Function at 0x10048fb
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x1008010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push edi
mov word [ebp - 0x340], ax
mov word [ebp - 0x7b4], ax
mov word [ebp - 0xd4], ax
lea eax, [ebp - 0x9dc]
push eax
xor ebx, ebx
push 0x20019
push ebx
mov esi, ecx
push 0x1001600
push 0x80000002
mov dword [ebp - 0x9dc], ebx
mov dword [esi + 0x6a0], ebx
mov dword [esi + 0x6a4], ebx
call dword [entry0]
test eax, eax
jne 0x100553c
push 0x104
lea eax, [ebp - 0x340]
push eax
xor edi, edi
push ebx
jmp 0x1004984
push 0x104
lea eax, [ebp - 0x340]
inc edi
push eax
push edi
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x1004976
imul edi, edi, 0x248
push edi
push 0x40
call dword [0x10010c8]
mov dword [esi + 0x6a4], eax
cmp eax, ebx
jne 0x10049c3
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1005553
push 0x104
lea eax, [ebp - 0x340]
push eax
push ebx
push dword [ebp - 0x9dc]
mov dword [ebp - 0xa0c], ebx
mov dword [ebp - 0xa14], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x1005530
xor edi, edi
mov dword [ebp - 0xa00], ebx
mov eax, dword [esi + 0x6a4]
lea eax, [edi + eax + 0x18]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x9dc]
call dword [entry0]
test eax, eax
jne 0x1005562
lea eax, [ebp - 0x340]
push eax
mov eax, dword [esi + 0x6a4]
push 0x104
lea eax, [edi + eax + 0x1c]
push eax
call fcn.01002fb5
cmp eax, ebx
mov dword [ebp - 0xa08], 0x208
mov dword [ebp - 0x9d8], 1
jl 0x1005562
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x7b4]
push eax
lea eax, [ebp - 0x9d8]
push eax
mov eax, dword [esi + 0x6a4]
push ebx
push ebx
push dword [edi + eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005562
lea eax, [ebp - 0x7b4]
push eax
push 0x27
lea eax, [ebp - 0x54]
push eax
call fcn.01002fb5
test eax, eax
jge 0x1004aaa
xor eax, eax
mov word [ebp - 0x54], ax
mov eax, dword [esi + 0x6a4]
lea eax, [edi + eax + 4]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [0x1001254]
mov eax, dword [esi + 0x6a4]
mov dword [edi + eax + 0x14], ebx
mov eax, dword [esi + 0x6a4]
add eax, edi
lea ecx, [eax + 0x14]
push ecx
push 0x10017c8
push 1
push ebx
add eax, 4
push eax
call dword [fcn.01001260]
test eax, eax
jl 0x1005562
mov eax, dword [esi + 0x6a4]
mov dword [edi + eax + 0x230], ebx
test byte [esi + 0x65c], 1
je 0x1004b15
mov eax, dword [esi + 0x6a4]
lea eax, [edi + eax + 0x230]
or dword [eax], 0x20
cmp dword [esi + 0x664], ebx
je 0x1004b2d
mov eax, dword [esi + 0x6a4]
lea eax, [edi + eax + 0x230]
or dword [eax], 0x40
lea eax, [esi + 8]
push eax
push 0x104
lea eax, [ebp - 0x9bc]
push eax
call fcn.01002fb5
mov eax, dword [esi + 0x6a4]
mov eax, dword [edi + eax + 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0xa04]
push edx
push 0x10017d8
push eax
call dword [ecx]
test eax, eax
jl 0x1004bd0
lea eax, [ebp - 0x340]
push eax
push 0x104
lea eax, [ebp - 0x5ac]
push eax
call fcn.01002fb5
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0xa04]
mov ecx, dword [ecx]
add eax, edi
lea edx, [eax + 0x230]
push edx
lea edx, [eax + 0x22c]
push edx
lea edx, [eax + 0x224]
push edx
lea edx, [eax + 0x228]
push edx
lea edx, [ebp - 0x5ac]
push edx
lea edx, [ebp - 0x9bc]
push edx
push dword [eax + 0x18]
push dword [ebp - 0xa04]
call dword [ecx + 0x20]
mov dword [ebp - 0x9e0], eax
mov eax, dword [ebp - 0xa04]
jmp 0x10052fe
push 0x400
call dword [0x100124c]
mov ecx, dword [esi + 0x6a4]
mov dword [edi + ecx + 0x224], eax
mov eax, dword [esi + 0x6a4]
add eax, edi
mov ecx, dword [eax + 0x224]
mov dword [ebp - 0x9d4], ecx
cmp ecx, ebx
je 0x10049bc
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x9e0], ecx
lea ecx, [eax + 0x230]
push ecx
