Function at 0x1001b5f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x2f9c]
mov eax, 0x301c
call fcn.10039d10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x2f98], eax
mov eax, dword [ebp + 0x2fa4]
push ebx
push esi
push edi
mov dword [ebp - 0x74], eax
xor eax, eax
mov edi, 0xffe
xor esi, esi
push edi
mov word [ebp + 0x1f98], ax
lea eax, [ebp + 0x1f9a]
push esi
push eax
mov dword [ebp - 0x70], esi
call fcn.10039d40
xor eax, eax
push edi
mov word [ebp + 0xf98], ax
lea eax, [ebp + 0xf9a]
push esi
push eax
call fcn.10039d40
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
mov edi, 0x800
push 0x20019
mov dword [ebp - 0x6c], edi
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push esi
cmp dword [ebp + 0x2fac], esi
je 0x1001b744
push 0x10060c04
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b847
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push esi
jmp 0x1001b72e
lea eax, [ebp + 0x1f98]
push eax
push 0x10060c44
push 0x10060c84
lea eax, [ebp + 0xf98]
push edi
push eax
call fcn.10052b6b
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
lea eax, [ebp + 0xf98]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b716
mov eax, dword [ebp + 0x2fa8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x80]
push eax
push esi
push 0x10060c90
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001b716
push dword [ebp + 0x2fa8]
push dword [ebp - 0x74]
call fcn.1001b5b0
pop ecx
pop ecx
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1001b6a2
jmp 0x1001b847
push 0x10060cb0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b847
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push esi
jmp 0x1001b836
lea eax, [ebp + 0x1f98]
push eax
push 0x10060d08
push 0x10060ca4
lea eax, [ebp + 0xf98]
push edi
push eax
call fcn.10052b6b
add esp, 0x14
lea eax, [ebp - 0x7c]
push eax
push 0x20019
push esi
lea eax, [ebp + 0xf98]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001b81e
push 0xffe
mov word [ebp - 0x68], ax
lea eax, [ebp - 0x66]
push esi
push eax
call fcn.10039d40
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push 0x10060d60
push dword [ebp - 0x7c]
mov dword [ebp - 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001b81e
cmp dword [ebp - 0x6c], esi
jbe 0x1001b81e
mov eax, dword [ebp + 0x2fa8]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x80]
push eax
push esi
push 0x10060d78
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001b81e
push dword [ebp + 0x2fa8]
push dword [ebp - 0x74]
call fcn.1001b5b0
pop ecx
pop ecx
inc dword [ebp - 0x70]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp + 0x1f98]
push eax
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], edi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1001b76d
mov eax, dword [ebp - 0x74]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x1001b84d
sub eax, edx
sar eax, 1
xor ecx, ecx
cmp ecx, eax
mov ecx, dword [ebp + 0x2f98]
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
neg eax
pop ebx
call fcn.10039bc2
add ebp, 0x2f9c
leave
ret