Function at 0x105380b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x538], ecx
xor ecx, ecx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x534], ecx
mov dword [ebp - 0x52c], ecx
mov ebx, 0x2001f
cmp eax, ecx
je 0x1053860
lea edx, [ebp - 0x52c]
push edx
push ebx
push ecx
push eax
push 0x80000000
jmp 0x1053893
lea eax, [ebp - 0x534]
push eax
push ebx
push ecx
push 0x10073b8
push 0x80000000
call edi
mov esi, eax
test esi, esi
jne 0x1053957
lea eax, [ebp - 0x52c]
push eax
push ebx
push esi
push 0x1008608
push dword [ebp - 0x534]
call edi
mov esi, eax
test esi, esi
jne 0x1053957
mov dword [ebp - 0x528], 0x80
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x524], eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x520]
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x105394b
inc dword [ebp - 0x520]
lea eax, [ebp - 0x524]
push eax
push ebx
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x52c]
mov dword [ebp - 0x528], 0x80
call edi
mov esi, eax
test esi, esi
jne 0x105394b
push dword [ebp - 0x524]
mov ecx, dword [ebp - 0x538]
call fcn.0105348a
test eax, eax
jge 0x1053938
lea eax, [ebp - 0x104]
push eax
push 0x1008ddc
push 4
call fcn.01055c8a
add esp, 0xc
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10538b5
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x534], 0
je 0x105396c
push dword [ebp - 0x534]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1053996
cmp esi, 0x103
je 0x1053996
test esi, esi
jg 0x1053984
mov dword [ebp - 0x530], esi
jmp 0x1053996
mov eax, esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x538]
cmp dword [eax + 0x1c], 3
jne 0x1053b13
push 0x10085ec
push 0x10073b8
push 0x100286c
lea eax, [ebp - 0x51c]
push 0x105
push eax
call fcn.0103592d
add esp, 0x14
test eax, eax
jl 0x1053b33
and dword [ebp - 0x520], 0
lea eax, [ebp - 0x520]
push eax
push ebx
push 0
lea eax, [ebp - 0x51c]
push eax
push 0x80000000
call edi
test eax, eax
jne 0x1053b33
mov dword [ebp - 0x540], 0x80
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x528]
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x1053b07
inc dword [ebp - 0x528]
lea eax, [ebp - 0x524]
push eax
push ebx
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x520]
mov dword [ebp - 0x540], 0x80
call edi
mov esi, eax
test esi, esi
jne 0x1053b07
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x53c]
push eax
push 0
push 0x10077c4
push dword [ebp - 0x524]
inc esi
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x544], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1053af4
cmp dword [ebp - 0x53c], esi
jne 0x1053af4
mov ecx, dword [ebp - 0x538]
lea eax, [ebp - 0x310]
push eax
call fcn.0104cb7d
test eax, eax
jne 0x1053af4
push dword [ebp - 0x524]
mov ecx, dword [ebp - 0x538]
call fcn.0105348a
test eax, eax
jge 0x1053af4
lea eax, [ebp - 0x104]
push eax
push 0x1008db4
push 4
call fcn.01055c8a
add esp, 0xc
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1053a0e
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1053b33
cmp esi, 0x103
je 0x1053b33
test esi, esi
jle 0x1053b31
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x1053b3f
xor esi, esi
cmp dword [ebp - 0x530], esi
jl 0x1053b48
jmp 0x1053b4e
cmp dword [ebp - 0x530], 0
jge 0x1053b4e
mov esi, dword [ebp - 0x530]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047480
leave
ret 4