Function at 0x10ba130
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x113bf93
mov eax, dword fs:[0]
push eax
sub esp, 0x48
push ebx
push esi
push edi
mov eax, dword [0x115f604]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], edi
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], edi
call edx
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x48], edi
mov ecx, dword [ebp + 0x10]
mov eax, ecx
and eax, 0x1000
mov byte [ebp - 4], 2
mov byte [ebp - 0xe], bl
mov dword [ebp - 0x34], eax
je 0x10ba1e5
test ecx, 0x110000
je 0x10ba1e5
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 1
call fcn.010b5490
lea eax, [esi - 0x10]
mov byte [ebp - 4], bl
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10ba1cc
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80070057
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
cmp dword [0x100320c], edi
jne 0x10ba216
lea ecx, [ebp - 0x48]
push ecx
push 1
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x10ba27a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3f0
jne 0x10ba289
lea edx, [ebp - 0x2c]
push edx
call fcn.0112deb0
mov eax, dword [eax]
lea ecx, [ebp - 0x24]
push ecx
push 0x20019
push 0
push 0x1015960
push eax
mov dword [ebp - 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
jne 0x10ba24b
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x10ba259
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x10ba2d0
cmp edi, 2
je 0x10ba628
cmp edi, 3
je 0x10ba628
test edi, edi
jg 0x10ba2bd
mov ebx, edi
jmp 0x10ba628
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
cmp eax, edi
mov dword [ebp - 0x4c], eax
jne 0x10ba216
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
test eax, eax
jg 0x10ba29b
call ebx
mov ebx, eax
jmp 0x10ba2ab
call ebx
mov ebx, eax
and ebx, 0xffff
or ebx, 0x80070000
cmp ebx, edi
jl 0x10ba628
mov ebx, 0x80070005
jmp 0x10ba628
and edi, 0xffff
or edi, 0x80070000
mov ebx, edi
jmp 0x10ba628
xor ebx, ebx
mov dword [ebp - 0x2c], 0x100
mov dword [ebp - 0x1c], ebx
mov eax, dword [0x1161d94]
mov edx, dword [eax + 0xc]
mov ecx, 0x1161d94
mov byte [ebp - 4], 3
call edx
add eax, 0x10
mov dword [ebp - 0x14], eax
mov ecx, dword [esi - 8]
mov eax, 1
sub eax, dword [esi - 4]
mov byte [ebp - 4], 4
or ecx, eax
mov byte [ebp - 0xd], bl
jge 0x10ba317
push ebx
lea ecx, [ebp - 0x18]
call fcn.010745e0
mov esi, dword [ebp - 0x18]
cmp dword [esi - 8], ebx
jl 0x10ba679
mov dword [esi - 0xc], ebx
mov word [esi], bx
mov edi, dword [ebp - 0x2c]
mov eax, dword [esi - 8]
mov ecx, 1
sub ecx, dword [esi - 4]
sub eax, edi
or eax, ecx
jge 0x10ba346
push edi
lea ecx, [ebp - 0x18]
call fcn.010745e0
mov esi, dword [ebp - 0x18]
cmp edi, ebx
jl 0x10ba679
cmp edi, dword [esi - 8]
jg 0x10ba679
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x2c]
push ecx
mov dword [esi - 0xc], edi
mov word [esi + edi*2], bx
mov edi, dword [ebp - 0x30]
push esi
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add edi, 1
mov ecx, esi
mov dword [ebp - 0x30], edi
lea edi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
cmp dx, bx
jne 0x10ba383
sub ecx, edi
sar ecx, 1
js 0x10ba679
cmp ecx, dword [esi - 8]
jg 0x10ba679
cmp eax, 0x103
mov dword [esi - 0xc], ecx
mov word [esi + ecx*2], bx
je 0x10ba683
cmp eax, ebx
je 0x10ba3c2
cmp eax, 0xea
jne 0x10ba6ab
push 0xb0
call fcn.01084a6d
mov ebx, eax
add esp, 4
mov dword [ebp - 0x24], ebx
test ebx, ebx
mov byte [ebp - 4], 5
je 0x10ba422
mov eax, dword [ebp + 0xc]
push eax
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
sub eax, 0x10
mov dword [ebp - 0x40], esp
mov edi, esp
push eax
call fcn.01081e90
add eax, 0x10
mov dword [edi], eax
lea eax, [esi - 0x10]
mov dword [ebp - 0x44], esp
mov edi, esp
push eax
mov byte [ebp - 4], 6
call fcn.01081e90
add eax, 0x10
mov dword [edi], eax
add esp, 4
mov ecx, ebx
mov byte [ebp - 4], 5
call fcn.010a1480
mov edi, eax
