Function at 0x1005cce
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
cmp dword [ebp + 8], esi
je 0x1005f11
cmp dword [ebp + 0xc], esi
je 0x1005f11
mov ebx, dword [ebp + 0x10]
cmp ebx, esi
je 0x1005f11
mov edi, dword [ebp + 0x14]
cmp edi, esi
je 0x1005f11
mov ecx, dword [edi + 4]
xor edx, edx
inc edx
cmp ecx, edx
je 0x1006e01
mov eax, dword [ebx + 0x4c]
cmp eax, esi
je 0x1005d32
cmp eax, edx
je 0x1006e18
push edi
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.01005876
mov dword [ebp + 0x10], eax
cmp eax, esi
jne 0x1005ec8
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp + 0x10], eax
cmp eax, esi
jne 0x1006e2e
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], esi
je 0x1005d7f
cmp eax, esi
je 0x1006e39
cmp eax, 0x100
jae 0x1005d88
add eax, eax
inc eax
mov dword [ebp - 0xc], eax
add eax, eax
push eax
call fcn.010026af
mov dword [ebp - 4], eax
cmp eax, esi
je 0x1006e43
push esi
push dword [ebp + 0xc]
call fcn.0100243e
mov ecx, dword [ebp - 0xc]
lea eax, [eax + ecx + 1]
mov dword [ebp - 0x18], eax
add eax, eax
push eax
call fcn.010026af
mov dword [ebp - 8], eax
cmp eax, esi
je 0x1006e43
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x14], esi
cmp dword [ebp - 0x10], esi
jbe 0x1005ec8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
add eax, eax
push eax
push esi
push dword [ebp - 4]
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp + 0x10], eax
cmp eax, esi
jne 0x1005f0c
xor ecx, ecx
inc ecx
mov dword [edi + 4], ecx
mov dword [edi + 0xc], esi
mov eax, dword [ebx + 0x4c]
test cl, al
je 0x1006e56
mov eax, dword [ebp - 0x14]
push ebx
add eax, eax
push eax
push ecx
push dword [ebp - 4]
call fcn.0100569b
mov dword [edi + 4], eax
cmp eax, esi
jne 0x1005f00
cmp dword [ebx + 0x18], esi
je 0x1006e47
push dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.010022bd
push dword [ebp - 0x18]
push 0x10011ec
push dword [ebp - 8]
call fcn.010028cb
push dword [ebp - 0x18]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.010028cb
xor eax, eax
inc eax
mov dword [edi], eax
cmp dword [edi + 4], eax
je 0x1006e6b
cmp dword [ebx + 0x18], eax
jne 0x1005eb9
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebx + 0x5c]
or eax, 0x20019
push eax
push esi
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005f0c
push edi
push ebx
push dword [ebp - 8]
push dword [ebp - 0x1c]
call fcn.01005cce
mov dword [ebp + 0x10], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.01001324
inc dword [ebp + 0x14]
mov eax, dword [ebp + 0x14]
cmp eax, dword [ebp - 0x10]
jb 0x1005dd4
lea eax, [ebp - 4]
push eax
call fcn.01002024
lea eax, [ebp - 8]
push eax
call fcn.01002024
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0x10
cmp dword [ebx + 0x54], esi
jne 0x1005d23
jmp 0x1005d4a
cmp dword [ebx + 0x54], esi
jne 0x1005d32
jmp 0x1005d4a
mov dword [edi + 0xc], 1
jmp 0x1005e43
mov dword [ebp + 0x10], esi
jmp 0x1005eb9
push 0x57
jmp 0x1006ea9
cmp dword [ebx + 0x4c], edx
jne 0x1005d23
cmp dword [ebx + 0x44], esi
je 0x1005ee4
jmp 0x1005d23
cmp ecx, edx
jne 0x1005d4a
cmp dword [ebx + 0x44], esi
je 0x1005ef2
jmp 0x1005d32
push eax
call fcn.01003151
jmp 0x1005ec8
mov eax, 0x100
jmp 0x1005d88
push 0xe
jmp 0x1006ea9
cmp dword [ebx + 0x4c], 1
jne 0x1005e43
jmp 0x1005eb9
cmp eax, esi
jne 0x1006e63
cmp dword [ebx + 0x44], esi
je 0x1005e43
mov dword [edi + 4], esi
jmp 0x1005e43
cmp dword [ebx + 0x44], esi
jne 0x1005e7d
cmp dword [ebx + 0x54], esi
jne 0x1005e7d
push dword [ebp - 8]
inc dword [edi + 0x10]
push 0x1003c64
push eax
push eax
mov dword [edi + 0xc], esi
mov dword [edi], esi
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.01004105
xor eax, eax
add esp, 0x14
inc eax
jmp 0x1005e7d
pop esi
push esi
call fcn.01003151
mov dword [ebp + 0x10], esi
jmp 0x1005ec8