Function at 0x10007534
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x224
mov eax, 0x100120b6
call fcn.10011eac
mov eax, dword [0x10014024]
cmp eax, 0x10014024
je 0x10007568
test byte [eax + 0x1c], 1
je 0x10007568
push dword [eax + 0x14]
mov edx, 0x10002130
push dword [eax + 0x10]
push 0x6b
pop ecx
call fcn.10002ea3
xor ecx, ecx
mov esi, ecx
mov ebx, ecx
mov edi, 0x100020d0
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x21c], ecx
lea eax, [ebp - 0x22c]
mov dword [ebp - 4], ecx
push eax
push 0x20219
push ecx
push edi
push 0x80000002
mov dword [ebp - 0x22c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100075bc
mov edi, dword [ebp - 0x22c]
mov dword [ebp - 0x224], edi
jmp 0x10007721
push ecx
push ecx
push 0x2021f
push ecx
push ecx
push edi
push 0x80000002
lea ecx, [ebp - 0x224]
call fcn.1000ab09
mov esi, eax
test esi, esi
jne 0x1000782f
push 0x10001bc4
lea ecx, [ebp - 0x218]
call fcn.1000acf9
mov ecx, edi
mov byte [ebp - 4], 1
call fcn.1000b2ee
push eax
push edi
lea ecx, [ebp - 0x218]
call fcn.1000aaae
mov ecx, dword [ebp - 0x218]
mov edi, 0x10000000
push 1
push edi
push 0x10001bd8
push 0xc
pop edx
call fcn.10007892
mov ecx, dword [ebp - 0x218]
mov esi, eax
test esi, esi
js 0x10007825
push 1
push 0x2001f
push 0x10001c6c
push 0xc
pop edx
call fcn.10007892
mov ecx, dword [ebp - 0x218]
mov esi, eax
test esi, esi
js 0x10007825
push 1
push edi
push 0x10001c88
push 0xc
pop edx
call fcn.10007892
mov ecx, dword [ebp - 0x218]
mov esi, eax
test esi, esi
js 0x10007825
push 1
push edi
push 0x10001c98
push 0xc
pop edx
call fcn.10007892
mov ecx, dword [ebp - 0x218]
mov esi, eax
test esi, esi
js 0x10007825
push 1
push edi
push 0x10001c58
push 0xc
pop edx
call fcn.10007892
mov esi, eax
test esi, esi
js 0x1000781f
mov edi, dword [ebp - 0x224]
test edi, edi
je 0x100076c4
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
and dword [ebp - 0x22c], 0
lea eax, [ebp - 0x22c]
push eax
push 0x20219
push 0
push 0x100020d0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10007800
test edi, edi
je 0x100076fc
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x22c]
mov dword [ebp - 0x224], edi
test eax, eax
jne 0x10007800
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.10003014
xor eax, eax
mov dword [ebp - 0x230], 0x100
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x100077f9
test eax, eax
jne 0x100077ea
push 0x10001bc4
lea ecx, [ebp - 0x228]
call fcn.1000acf9
mov esi, 0x100020d0
mov byte [ebp - 4], 2
mov ecx, esi
call fcn.1000b2ee
push eax
push esi
lea ecx, [ebp - 0x228]
call fcn.1000aaae
lea ecx, [ebp - 0x214]
call fcn.1000b2ee
push eax
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0x228]
call fcn.1000aaae
mov ecx, dword [ebp - 0x228]
lea eax, [ebp - 0x214]
push 1
push 0x10000000
push eax
push 0xc
pop edx
call fcn.10007892
mov ecx, dword [ebp - 0x228]
mov esi, eax
lea ecx, [ecx - 0x10]
test esi, esi
jns 0x100077d2
xor esi, esi
call fcn.1000b376
test edi, edi
je 0x100077e2
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
xor ecx, ecx
jmp 0x1000756e
jg 0x100077f0
mov esi, eax
jmp 0x100077f9
movzx esi, ax
or esi, 0x80070000
test edi, edi
je 0x1000784f
push edi
jmp 0x10007849
jg 0x10007806
mov esi, eax
jmp 0x1000780f
movzx esi, ax
or esi, 0x80070000
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.1000b376
jmp 0x100077f9
mov ecx, dword [ebp - 0x218]
lea ecx, [ecx - 0x10]
call fcn.1000b376
jmp 0x1000783a
jle 0x1000783a
movzx esi, si
or esi, 0x80070000
cmp dword [ebp - 0x224], 0
je 0x1000784f
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [0x10014024]
cmp edi, 0x10014024
je 0x1000788a
test byte [edi + 0x1c], 1
je 0x1000788a
movzx eax, byte [edi + 0x19]
mov ecx, esi
sar ecx, 0x1f
and ecx, 0xfffffffd
add ecx, 5
cmp eax, ecx
jl 0x1000788a
push esi
push dword [edi + 0x14]
mov edx, 0x10002130
push dword [edi + 0x10]
push 0x6c
pop ecx
call fcn.10002ec1
mov eax, esi
call fcn.10011e5b
ret