Function at 0x1008fcd
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x600
mov eax, dword [0x1017048]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x5f0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x5f4], edi
mov dword [ebp - 0x600], esi
mov dword [ebp - 0x5f0], ebx
call fcn.01008658
push eax
push 0x20019
push ebx
push esi
push edi
call fcn.01008692
add esp, 0x14
cmp eax, ebx
je 0x100903e
cmp eax, 2
je 0x1009036
push esi
push eax
push 0x10018f0
call fcn.0100f591
add esp, 0xc
jmp 0x100925d
xor ebx, ebx
inc ebx
jmp 0x100925d
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x3ec]
push eax
mov dword [ebp - 0x5f8], ebx
push ebx
jmp 0x10090a2
push dword [ebp + 0x10]
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x5f0]
call fcn.01008fcd
add esp, 0xc
test eax, eax
je 0x100925d
cmp byte [ebp + 0x10], bl
je 0x100908a
inc dword [ebp - 0x5f8]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5fc]
push eax
lea eax, [ebp - 0x3ec]
push eax
push dword [ebp - 0x5f8]
push dword [ebp - 0x5f0]
mov dword [ebp - 0x5fc], 0x1f4
call edi
mov esi, eax
cmp esi, ebx
je 0x100905f
cmp esi, 0x103
je 0x10090d4
push esi
push 0x1001890
call fcn.0100f591
pop ecx
pop ecx
jmp 0x100925d
push ebx
lea ecx, [ebp - 0x5f0]
call fcn.01008634
cmp byte [ebp + 0x10], bl
mov edi, dword [ebp - 0x600]
jne 0x100910c
push edi
push dword [ebp - 0x5f4]
call fcn.010086c9
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x1009240
cmp esi, 5
jne 0x10091ee
push 0x100185c
call fcn.01008bd6
test al, al
pop ecx
je 0x10091ee
push edi
push dword [ebp - 0x5f4]
call fcn.01008e1b
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x1009150
push edi
push esi
push 0x10017d8
call fcn.0100f591
add esp, 0xc
cmp byte [ebp + 0x10], bl
je 0x10091ee
jmp 0x100925d
lea ecx, [ebp - 0x5f0]
call fcn.01008658
push eax
push 0x60000
push ebx
push edi
push dword [ebp - 0x5f4]
call fcn.01008692
mov esi, eax
add esp, 0x14
cmp esi, ebx
jne 0x10091d3
push dword [ebp - 0x5f0]
call fcn.01008fb5
mov esi, eax
cmp esi, ebx
pop ecx
jne 0x1009198
push edi
push 0x1001750
call fcn.0100f591
pop ecx
pop ecx
jmp 0x10091b0
push esi
push edi
push 0x10016d0
call fcn.0100f591
add esp, 0xc
cmp byte [ebp + 0x10], bl
jne 0x100925d
push ebx
lea ecx, [ebp - 0x5f0]
call fcn.01008634
cmp byte [ebp + 0x10], bl
jne 0x10091ee
push edi
push dword [ebp - 0x5f4]
call fcn.010086c9
pop ecx
pop ecx
mov esi, eax
jmp 0x10091ee
push edi
push esi
push 0x1001510
call fcn.0100f591
add esp, 0xc
push ebx
lea ecx, [ebp - 0x5f0]
call fcn.01008634
cmp esi, ebx
je 0x1009234
cmp byte [ebp + 0x10], bl
jne 0x1009239
push ebx
push 0x100
lea eax, [ebp - 0x5ec]
push eax
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
test eax, eax
jne 0x1009222
push edi
push esi
push 0x1001670
jmp 0x1009029
lea eax, [ebp - 0x5ec]
push eax
push edi
push 0x1001620
jmp 0x1009029
cmp byte [ebp + 0x10], bl
je 0x1009240
mov eax, 0x10015f8
jmp 0x1009245
mov eax, 0x10015e4
push edi
push eax
push 0x10015cc
call fcn.0100f591
xor ebx, ebx
add esp, 0xc
inc ebx
mov byte [0x101881c], bl
lea ecx, [ebp - 0x5f0]
call fcn.01008676
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0100f0dc
leave
ret