Function at 0x100c95b
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x17a4
call fcn.0100e150
mov eax, dword [0x101c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov dword [ebp - 0x1788], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
shl eax, 5
push ebx
add eax, section..data
push ebx
mov dword [ebp - 0x1780], ebx
mov dword [ebp - 0x1790], eax
call edi
push eax
call fcn.0100e909
push eax
mov esi, 0x1005e8c
push esi
push 0x10052f0
push 0x272
push ebx
push 0x10052e8
push ebx
push dword [ebp - 0x1788]
push 0x1005e5c
push 0x4000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
lea eax, [ebp - 0x1798]
push eax
push dword [ebp - 0x1788]
call fcn.0100d1ee
test eax, eax
jne 0x100cd13
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x178c]
push eax
lea eax, [ebp - 0x1794]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x1798]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x1778], eax
cmp eax, ebx
jne 0x100ccc8
inc dword [ebp - 0x178c]
mov eax, dword [ebp - 0x178c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1784], eax
cmp eax, ebx
je 0x100cd13
mov dword [ebp - 0x177c], ebx
cmp dword [ebp - 0x1794], ebx
jbe 0x100cc66
mov eax, dword [ebp - 0x178c]
mov dword [ebp - 0x179c], eax
lea eax, [ebp - 0x17a4]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x179c]
push eax
push dword [ebp - 0x1784]
push dword [ebp - 0x177c]
push dword [ebp - 0x1798]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
mov dword [ebp - 0x1778], eax
push ebx
cmp eax, ebx
jne 0x100cc77
call edi
push eax
call fcn.0100e909
push eax
push esi
push 0x10052f0
push 0x293
push ebx
push 0x10052e8
push ebx
push ebx
push dword [ebp - 0x1784]
push dword [ebp - 0x177c]
push 0x1005e18
push 0x4000000
call fcn.0100b725
add esp, 0x14
push eax
call fcn.0100f2dd
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1778], eax
shl eax, 5
lea esi, [eax + section..data]
jmp 0x100cc41
cmp dword [esi + 4], ebx
jne 0x100cc2c
mov eax, dword [ebp - 0x1790]
push dword [eax + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x100cc2c
cmp dword [esi + 0x10], ebx
jne 0x100cb8c
push dword [ebp - 0x1784]
lea eax, [ebp - 0x7d4]
push 0x3e8
push eax
call fcn.0100c026
push ebx
push ebx
call edi
push eax
call fcn.0100e909
push eax
push 0x1005e8c
push 0x10052f0
push 0x2a5
push ebx
push 0x10052e8
push ebx
push dword [esi + 0x18]
lea eax, [ebp - 0x7d4]
push eax
push 0x1005de4
push 0x4000000
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
jmp 0x100cbd8
mov eax, dword [ebp - 0x1790]
push dword [eax + 0xc]
lea eax, [ebp - 0x1774]
push 0x3e8
push eax
call fcn.0100c026
push dword [ebp - 0x1784]
lea eax, [ebp - 0x1774]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0x3e8
lea eax, [ebp - 0x7d4]
push eax
push dword [esi + 0x10]
lea eax, [ebp - 0x1774]
push eax
call fcn.0100d41b
cmp eax, ebx
jl 0x100cc21
mov eax, dword [ebp - 0x177c]
inc eax
push eax
push dword [esi + 0x18]
lea eax, [ebp - 0xfa4]
push 0x3e8
push eax
call fcn.0100c0f1
add esp, 0x10
push 0x101fd90
push 0x3e8
lea eax, [ebp - 0x7d4]
push eax
lea eax, [ebp - 0xfa4]
push eax
mov eax, dword [ebp - 0x1790]
push dword [eax + 0x14]
call fcn.0100c276
cmp eax, ebx
jge 0x100cc2c
cmp byte [esi + 0x1c], bl
jne 0x100cc2c
mov dword [ebp - 0x1780], eax
inc dword [ebp - 0x1778]
mov esi, dword [ebp - 0x1778]
shl esi, 5
lea esi, [esi + section..data]
cmp dword [esi], ebx
jne 0x100cb08
mov esi, 0x1005e8c
inc dword [ebp - 0x177c]
mov eax, dword [ebp - 0x177c]
cmp eax, dword [ebp - 0x1794]
jb 0x100ca6b
push dword [ebp - 0x1784]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x100cd13
call edi
push eax
call fcn.0100e909
push eax
push esi
push 0x10052f0
push 0x2ca
push ebx
push 0x10052e8
push ebx
push dword [ebp - 0x1778]
push dword [ebp - 0x177c]
push dword [ebp - 0x1788]
push 0x1005d88
push 0x2000000
call fcn.0100b725
add esp, 0x14
push eax
call fcn.0100f2dd
mov dword [ebp - 0x1780], 0x80004005
jmp 0x100cc4e
push ebx
push ebx
call edi
push eax
call fcn.0100e909
push eax
push esi
push 0x10052f0
push 0x2d3
push ebx
push 0x10052e8
push ebx
push dword [ebp - 0x1778]
push dword [ebp - 0x1788]
push 0x1005d40
push 0x2000000
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
mov dword [ebp - 0x1780], 0x80004005
push ebx
push ebx
call edi
push eax
call fcn.0100e909
push eax
push esi
push 0x10052f0
push 0x2db
push ebx
push 0x10052e8
push ebx
push dword [ebp - 0x1780]
push 0x1005d08
push 0x4000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1780]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e138
leave
ret 8