Function at 0x104dee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x1099a38]
and dword [ebp - 0x210], 0
push ebx
push esi
push edi
mov edx, 0x1017ab0
xor ecx, ecx
mov dword [ebp - 4], eax
call fcn.01081c57
cmp dword [0x109a030], 0
je 0x104e0a5
push 0x104
mov ebx, 0x1106960
push ebx
push 0x100ae7c
push 0x10bed24
call fcn.01070fc9
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x20], 0
je 0x104df4a
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x104df3c
mov esi, 0x1017aac
movsd dword es:[edi], dword [esi]
cmp dword [ecx + 0x2c], 0
je 0x104df61
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x104df53
mov esi, 0x1017aa8
movsd dword es:[edi], dword [esi]
cmp dword [ecx + 0x1c], 0
je 0x104dfff
cmp dword [ecx + 0x28], 0
jne 0x104df82
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x104df74
mov esi, 0x1017aa4
movsd dword es:[edi], dword [esi]
cmp dword [ecx + 0x1c], 0
je 0x104dfff
cmp dword [ecx + 0x28], 0
je 0x104dfff
jmp dword [0x109919c]
cmp dword [ecx + 0x40], 0
je 0x104e01b
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x104e008
mov esi, 0x1017a90
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
push ebx
push 0x1017a80
call fcn.01071ac0
pop ecx
pop ecx
xor edi, edi
push edi
push ebx
call fcn.0107245e
test eax, eax
jne 0x104e221
push ebx
push 0x1017a64
call fcn.01071ac0
pop ecx
pop ecx
push 0xfffa
push ebx
mov esi, 0xf078
push esi
push edi
mov byte [0x1106960], 0
call fcn.010312a2
push ebx
call fcn.01071aad
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], edi
jne 0x104e09e
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0xf00f
push edi
mov byte [ebp - 0x108], 0
call fcn.010312a2
push 0x11010
lea eax, [ebp - 0x108]
push eax
push ebx
push edi
call fcn.0107473f
mov eax, esi
jmp 0x104e22f
push 0xd
pop ecx
mov esi, 0x1017a2c
lea edi, [ebp - 0x20c]
rep movsd dword es:[edi], dword [esi]
mov eax, 0x10f55e0
mov byte [0x1106960], 0
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x104e0c4
lea edi, [ebp - 0x20c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x104e0d4
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x210]
push eax
and ecx, 3
push 0x20019
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
lea eax, [ebp - 0x20c]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x104e196
lea eax, [ebp - 0x20c]
push eax
push 0x1017a0c
call fcn.01071ac0
mov ebx, 0x1106960
pop ecx
pop ecx
push 0xfffa
push ebx
mov esi, 0xf078
push esi
push edi
mov byte [0x1106960], 0
call fcn.010312a2
push ebx
call fcn.01071aad
mov eax, dword [ebp + 8]
cmp dword [eax + 0x1c], edi
jne 0x104e185
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0xf00f
push edi
mov byte [ebp - 0x108], 0
call fcn.010312a2
push 0x11010
lea eax, [ebp - 0x108]
push eax
push ebx
push edi
call fcn.0107473f
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x104e09e
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x214]
push eax
mov ebx, 0x1106960
push ebx
push edi
push edi
push 0x100ae94
push dword [ebp - 0x210]
mov dword [ebp - 0x214], 0xfffa
call esi
test eax, eax
je 0x104e1dc
lea eax, [ebp - 0x20c]
push eax
push 0x10179d4
call fcn.01071ac0
jmp 0x104e12b
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push edi
push 0x1010d0c
push dword [ebp - 0x210]
call esi
push dword [ebp - 0x210]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x104df30
lea eax, [ebp - 0x20c]
push eax
push 0x1017990
call fcn.01071ac0
xor edi, edi
jmp 0x104e044
mov edx, 0x1017ab0
xor ecx, ecx
call fcn.01081c57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 4