Function at 0x1097fb5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x458
mov eax, dword [0x10b5894]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x14]
mov edx, dword [ebp + 0x18]
push ebx
xor ebx, ebx
cmp ecx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x450], eax
mov dword [ebp - 0x440], edx
mov dword [ebp - 0x454], ecx
mov dword [ebp - 0x428], 0x80000002
mov dword [ebp - 0x42c], ebx
mov dword [ebp - 0x448], ebx
mov dword [ebp - 0x420], ebx
mov dword [ebp - 0x438], ebx
mov dword [ebp - 0x424], ebx
je 0x109801e
mov dword [ecx], ebx
cmp edx, ebx
je 0x1098024
mov dword [edx], ebx
cmp eax, ebx
jne 0x1098038
mov edi, 0x80004003
push edi
push 0x98401b5
jmp 0x1098726
push 8
push esi
push 0x1002f3c
mov dword [eax], ebx
call fcn.01097336
push 6
push esi
push 0x101cec4
mov dword [ebp - 0x430], eax
call fcn.01097336
push 5
push esi
push 0x101ceb8
mov dword [ebp - 0x434], eax
call fcn.01097336
cmp dword [ebp - 0x430], ebx
mov dword [ebp - 0x418], eax
jne 0x1098083
cmp dword [ebp - 0x434], ebx
je 0x1098093
test byte [ebp + 0x10], 4
je 0x1098093
mov dword [ebp - 0x428], 0x80000001
cmp edi, ebx
je 0x10980f4
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x438]
push eax
push edi
call fcn.0107e9df
mov edi, eax
cmp edi, ebx
je 0x10980bc
push edi
push 0x99701b5
jmp 0x1098726
cmp dword [ebp - 0x444], ebx
jne 0x10980f4
lea eax, [ebp - 0x428]
push eax
push dword [ebp - 0x428]
push dword [ebp - 0x438]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp edi, ebx
je 0x10980f4
push edi
push 0x99c01b5
push dword [ebp - 0x438]
jmp 0x1098539
cmp dword [ebp - 0x430], ebx
jne 0x109818f
cmp dword [ebp - 0x434], ebx
jne 0x109818f
cmp dword [ebp - 0x418], ebx
jne 0x109818f
lea eax, [ebp - 0x42c]
push eax
mov eax, dword [ebp + 0x10]
and al, 2
neg al
mov ebx, 0x1011350
sbb eax, eax
and eax, 0xd0026
add eax, 0x20019
push eax
push 0
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, 2
jne 0x1098180
test byte [ebp + 0x10], 8
je 0x1098184
push eax
push 0x9aa01b5
call fcn.0107ae44
lea eax, [ebp - 0x42c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test edi, edi
je 0x109818f
push edi
push 0x9ac01b5
jmp 0x1098726
test edi, edi
je 0x109818f
push edi
push 0x9ae01b5
jmp 0x1098726
push 0x5c
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x444], eax
mov ebx, 0x104
mov edi, 0x100225c
jne 0x109823f
push 2
push esi
push 0x1003a44
call fcn.01097336
test eax, eax
jne 0x109823f
push 6
push esi
push 0x101cea8
call fcn.01097336
test eax, eax
jne 0x109823f
push 4
push esi
push 0x101ce9c
call fcn.01097336
test eax, eax
jne 0x109823f
push 7
push esi
push 0x101ce8c
call fcn.01097336
test eax, eax
jne 0x109823f
push 6
push esi
push edi
call fcn.01097336
test eax, eax
jne 0x109823f
cmp dword [ebp - 0x430], eax
jne 0x1098249
cmp dword [ebp - 0x434], eax
jne 0x1098271
cmp dword [ebp - 0x418], eax
jne 0x1098283
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x42c], eax
mov word [ebp - 0x20c], ax
jmp 0x10984d5
xor eax, eax
cmp dword [ebp - 0x430], eax
je 0x1098269
add esi, 0x10
push 0x100f700
push ebx
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x418], esi
call fcn.01028f74
jmp 0x10984d5
cmp dword [ebp - 0x434], eax
je 0x109827b
add esi, 0xc
push 0x100f6a0
jmp 0x1098251
cmp dword [ebp - 0x418], eax
je 0x109828d
add esi, 0xa
push 0x101cdd0
jmp 0x1098251
push 6
push esi
push edi
mov word [ebp - 0x20c], ax
call fcn.01097336
test eax, eax
jne 0x1098306
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x43c]
push eax
push 0
push 0x100be4c
push dword [ebp - 0x42c]
mov dword [ebp - 0x41c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
je 0x10982e4
push edi
push 0x9e701b5