lea ecx, [eax + 0x224]
push ecx
lea ecx, [eax + 0x228]
push ecx
lea ecx, [ebp - 0x9bc]
push ecx
push dword [eax + 0x18]
push dword [ebp - 0x9e0]
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x9d4]
mov dword [ebp - 0x9e0], eax
mov eax, dword [esi + 0x6a4]
cmp ecx, dword [edi + eax + 0x224]
je 0x1004c59
push ecx
call dword [0x1001250]
cmp dword [ebp - 0x9e0], ebx
jne 0x100530a
lea eax, [ebp - 0x9fc]
push eax
mov dword [ebp - 0x9e8], ebx
call dword [0x1001108]
xor eax, eax
mov word [ebp - 0x5ac], ax
lea eax, [ebp - 0xa08]
push eax
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x9d8]
push eax
mov eax, dword [esi + 0x6a4]
push ebx
push 0x100174c
mov dword [ebp - 0xa08], 0x208
mov dword [ebp - 0x9d8], 1
push dword [edi + eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004d03
lea eax, [ebp - 0x5ac]
push eax
push 0x27
lea eax, [ebp - 0x54]
push eax
call fcn.01002fb5
lea eax, [ebp - 0x9cc]
push eax
lea eax, [ebp - 0x54]
push eax
call dword [0x1001254]
lea eax, [ebp - 0x9e8]
push eax
push 0x10017a8
push 1
push ebx
lea eax, [ebp - 0x9cc]
push eax
call dword [fcn.01001260]
mov eax, dword [esi + 0x6a4]
cmp dword [edi + eax + 0x228], ebx
jne 0x1004f1a
mov eax, dword [ebp - 0x9e8]
cmp eax, ebx
je 0x1004daf
push 8
pop ecx
push ebx
lea edx, [ebp - 0x9fc]
push edx
push 0x100173c
mov word [ebp - 0x9fc], cx
mov dword [ebp - 0x9f4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1004daf
cmp word [ebp - 0x9fc], 8
jne 0x1004da2
push dword [ebp - 0x9f4]
call dword [0x100110c]
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 0x9d4], eax
call dword [0x100124c]
mov ecx, dword [esi + 0x6a4]
mov dword [edi + ecx + 0x228], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [edi + eax + 0x228]
cmp eax, ebx
je 0x1004da2
push dword [ebp - 0x9f4]
push dword [ebp - 0x9d4]
push eax
call fcn.01003f95
lea eax, [ebp - 0x9fc]
push eax
call dword [0x1001110]
mov eax, dword [esi + 0x6a4]
add eax, edi
cmp dword [eax + 0x228], ebx
jne 0x1004f1a
lea ecx, [ebp - 0x9d0]
push ecx
push ebx
lea ecx, [ebp - 0x9d8]
push ecx
push ebx
push 0x100173c
mov dword [ebp - 0x9d0], ebx
mov dword [ebp - 0x9d8], 1
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x340]
push eax
call dword [0x1001088]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x9d0], eax
ja 0x1004e21
lea eax, [ebp - 0x340]
push eax
call dword [0x1001088]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x9d0], eax
push dword [ebp - 0x9d0]
push 0x40
call dword [0x10010c8]
mov dword [ebp - 0x9d4], eax
cmp eax, ebx
je 0x1004f1a
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x9d0]
push ecx
push eax
lea eax, [ebp - 0x9d8]
push eax
mov eax, dword [esi + 0x6a4]
push ebx
push 0x100173c
push dword [edi + eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004e83
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0x9d0]
push dword [ebp - 0x9d4]
call fcn.01003f95
push 0x202
push 0x40
call dword [0x10010c8]
mov dword [ebp - 0x9e4], eax
cmp eax, ebx
je 0x1004f0e
push ebx
push 0x101
push eax
push dword [ebp - 0x9d4]
xor ecx, ecx
mov word [eax], cx
call dword [0x1001148]
test eax, eax
jl 0x1004f02
push dword [ebp - 0x9e4]
call dword [0x1001088]
inc eax
mov dword [ebp - 0x9ec], eax
add eax, eax
push eax
call dword [0x100124c]
mov ecx, dword [esi + 0x6a4]
mov dword [edi + ecx + 0x228], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [edi + eax + 0x228]
cmp eax, ebx
je 0x1004f02
push dword [ebp - 0x9e4]
push dword [ebp - 0x9ec]
push eax
call fcn.01002fb5
push dword [ebp - 0x9e4]
call dword [fcn.01001090]
push dword [ebp - 0x9d4]
call dword [fcn.01001090]
mov eax, dword [esi + 0x6a4]
cmp dword [edi + eax + 0x224], ebx
jne 0x10050f2