jmp 0x10ba424
xor edi, edi
test edi, edi
mov byte [ebp - 4], 4
mov dword [ebp - 0x1c], edi
je 0x10ba5ec
mov ecx, edi
call fcn.010b98b0
test eax, eax
mov dword [ebp - 0x20], eax
jge 0x10ba464
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov dword [ebp - 0x20], 0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x10ba603
mov ebx, dword [ebp + 0x10]
test ebx, 0x100000
je 0x10ba480
push 1
mov ecx, edi
call fcn.010b6d20
test eax, eax
jne 0x10ba555
push 0
mov ecx, edi
call fcn.010b6d20
test eax, eax
je 0x10ba5ec
test ebx, 0x10000
jne 0x10ba555
cmp dword [ebp - 0x34], 0
je 0x10ba5ec
mov edx, dword [0x1161d94]
mov eax, dword [edx + 0xc]
mov ecx, 0x1161d94
call eax
add eax, 0x10
mov dword [ebp - 0x24], eax
cmp dword [edi + 0x30], 0
mov byte [ebp - 4], 7
je 0x10ba4d4
lea ecx, [ebp - 0x24]
call fcn.0111cdb0
jmp 0x10ba5ec
push 0x1162aa4
push 0
lea ecx, [ebp - 0x38]
push ecx
mov ecx, edi
call fcn.010b6820
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 8
call fcn.0109c210
mov eax, dword [ebp - 0x38]
add eax, 0xfffffff0
mov byte [ebp - 4], 7
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10ba516
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x24]
push ecx
push 0x1162ab4
call fcn.010b7240
mov ebx, eax
mov eax, dword [ebp - 0x24]
add eax, 0xfffffff0
mov byte [ebp - 4], 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10ba549
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
test ebx, ebx
je 0x10ba5ec
mov byte [ebp - 0xe], 1
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x10ba5a9
push eax
push 0
lea edx, [ebp - 0x3c]
push edx
mov ecx, edi
call fcn.010b6820
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.0109dbc0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 4
call fcn.0111cdb0
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], 0
je 0x10ba5ec
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
cmp dword [ecx - 0xc], 0
je 0x10ba5a9
push eax
lea edx, [ebp - 0x14]
push edx
call fcn.010b5cc0
test al, al
je 0x10ba5ec
mov ebx, dword [ebp + 0x1c]
mov eax, dword [ebx + 4]
xor edi, edi
test eax, eax
jbe 0x10ba5e4
cmp edi, eax
jae 0x10ba679
mov eax, dword [ebx]
lea ecx, [ebp - 0x18]
lea eax, [eax + edi*4]
push ecx
push eax
call fcn.010b5cc0
test al, al
je 0x10ba5d4
mov byte [ebp - 0xd], 1
mov eax, dword [ebx + 4]
add edi, 1
cmp edi, eax
jb 0x10ba5bd
cmp byte [ebp - 0xd], 0
jne 0x10ba5ec
push esi
mov ecx, ebx
call fcn.010a3bb0
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
or ecx, 0xffffffff
lea edx, [eax + 0xc]
mov byte [ebp - 4], 3
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10ba60f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.010979a0
cmp byte [ebp - 0xe], 0
je 0x10ba2d0
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x4c], 0
mov byte [ebp - 4], 1
je 0x10ba6ef
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10ba6fd
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_SetThreadToken]
test eax, eax
jne 0x10ba6ef
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10ba668
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x114de9c
lea ecx, [ebp + 0x10]
push ecx
mov dword [ebp + 0x10], esi
call fcn.01083d3b
push 0x80070057
call fcn.01071710
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10ba625
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x10ba625
cmp eax, ebx
jle 0x10ba6b9
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
mov byte [ebp - 4], 3
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10ba6de
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.010979a0
jmp 0x10ba628
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10ba6fd
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x10ba71d
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, dword [ebp - 0x28]
test eax, eax
je 0x10ba72b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18