Function at 0x10990c8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x605c
call fcn.01077950
mov eax, dword [0x10de03c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x6020], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
push eax
mov dword [ebp - 0x6028], edi
mov dword [ebp - 0x6038], eax
mov dword [ebp - 0x6040], esi
mov dword [ebp - 0x602c], esi
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6034], esi
mov dword [ebp - 0x6024], esi
mov dword [ebp - 0x6010], esi
mov dword [ebp - 0x6014], esi
call fcn.010a721f
test byte [edi + 0x60], 0x80
mov ebx, eax
mov dword [ebp - 0x6048], ebx
je 0x1099158
push ebx
call fcn.010a72a9
push eax
push esi
push edi
call fcn.010a753c
push eax
mov dword [ebp - 0x6040], eax
call fcn.010a72a9
jmp 0x109915a
mov eax, ebx
cmp ebx, esi
je 0x1099986
cmp eax, esi
je 0x1099986
push eax
push 0x10113c0
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x2000000
jne 0x1099805
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011518
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x1099805
lea eax, [ebp - 0x6030]
push eax
lea eax, [ebp - 0x6034]
push eax
push esi
push esi
push 0x1011508
push dword [ebp - 0x600c]
mov dword [ebp - 0x6030], reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x600c]
mov dword [ebp - 0x6018], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6018], esi
jne 0x1099805
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
je 0x1099285
push 0x1011730
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x10116f0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099285
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114b8
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x10116f0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x1099303
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
pop ecx
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6010], esi
je 0x10993a2
push 0x1011730
lea eax, [ebp - 0x2004]
push 0x10116b8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x10993a2
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x10993a2
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114b8
lea eax, [ebp - 0x2004]
push 0x10116b8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x1099422
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x1099422
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098881
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp - 0x6018], esi
pop ecx
jne 0x1099805
mov eax, dword [ebp - 0x602c]
jmp 0x10997f7
mov eax, dword [ebp - 0x6010]
cmp word [eax], si
je 0x1099805
push 0x1011690
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x1011690
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x10994ab
push 0x1011690
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2]
push eax
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x10116f0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
jmp 0x10994c6
push dword [ebp - 0x6010]
lea eax, [ebp - 0x2004]
push 0x101166c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push dword [ebp - 0x6010]
lea eax, [ebp - 0x6004]
push 0x1011658
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x1011648
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x10997e0
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
cmp word [ecx + eax*2 - 2], 0x2a
lea eax, [ebp - 0x2004]
jne 0x10997c7
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov word [ebp + eax*2 - reloc.ADVAPI32.dll_RegDeleteValueW], si
lea eax, [ebp - 0x6004]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
mov word [ebp + eax*2 - reloc.ADVAPI32.dll_RegDeleteValueW], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6030]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
call edi
test eax, eax
jne 0x10997e0
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6044]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x6004]
push eax
push reloc.KERNEL32.dll_WaitForSingleObject
call edi
cmp eax, esi
jne 0x109978a
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6014], esi
mov dword [ebp - 0x6024], esi
cmp dword [ebp - 0x6014], esi
je 0x10995c5
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
lea eax, [ebp - 0x605c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x6054]
push eax
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6024]
mov dword [ebp - 0x6054], reloc.KERNEL32.dll_GetVolumeNameForVolumeMountPointW
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1099764
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6044]
call edi
cmp eax, esi
je 0x109962e
mov dword [ebp - 0x6014], esi
cmp eax, esi
mov dword [ebp - 0x6008], esi
jne 0x10996a7
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push 4
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099798
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push esi
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099798
mov dword [ebp - 0x6008], esi
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x604c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x101163c
push dword [ebp - 0x6014]
mov dword [ebp - 0x6018], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1099732
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x603c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x101163c
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1099732
mov eax, dword [ebp - 0x604c]
cmp eax, dword [ebp - 0x603c]
jae 0x1099732
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.010987e3
mov dword [ebp - 0x6018], esi
cmp dword [ebp - 0x6008], esi
je 0x1099752
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6008], esi
inc dword [ebp - 0x6024]
cmp dword [ebp - 0x6018], esi
je 0x10995ab
cmp dword [ebp - 0x6014], esi
je 0x109977e
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6030]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10997e0
cmp dword [ebp - 0x601c], 1
jne 0x10996a7
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.010987e3
jmp 0x1099738
push dword [ebp - 0x6038]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.01098f4a
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2 + 2]
cmp eax, esi
mov dword [ebp - 0x6010], eax
jne 0x1099446
cmp word [reloc.ADVAPI32.dll_RegDeleteValueW], si
je 0x10998a4
push 0x5c
push 0x10ecaf0
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x109982a
mov eax, 0x10ecaf0
add eax, 2
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x1099841
mov eax, 0x10ecaf0
add eax, 2
push eax
push dword [ebp - 0x6034]
mov dword [ebp - 0x603c], eax
lea eax, [ebp - 0x2004]
push 0x10115f8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push dword [ebp - 0x603c]
lea eax, [ebp - 0x6004]
push 0x10115b8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
push dword [ebp - 0x6038]
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.01098f4a
mov word [reloc.ADVAPI32.dll_RegDeleteValueW], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10115a8
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099952
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10113c0
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099946
cmp dword [0x10e2588], esi
je 0x109993a
push esi
push esi
push dword [ebp - 0x600c]
push dword [ebp - 0x6014]
call fcn.010cb454
test eax, eax
jne 0x109993a
push esi
push esi
push esi
call fcn.01050ebf
push 0xe27
xor edi, edi
inc edi
push edi
push edi
push esi
call fcn.01050ebf
push 8
push esi
call fcn.01050ebf
add esp, 0x24
mov dword [0x10e0f40], edi
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x602c]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
pop ecx
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x10113c0
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x6048]
jmp 0x109998d
mov esi, dword [sym.imp.msvcrt.dll_free]
push ebx
call esi
push dword [ebp - 0x6040]
call esi
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075aef
leave
ret 8