mov eax, dword [ebp - 0x9e8]
cmp eax, ebx
je 0x1004fc6
push 8
pop ecx
push ebx
lea edx, [ebp - 0x9fc]
push edx
push 0x1001724
mov word [ebp - 0x9fc], cx
mov dword [ebp - 0x9f4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1004fc6
cmp word [ebp - 0x9fc], 8
jne 0x1004fb9
push dword [ebp - 0x9f4]
call dword [0x100110c]
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 0x9d4], eax
call dword [0x100124c]
mov ecx, dword [esi + 0x6a4]
mov dword [edi + ecx + 0x224], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [edi + eax + 0x224]
cmp eax, ebx
je 0x1004fb9
push dword [ebp - 0x9f4]
push dword [ebp - 0x9d4]
push eax
call fcn.01003f95
lea eax, [ebp - 0x9fc]
push eax
call dword [0x1001110]
mov eax, dword [esi + 0x6a4]
add eax, edi
cmp dword [eax + 0x224], ebx
jne 0x10050f2
lea ecx, [ebp - 0x9d0]
push ecx
push ebx
lea ecx, [ebp - 0x9d8]
push ecx
push ebx
push 0x1001724
mov dword [ebp - 0x9d0], ebx
mov dword [ebp - 0x9d8], 1
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x9d0]
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [0x10010c8]
mov dword [ebp - 0x9e4], eax
cmp eax, ebx
je 0x10050f2
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x9d0]
push ecx
push eax
lea eax, [ebp - 0x9d8]
push eax
mov eax, dword [esi + 0x6a4]
push ebx
push 0x1001724
push dword [edi + eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10050e6
push 0x402
push 0x40
call dword [0x10010c8]
mov dword [ebp - 0x9d4], eax
cmp eax, ebx
je 0x10050e6
push ebx
push 0x201
push eax
push dword [ebp - 0x9e4]
xor ecx, ecx
mov word [eax], cx
call dword [0x1001148]
test eax, eax
jl 0x10050da
push dword [ebp - 0x9d4]
call dword [0x1001088]
inc eax
mov dword [ebp - 0x9ec], eax
add eax, eax
push eax
call dword [0x100124c]
mov ecx, dword [esi + 0x6a4]
mov dword [edi + ecx + 0x224], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [edi + eax + 0x224]
cmp eax, ebx
je 0x10050da
push dword [ebp - 0x9d4]
push dword [ebp - 0x9ec]
push eax
call fcn.01002fb5
push dword [ebp - 0x9d4]
call dword [fcn.01001090]
push dword [ebp - 0x9e4]
call dword [fcn.01001090]
mov eax, dword [esi + 0x6a4]
mov dword [edi + eax + 0x22c], ebx
mov eax, dword [esi + 0x6a4]
test byte [edi + eax + 0x230], 1
je 0x10052f4
mov eax, dword [ebp - 0x9e8]
cmp eax, ebx
je 0x10051ac
push 8
pop ecx
push ebx
lea edx, [ebp - 0x9fc]
push edx
push 0x10016fc
mov word [ebp - 0x9fc], cx
mov dword [ebp - 0x9f4], ebx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10051ac
cmp word [ebp - 0x9fc], 8
jne 0x100519f
push dword [ebp - 0x9f4]
call dword [0x100110c]
lea eax, [eax + eax + 2]
push eax
mov dword [ebp - 0x9d4], eax
call dword [0x100124c]
mov ecx, dword [esi + 0x6a4]
mov dword [edi + ecx + 0x22c], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [edi + eax + 0x22c]
cmp eax, ebx
je 0x100519f
push dword [ebp - 0x9f4]
push dword [ebp - 0x9d4]
push eax
call fcn.01003f95
lea eax, [ebp - 0x9fc]
push eax
call dword [0x1001110]
mov eax, dword [esi + 0x6a4]
cmp dword [edi + eax + 0x22c], ebx
jne 0x10052f4
push 0x32
lea eax, [ebp - 0x3a4]
push eax
push 0x12
push dword [0x1008034]
call dword [0x10011a8]
lea eax, [ebp - 0x9d0]
push eax
push ebx
lea eax, [ebp - 0x9d8]
push eax
mov eax, dword [esi + 0x6a4]
push ebx
push 0x10016fc
mov dword [ebp - 0x9d0], ebx
mov dword [ebp - 0x9d8], 1
push dword [edi + eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x9d0], 0x64
ja 0x100521e
mov dword [ebp - 0x9d0], 0x64
push dword [ebp - 0x9d0]
push 0x40
call dword [0x10010c8]
mov dword [ebp - 0x9d4], eax
cmp eax, ebx
je 0x10052f4
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x9d0]
push ecx
push eax
lea eax, [ebp - 0x9d8]
push eax
mov eax, dword [esi + 0x6a4]
push ebx
