60c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x610]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100219c
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x604]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x648]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x604]
push eax
push esi
push dword [ebp - 0x60c]
mov dword [ebp - 0x608], esi
mov dword [ebp - 0x614], 0x100
call ebx
cmp eax, esi
jne 0x1001ffa
push esi
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0x604]
push eax
push dword [ebp - 0x638]
call fcn.01003955
test eax, eax
je 0x1002008
inc dword [ebp - 0x608]
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x604]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x648]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x604]
push eax
push dword [ebp - 0x608]
mov dword [ebp - 0x614], 0x100
push dword [ebp - 0x60c]
call ebx
cmp eax, 0x103
jne 0x1001f8d
jmp 0x100200e
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01003127
jmp 0x100200e
mov dword [ebp - 0x620], edi
push dword [ebp - 0x60c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
cmp dword [ebp - 0x620], 1
mov dword [ebp - 0x60c], esi
mov dword [ebp - 0x608], esi
jne 0x10020be
cmp dword [ebp - 0x62c], esi
je 0x10021b3
cmp dword [ebp - 0x634], esi
je 0x1002064
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x618]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10021b3
lea eax, [ebp - 0x404]
push eax
push 0xa1
call fcn.01003d7f
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
call fcn.01002f34
mov dword [ebp - 0x624], 1
jmp 0x10020be
cmp dword [ebp - 0x634], edi
jne 0x10020be
cmp dword [ebp - 0x630], esi
je 0x1002288
cmp dword [ebp - 0x624], edi
je 0x100229f
inc dword [ebp - 0x640]
xor eax, eax
mov ecx, 0x80
lea edi, [ebp - 0x404]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x648]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x640]
mov dword [ebp - 0x614], 0x100
push dword [ebp - 0x610]
call ebx
cmp eax, 0x103
jne 0x1001edc
xor edi, edi
inc edi
push dword [ebp - 0x610]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
cmp dword [ebp - 0x608], esi
mov dword [ebp - 0x610], esi
jne 0x10023ac
cmp dword [ebp - 0x628], esi
jne 0x10023a6
cmp dword [ebp - 0x62c], edi
jne 0x10022aa
cmp dword [ebp - 0x634], esi
jne 0x10022b6
push dword [ebp - 0x618]
push 0x99
call fcn.01003d7f
push eax
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x204]
jmp 0x10023a0
push eax
mov dword [ebp - 0x608], 1
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01003127
jmp 0x100210e
push eax
mov dword [ebp - 0x608], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01003127
jmp 0x1002111
mov eax, dword [ebp - 0x63c]
xor ebx, ebx
inc ebx
cmp eax, esi
mov dword [ebp - 0x628], ebx
je 0x10021c8
mov dword [eax], esi
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x404]
push eax
push 0x1001320
lea eax, [ebp - 0x204]
push 0x100130c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
lea eax, [ebp - 0x60c]
push eax
push ebx
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x61c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1002213
push eax
jmp 0x1002245
push esi
push esi
push esi
push esi
push 0x10011dc
push dword [ebp - 0x60c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
mov dword [ebp - 0x624], eax
je 0x100225b
cmp eax, 2
je 0x100225b
push dword [ebp - 0x60c]
call edi
push dword [ebp - 0x624]
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01003127
mov dword [ebp - 0x608], ebx
jmp 0x100210e
push dword [ebp - 0x60c]
call edi
mov eax, dword [ebp - 0x63c]
cmp eax, esi
je 0x100210e
cmp dword [ebp - 0x624], esi
jne 0x100210e
mov dword [eax], 1
jmp 0x100210e
mov eax, dword [ebp - 0x63c]
cmp eax, esi
je 0x1002294
mov dword [eax], edi
mov dword [ebp - 0x628], edi
jmp 0x1002111
mov dword [ebp - 0x608], edi
jmp 0x1002111
cmp dword [ebp - 0x62c], esi
je 0x1002386
cmp dword [ebp - 0x630], esi
je 0x10023a6
cmp dword [ebp - 0x634], esi
je 0x10023a6
cmp dword [ebp - 0x620], esi
jne 0x10023a6
push dword [ebp - 0x618]
lea eax, [ebp - 0x204]
push 0x1001320
push 0x1001300
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x610]
push eax
push 0x20006
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x61c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x1002339
mov ecx, eax
dec ecx
dec ecx
je 0x1002327
push eax
jmp 0x100232c
push 0x3f7
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.01003127
jmp 0x10023ac
push dword [ebp - 0x638]
push dword [ebp - 0x610]
call fcn.010015c5
test eax, eax
jne 0x1002362
push dword [ebp - 0x61c]
call ebx
push dword [ebp - 0x610]
call ebx
xor eax, eax
jmp 0x10023b6
push dword [ebp - 0x60c]
mov dword [ebp - 0x628], edi
call ebx
push dword [ebp - 0x610]
call ebx
mov eax, dword [ebp - 0x63c]
cmp eax, esi
je 0x10023a6
mov dword [eax], edi
jmp 0x10023a6
cmp dword [ebp - 0x630], edi
jne 0x10023a6
cmp dword [ebp - 0x620], esi
jne 0x10023a6
push 0xa0
call fcn.01003d7f
push eax
call fcn.01002f34
mov esi, dword [ebp - 0x628]
push dword [ebp - 0x61c]
call ebx
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01002b06
leave
ret 0x10