Function at 0xed01dd1
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0xed3e248]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x858], edi
mov word [ebp - 0x414], ax
cmp dword [edi], ebx
jne 0xed0263c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0ed01b36
leave
ret 8
push 0x104
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
jmp 0xed0268b
push esi
push 0x2c
xor esi, esi
push esi
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
add edi, 4
push 0xa
or eax, 0xffffffff
pop ecx
mov dword [ebp - 0x82c], edi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x858]
mov dword [eax], ebx
cmp word [0xed3efa0], si
je 0xed0c310
cmp word [0xed3f378], si
je 0xed0c310
cmp word [0xed3efa0], si
jne 0xed0c31b
cmp word [ebp - 0x414], si
je 0xed0284a
mov edi, 0x20019
push edi
push 0xed026d0
push 0x80000002
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x854], esi
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x84c], esi
call fcn.0ed02855
jmp 0xed0d53a
test eax, eax
je 0xed0d577
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x824]
push eax
push 0xed3efa0
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x828], ebx
call fcn.0ed025eb
test eax, eax
je 0xed0d577
lea ecx, [ebp - 0x854]
call fcn.0ed02891
mov ecx, 0xed02818
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
je 0xed0c2f8
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0xed0d8a8
mov ecx, 0xed027f8
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
je 0xed0d8ba
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0xed0d8e3
lea ecx, [ebp - 0x854]
call fcn.0ed02891
jmp 0xed0284a
pop esi
jmp 0xed01e05
cmp dx, si
je 0xed0c32d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xed027ba
jmp 0xed0d894
push esi
call fcn.0ed039e4
jmp 0xed0267e
cmp word [0xed3f378], si
jne 0xed02627
jmp 0xed0268b
xor eax, eax
jmp 0xed027bf
test eax, eax
jne 0xed02798
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x824]
push eax
mov ebx, 0x104
push 0xed3f378
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x828], ebx
call fcn.0ed025eb
jmp 0xed02764
xor eax, eax
mov word [ebp - 0x61e], ax
push edi
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0x854]
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x848], esi
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x840], esi
call fcn.0ed02855
test eax, eax
jne 0xed0d884
push esi
push esi
push esi
mov word [ebp - 0x61c], ax
mov word [ebp - 0x20c], ax
push esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x830], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x828], esi
push esi
jmp 0xed0d6a8
inc dword [ebp - 0x828]
lea eax, [ebp - 0x20c]
mov ecx, 0xed3f590
mov dx, word [ecx]
cmp dx, word [eax]
jne 0xed0d622
cmp dx, si
je 0xed0d61e
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0xed0d622
add ecx, 4
add eax, 4
cmp dx, si
jne 0xed0d5fc
xor eax, eax
jmp 0xed0d627
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jle 0xed0d687
cmp word [ebp - 0x61c], si
je 0xed0d66f
lea ecx, [ebp - 0x61c]
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xed0d666
cmp dx, si
je 0xed0d662
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xed0d666
add eax, 4
add ecx, 4
cmp dx, si
jne 0xed0d640
xor eax, eax
jmp 0xed0d66b
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jle 0xed0d687
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
call fcn.0ed0390d
push esi
push esi
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
push esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x828]
push dword [ebp - 0x848]
call ebx
test eax, eax
je 0xed0d5eb
cmp word [ebp - 0x61c], si
je 0xed0d7c6
push edi
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x848]
lea ecx, [ebp - 0x864]
mov dword [ebp - 0x864], esi
mov dword [ebp - 0x860], esi
mov dword [ebp - 0x85c], esi
call fcn.0ed02855
test eax, eax
jne 0xed0d7bb
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x864]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0ed02855
test eax, eax
jne 0xed0d769
mov ebx, dword [ebp - 0x82c]
xor edi, edi
cmp dword [ebx], 0xffffffff
jne 0xed0d75e
lea eax, [ebp - 0x828]
push eax
push dword [edi + 0xed3f9ac]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x828], esi
call fcn.0ed17733
test eax, eax
jne 0xed0d75e
mov eax, dword [ebp - 0x828]
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x28
jb 0xed0d72f
mov ebx, dword [ebp - 0x82c]
xor edi, edi
cmp dword [ebx], 0xffffffff
jne 0xed0d7a0
lea eax, [ebp - 0x828]
push eax
push dword [edi + 0xed3f9ac]
lea ecx, [ebp - 0x864]
mov dword [ebp - 0x828], esi
call fcn.0ed17733
test eax, eax
jne 0xed0d7a0
mov eax, dword [ebp - 0x828]
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x28
jb 0xed0d771
lea ecx, [ebp - 0x83c]
call fcn.0ed02891
mov edi, 0x20019
lea ecx, [ebp - 0x864]
call fcn.0ed02891
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x848]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0ed02855
test eax, eax
jne 0xed0d837
mov ebx, dword [ebp - 0x82c]
xor edi, edi
cmp dword [ebx], 0xffffffff
jne 0xed0d82c
lea eax, [ebp - 0x828]
push eax
push dword [edi + 0xed3f9ac]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x828], esi
call fcn.0ed17733
test eax, eax
jne 0xed0d82c
mov eax, dword [ebp - 0x828]
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x28
jb 0xed0d7fd
mov edi, dword [ebp - 0x82c]
xor ebx, ebx
cmp dword [edi], 0xffffffff
jne 0xed0d86e
lea eax, [ebp - 0x828]
push eax
push dword [ebx + 0xed3f9ac]
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x828], esi
call fcn.0ed17733
test eax, eax
jne 0xed0d86e
mov eax, dword [ebp - 0x828]
mov dword [edi], eax
add ebx, 4
add edi, 4
cmp ebx, 0x28
jb 0xed0d83f
lea ecx, [ebp - 0x83c]
call fcn.0ed02891
lea ecx, [ebp - 0x848]
call fcn.0ed02891
jmp 0xed02798
add eax, 4
add ecx, 4
cmp dx, si
je 0xed0c32d
jmp 0xed027ae
mov eax, dword [ebp - 0x858]
mov dword [eax + 0xc], 1
jmp 0xed027eb
cmp dx, si
je 0xed0d8dc
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xed027de
add eax, 4
add ecx, 4
cmp dx, si
jne 0xed027d2
xor eax, eax
jmp 0xed027e3
mov eax, dword [ebp - 0x82c]
mov dword [eax], esi
jmp 0xed027eb