Function at 0x105e99c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push dword [0x107fde4]
mov edi, 0x95
push 0x100bce4
xor esi, esi
xor ebx, ebx
lea eax, [ebp - 0x25c]
push edi
inc ebx
push eax
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x270], esi
call fcn.01034d76
add esp, 0x14
test eax, eax
jge 0x105ea00
xor eax, eax
jmp 0x105ec11
lea eax, [ebp - 0x270]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x25c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105ec04
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push esi
push 0x100bccc
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
jne 0x105eac0
cmp dword [ebp - 0x268], ebx
jne 0x105eac0
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01034c79
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x105ea93
and word [eax], 0
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.01069f4b
test eax, eax
je 0x105eaaf
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x105eac0
inc ebx
inc ebx
jmp 0x105ea70
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0x100bcbc
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105eb55
cmp dword [ebp - 0x268], 1
jne 0x105eb55
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01034c79
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x105eb28
and word [eax], 0
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.0106a5c7
test eax, eax
je 0x105eb44
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x105eb55
inc ebx
inc ebx
jmp 0x105eb05
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0x100bca8
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105ebea
cmp dword [ebp - 0x268], 1
jne 0x105ebea
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01034c79
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
test eax, eax
pop ecx
pop ecx
je 0x105ebbd
and word [eax], 0
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.0106a5ac
test eax, eax
je 0x105ebd9
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x105ebea
inc ebx
inc ebx
jmp 0x105eb9a
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x260]
jne 0x105ec09
push 2
pop eax
jmp 0x105ec11
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 4