Function at 0x1005a09
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x2020
call fcn.01009b60
mov eax, dword [0x100cdf4]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
lea esi, [ecx + eax*2]
add esi, eax
shl esi, 5
mov edx, dword [esi + 0x1020f84]
test edx, edx
jne 0x1005a47
mov eax, 0x80004005
jmp 0x1005d23
and word [ebp - 0x2004], 0
push edi
xor eax, eax
mov ecx, 0x7ff
lea edi, [ebp - 0x2002]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esi + 0x1020f80]
mov eax, dword [eax*4 + 0x101eed8]
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x2010], edi
mov dword [ebp - 0x2014], edi
mov dword [ebp - 0x201c], edi
je 0x1005d19
movzx ecx, word [esi + 0x1020f88]
cmp ecx, 3
je 0x1005c41
cmp ecx, 8
je 0x1005beb
cmp ecx, 0x2000
jne 0x1005d20
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ecx, [ebp - 0x200c]
push ecx
push edi
lea ecx, [ebp - 0x2018]
push ecx
push edi
push edx
push eax
call ebx
test eax, eax
mov dword [ebp - 0x2008], eax
jne 0x1005b29
push dword [ebp - 0x200c]
call dword [sym.imp.msvcrt.dll_malloc]
test eax, eax
pop ecx
mov dword [ebp - 0x2010], eax
jne 0x1005af9
mov dword [ebp - 0x2008], 0x8007000e
jmp 0x1005cfa
lea ecx, [ebp - 0x200c]
push ecx
push eax
lea eax, [ebp - 0x2018]
push eax
mov eax, dword [esi + 0x1020f80]
push 0
push dword [esi + 0x1020f84]
push dword [eax*4 + 0x101eed8]
call ebx
test eax, eax
mov dword [ebp - 0x2008], eax
je 0x1005b4d
cmp dword [ebp - 0x2008], 2
jne 0x1005b42
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010053c6
jmp 0x1005cfa
push dword [ebp - 0x2008]
jmp 0x1005c8a
mov ebx, dword [ebp - 0x2010]
xor esi, esi
cmp dword [ebp - 0x200c], 2
jb 0x1005bcc
sub dword [ebp - 0x200c], 2
cmp word [ebx], 0
je 0x1005bcc
mov eax, dword [ebp - 0x200c]
shr eax, 1
cmp esi, eax
jae 0x1005bcc
push 8
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
test edi, edi
pop ecx
je 0x1005bdc
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
push ebx
lea esi, [esi + eax + 1]
call dword [sym.imp.msvcrt.dll__wcsdup]
test eax, eax
pop ecx
pop ecx
mov dword [edi], eax
je 0x1005bdc
mov eax, dword [ebp - 0x201c]
test eax, eax
mov dword [ebp - 0x201c], edi
jne 0x1005bb8
mov dword [ebp - 0x2014], edi
jmp 0x1005bbb
mov dword [eax + 4], edi
mov eax, dword [ebp - 0x2010]
and dword [edi + 4], 0
lea ebx, [eax + esi*2]
test ebx, ebx
jne 0x1005b65
mov eax, dword [ebp - 0x2014]
mov dword [0x101eecc], eax
jmp 0x1005cfa
mov dword [ebp - 0x2008], 0x8007000e
jmp 0x1005ca6
lea ecx, [ebp - 0x200c]
push ecx
lea ecx, [ebp - 0x2004]
push ecx
lea ecx, [ebp - 0x2018]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x200c], 0x2000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x2008], eax
jne 0x1005c74
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
test eax, eax
mov dword [ebx + 8], eax
jne 0x1005c9a
push 0x4de
call fcn.0100484c
jmp 0x1005d19
lea ecx, [ebp - 0x200c]
push ecx
lea ecx, [ebp - 0x2020]
push ecx
lea ecx, [ebp - 0x2018]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x200c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov dword [ebp - 0x2008], eax
je 0x1005c91
cmp eax, 2
jne 0x1005c89
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.010053c6
jmp 0x1005d19
push eax
call fcn.01004de1
jmp 0x1005c9a
mov eax, dword [ebp - 0x2020]
mov dword [ebx + 8], eax
cmp dword [ebp - 0x2008], 0x8007000e
jne 0x1005cfa
mov esi, dword [ebp - 0x2014]
test esi, esi
je 0x1005cdd
jmp 0x1005cb8
mov esi, dword [ebp - 0x2014]
mov eax, dword [esi]
test eax, eax
mov ebx, esi
je 0x1005cc8
push eax
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov esi, dword [esi + 4]
push ebx
mov dword [ebp - 0x2014], esi
call dword [sym.imp.msvcrt.dll_free]
test esi, esi
pop ecx
jne 0x1005cb2
test edi, edi
je 0x1005cfa
mov eax, dword [edi]
test eax, eax
je 0x1005cf2
push eax
call dword [sym.imp.msvcrt.dll_free]
and dword [edi], 0
pop ecx
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x2010], 0
je 0x1005d10
push dword [ebp - 0x2010]
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x2008], 0
je 0x1005d20
mov eax, 0x80004005
jmp 0x1005d22
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.01009832
leave
ret 0xc