Function at 0x10057fc5
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x100a2bb4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, ecx
cmp dword [edi], 0
jne 0x10057fee
xor eax, eax
inc eax
jmp 0x100583ae
push esi
lea esi, [edi + 0x20]
cmp dword [edi + 0x14], 0
jne 0x1005820a
push 0
push 0
push 0
push 0
lea eax, [edi + 0x18]
push eax
push esi
push dword [edi + 0x1c]
mov dword [eax], 0x40
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [edi + 0x1c]
cmp eax, 0xea
je 0x10057ff2
test eax, eax
jne 0x1005824c
mov esi, dword [edi]
lea ecx, [edi + 4]
call fcn.10056a22
push eax
push 0x20019
push 0
lea eax, [edi + 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea esi, [edi + 0x20]
test eax, eax
jne 0x10057ff2
xor ecx, ecx
lea eax, [ebp - 0x410]
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [ebp - 0x404]
mov dword [ebp - 0x418], ecx
mov esi, ecx
push eax
mov dword [ebp - 0x408], esi
push ecx
jmp 0x100581ea
cmp esi, 3
lea esi, [edi + 0x20]
jge 0x10057ff2
mov ecx, 0x100092f0
lea eax, [ebp - 0x404]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100580b5
test dx, dx
je 0x100580b1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100580b5
add eax, 4
add ecx, 4
test dx, dx
jne 0x1005808f
xor eax, eax
jmp 0x100580ba
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100580eb
mov esi, dword [edi + 4]
lea ecx, [edi + 8]
call fcn.10056a22
push eax
push 0x20019
push 0
push 0x100092f0
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100580eb
or dword [edi + 0x14], 1
inc dword [ebp - 0x408]
mov ecx, 0x10009310
lea eax, [ebp - 0x404]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1005811c
test dx, dx
je 0x10058118
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1005811c
add eax, 4
add ecx, 4
test dx, dx
jne 0x100580f6
xor eax, eax
jmp 0x10058121
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10058152
mov esi, dword [edi + 4]
lea ecx, [edi + 0xc]
call fcn.10056a22
push eax
push 0x20019
push 0
push 0x10009310
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10058152
or dword [edi + 0x14], 2
inc dword [ebp - 0x408]
mov ecx, 0x10009334
lea eax, [ebp - 0x404]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10058183
test dx, dx
je 0x1005817f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10058183
add eax, 4
add ecx, 4
test dx, dx
jne 0x1005815d
xor eax, eax
jmp 0x10058188
sbb eax, eax
or eax, 1
test eax, eax
jne 0x100581c2
mov esi, dword [edi + 4]
lea ecx, [edi + 0x10]
call fcn.10056a22
push eax
push 0x20019
push 0
push 0x10009334
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [ebp - 0x408]
test eax, eax
jne 0x100581c8
or dword [edi + 0x14], 4
inc esi
mov dword [ebp - 0x408], esi
jmp 0x100581c8
mov esi, dword [ebp - 0x408]
mov eax, dword [ebp - 0x418]
inc eax
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x418], eax
push ecx
lea ecx, [ebp - 0x404]
push ecx
push eax
push dword [edi + 4]
mov dword [ebp - 0x410], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10058078
jmp 0x10057fef
xor eax, eax
mov dword [ebp - 0x40c], 0x200
mov word [ebp - 0x204], ax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push dword [edi + 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10058254
and dword [edi + 0x14], 0
jmp 0x10057ff2
xor eax, eax
inc eax
jmp 0x100583ad
lea eax, [ebp - 0x204]
mov ecx, ebx
push eax
call fcn.10058ae1
add eax, eax
lea ecx, [ebx + 0x204]
push esi
mov dword [ebx + 0x200], eax
call fcn.10058ae1
add eax, eax
lea ecx, [ebx + 0x610]
mov dword [ebx + 0x404], eax
xor eax, eax
push esi
mov word [ebx + 0x60e], ax
call fcn.10058ae1
add eax, eax
mov dword [ebp - 0x40c], 0x200
mov dword [ebx + 0x810], eax
add esp, 0xc
xor eax, eax
test byte [edi + 0x14], 1
mov word [ebp - 0x204], ax
je 0x10058307
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push dword [edi + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebx + 0x408]
call fcn.10058ae1
add eax, eax
mov dword [ebx + 0x608], eax
xor eax, eax
inc eax
mov word [ebx + 0x60c], ax
and dword [edi + 0x14], 0xfffffffe
pop ecx
jmp 0x100583ab
test byte [edi + 0x14], 2
je 0x1005835a
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push dword [edi + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebx + 0x408]
call fcn.10058ae1
pop ecx
add eax, eax
mov dword [ebx + 0x608], eax
push 2
pop eax
mov word [ebx + 0x60c], ax
and dword [edi + 0x14], 0xfffffffd
jmp 0x100583ab
test byte [edi + 0x14], 4
je 0x100583ab
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x414]
push eax
push 0
push 0
push dword [edi + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebx + 0x408]
call fcn.10058ae1
pop ecx
add eax, eax
mov dword [ebx + 0x608], eax
push 3
pop eax
mov word [ebx + 0x60c], ax
and dword [edi + 0x14], 0xfffffffb
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.10037870
mov esp, ebp
pop ebp
ret 4