Function at 0x60127fd0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x60149fdc
push eax
mov dword fs:[0], esp
sub esp, 0x344
push ebx
push esi
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
jne 0x6012801c
call fcn.601180b0
pop esi
pop ebx
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
add esp, 0x350
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ConvertStringSidToSidA
push esi
call edi
cmp eax, ebx
jne 0x6012804c
call fcn.601180b0
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
add esp, 0x350
ret
push str.LookupAccountSidA
push esi
mov dword [esp + 0x34], eax
call edi
cmp eax, ebx
mov dword [esp + 0x34], eax
je 0x6012802f
mov dword [esp + 0x10], ebx
push 0x20019
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList_
push SysStringLen
lea ecx, [esp + 0x1c]
mov dword [esp + 0x364], ebx
call fcn.60108dc0
test eax, eax
je 0x601280b7
call fcn.601180b0
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x6012809d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebx
mov ecx, dword [esp + 0x344]
mov dword fs:[0], ecx
add esp, 0x350
ret
mov edi, dword [esp + 0x360]
mov esi, dword [sym.imp.MSVCR71.dll__mbsstr]
push ebp
xor ebp, ebp
lea eax, [esp + 0x40]
push eax
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x160]
push edx
push ebp
push eax
mov dword [esp + 0x44], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x60128263
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x150]
push edx
call dword [esp + 0x38]
test eax, eax
je 0x6012822a
mov eax, 0x104
mov dword [esp + 0x3c], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x258]
push edx
mov edx, dword [esp + 0x2c]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x58]
push ecx
push edx
push ebx
call dword [esp + 0x54]
test eax, eax
je 0x6012821f
cmp dword [esp + 0x34], 1
jne 0x6012821f
push edi
lea ecx, [esp + 0x14]
call fcn.601045b0
lea ecx, [esp + 0x10]
mov byte [esp + 0x35c], 1
call fcn.6010a420
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x20]
call fcn.601045b0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x35c], 2
call fcn.6010a420
lea ecx, [esp + 0x250]
push ecx
lea ecx, [esp + 0x1c]
call fcn.601045b0
lea ecx, [esp + 0x18]
mov byte [esp + 0x35c], 3
call fcn.6010a420
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x601281fd
mov ecx, dword [esp + 0x10]
cmp dword [ecx - 0xc], ebx
jl 0x601281fd
push eax
push ecx
call esi
add esp, 8
cmp eax, ebx
je 0x601281fd
mov ecx, dword [esp + 0x10]
sub eax, ecx
mov dword [esp + 0x2c], eax
js 0x601281fd
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x601281fd
cmp dword [ecx - 0xc], ebx
jl 0x601281fd
push eax
push ecx
call esi
add esp, 8
cmp eax, ebx
je 0x601281fd
sub eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
jns 0x60128230
lea ecx, [esp + 0x18]
call fcn.601042d0
lea ecx, [esp + 0x1c]
call fcn.601042d0
lea ecx, [esp + 0x10]
mov byte [esp + 0x35c], bl
call fcn.601042d0
mov edx, dword [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc ebp
jmp 0x601280c7
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [esp + 0x18]
call fcn.601042d0
lea ecx, [esp + 0x1c]
call fcn.601042d0
lea ecx, [esp + 0x10]
call fcn.601042d0
lea ecx, [esp + 0x14]
call fcn.60109020
xor eax, eax
jmp 0x60128271
lea ecx, [esp + 0x14]
call fcn.60109020
mov eax, 1
mov ecx, dword [esp + 0x354]
pop ebp
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x350
ret