push 0x10016fc
push dword [edi + eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1005280
lea eax, [ebp - 0x3a4]
push eax
push dword [ebp - 0x9d0]
push dword [ebp - 0x9d4]
call fcn.01003f95
push ebx
push 0x32
lea eax, [ebp - 0x138]
push eax
push dword [ebp - 0x9d4]
call dword [0x1001148]
test eax, eax
jl 0x10052e8
lea eax, [ebp - 0x138]
push eax
call dword [0x1001088]
inc eax
mov dword [ebp - 0x9ec], eax
add eax, eax
push eax
call dword [0x100124c]
mov ecx, dword [esi + 0x6a4]
mov dword [edi + ecx + 0x22c], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [edi + eax + 0x22c]
cmp eax, ebx
je 0x10052e8
lea ecx, [ebp - 0x138]
push ecx
push dword [ebp - 0x9ec]
push eax
call fcn.01002fb5
push dword [ebp - 0x9d4]
call dword [fcn.01001090]
mov eax, dword [ebp - 0x9e8]
cmp eax, ebx
je 0x100531c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x9e0], ebx
jl 0x1005562
cmp dword [ebp - 0x9e0], ebx
jne 0x1005562
mov eax, dword [esi + 0x6a4]
push 4
mov dword [edi + eax + 0x240], 1
pop eax
mov dword [ebp - 0x9d0], eax
mov dword [ebp - 0x9d8], eax
mov eax, dword [esi + 0x6a4]
add eax, edi
lea ecx, [ebp - 0x9d0]
push ecx
lea ecx, [eax + 0x234]
push ecx
lea ecx, [ebp - 0x9d8]
push ecx
push ebx
push 0x10016e8
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100537d
mov eax, dword [esi + 0x6a4]
mov dword [edi + eax + 0x234], 0xc8
test byte [esi + 0x65c], 3
lea eax, [ebp - 0xd4]
jne 0x100539b
push 0x1001690
push 0x40
push eax
call fcn.01002fb5
jmp 0x10053b6
push dword [esi + 0x660]
push 0x1001690
push 0x1001680
push 0x40
push eax
call fcn.01001ee4
add esp, 0x14
test byte [esi + 0x65c], 8
push 4
pop eax
mov dword [ebp - 0xa10], ebx
mov dword [ebp - 0x9d0], eax
mov dword [ebp - 0x9d8], eax
je 0x10053ed
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0xa00]
mov dword [ecx + eax + 0x244], 1
jmp 0x100546b
lea eax, [ebp - 0x9d0]
push eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0x9d8]
push eax
push ebx
lea eax, [ebp - 0xd4]
push eax
mov eax, dword [esi + 0x6a4]
push dword [edi + eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1005444
test byte [esi + 0x65c], 3
mov eax, dword [ebp - 0xa10]
mov ecx, dword [esi + 0x6a4]
jne 0x1005438
and eax, 1
jmp 0x100543b
and eax, 2
mov dword [edi + ecx + 0x244], eax
jmp 0x100546b
mov eax, dword [esi + 0x6a4]
add eax, edi
test byte [esi + 0x65c], 3
mov ecx, dword [eax + 0x230]
jne 0x100545f
shr ecx, 1
jmp 0x1005462
shr ecx, 3
and ecx, 1
mov dword [eax + 0x244], ecx
lea eax, [ebp - 0x9d0]
push eax
lea eax, [ebp - 0x5ac]
push eax
lea eax, [ebp - 0x9d8]
push eax
mov eax, dword [esi + 0x6a4]
push ebx
push 0x10016d4
mov dword [ebp - 0x9d0], 0x208
push dword [edi + eax + 0x18]
mov dword [ebp - 0x9e0], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10054b6
mov dword [ebp - 0x9e0], 1
jmp 0x10054ce
lea eax, [ebp - 0x7b4]
push eax
push 0x104
lea eax, [ebp - 0x5ac]
push eax
call fcn.01002fb5
push dword [ebp - 0x9e0]
lea eax, [ebp - 0x5ac]
push eax
mov ecx, esi
call fcn.010046f2
mov ecx, dword [esi + 0x6a4]
inc dword [ebp - 0xa14]
mov dword [edi + ecx], eax
add edi, 0x248
inc dword [ebp - 0xa0c]
add dword [ebp - 0xa00], 0x248
push 0x104
lea eax, [ebp - 0x340]
push eax
push dword [ebp - 0xa0c]
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x10049fb
mov eax, dword [ebp - 0xa14]
mov dword [esi + 0x6a0], eax
cmp dword [ebp - 0x9dc], ebx
je 0x1005550
push dword [ebp - 0x9dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100663c
leave
ret
mov eax, dword [esi + 0x6a4]
add eax, edi
push eax
mov ecx, esi
call fcn.010042d8
mov eax, dword [esi + 0x6a4]
push 0x248
add eax, edi
push ebx
push eax
call fcn.01006652
add esp, 0xc
jmp 0x10054f7