jmp 0x1098465
cmp dword [ebp - 0x43c], 1
je 0x1098306
cmp dword [ebp - 0x43c], 7
je 0x1098306
mov edi, 0x8007000d
push edi
push 0x9ec01b5
jmp 0x1098465
push 2
push esi
push 0x1003a44
call fcn.01097336
test eax, eax
je 0x1098325
add esi, 4
mov dword [ebp - 0x418], esi
jmp 0x10983dc
push 6
push esi
push 0x101cea8
call fcn.01097336
test eax, eax
je 0x1098342
mov dword [ebp - 0x424], 0x1017320
jmp 0x10983a5
push 4
push esi
push 0x101ce9c
call fcn.01097336
test eax, eax
je 0x1098362
mov dword [ebp - 0x424], 0x101cdb4
add esi, 8
jmp 0x10983a8
push 7
push esi
push 0x101ce8c
call fcn.01097336
test eax, eax
je 0x1098390
push 0x101b798
push ebx
lea eax, [ebp - 0x20c]
add esi, 0xe
push eax
mov dword [ebp - 0x418], esi
call fcn.01028f74
jmp 0x10983dc
push 6
push esi
push 0x100225c
call fcn.01097336
test eax, eax
je 0x109871b
add esi, 0xc
cmp dword [ebp - 0x424], 0
mov dword [ebp - 0x418], esi
je 0x10983dc
push 0x1008080
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0102920e
push dword [ebp - 0x424]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0102920e
cmp dword [ebp - 0x440], 0
je 0x10984b9
lea eax, [ebp - 0x448]
push eax
push 0x20019
xor esi, esi
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x42c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
je 0x109841c
push edi
push 0xa2c01b5
jmp 0x1098532
cmp dword [ebp - 0x424], esi
je 0x10984d5
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x43c]
push eax
push esi
push 0x100be4c
push dword [ebp - 0x448]
mov dword [ebp - 0x41c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
je 0x109846f
push edi
push 0xa3801b5
push 0x100be4c
jmp 0x1098539
cmp dword [ebp - 0x43c], 1
je 0x1098491
cmp dword [ebp - 0x43c], 7
je 0x1098491
mov edi, 0x8007000d
push edi
push 0xa3d01b5
jmp 0x1098532
push 0x1008080
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0102920e
lea eax, [ebp - 0x414]
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.0102920e
jmp 0x10984d7
cmp dword [ebp - 0x444], 0
je 0x10984d5
push dword [ebp - 0x444]
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.0102920e
xor esi, esi
cmp dword [ebp - 0x420], esi
jne 0x1098543
mov eax, dword [ebp - 0x42c]
cmp eax, esi
jne 0x10984ef
mov eax, dword [ebp - 0x428]
lea ecx, [ebp - 0x458]
push ecx
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp + 0x10]
and cl, 2
neg cl
push esi
sbb ecx, ecx
and ecx, 0xd0026
add ecx, 0x20019
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
je 0x1098543
push edi
push 0xa6201b5
lea eax, [ebp - 0x20c]
push eax
call fcn.0107ae7f
jmp 0x109872b
mov eax, dword [ebp - 0x418]
cmp word [eax], 0x5c
jne 0x1098556
add dword [ebp - 0x418], 2
cmp dword [ebp - 0x440], esi
je 0x10985e2
mov eax, dword [ebp - 0x418]
cmp word [eax], si
je 0x10985e2
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x424], esi
push esi
jmp 0x10985c2
push dword [ebp - 0x418]
lea eax, [ebp - 0x414]
push eax
call fcn.0107d890
test eax, eax
je 0x10985d6
inc dword [ebp - 0x424]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x424]
push dword [ebp - 0x420]
mov dword [ebp - 0x44c], ebx
call edi
test eax, eax
je 0x109858e
jmp 0x10985e2
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10985eb
sub eax, edx
sar eax, 1
cmp dword [ebp - 0x430], esi
lea eax, [eax + eax + 2]
mov dword [ebp - 0x41c], eax
jne 0x1098620
cmp dword [ebp - 0x434], esi
jne 0x1098620
test byte [ebp + 0x10], 1
je 0x1098620
add dword [ebp - 0x41c], 0x70
push dword [ebp - 0x41c]
mov ebx, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push esi
call ebx
cmp eax, esi
mov edi, dword [ebp - 0x450]
mov dword [edi], eax
jne 0x109864b
mov edi, 0x8007000e
push edi
push 0xa8901b5
jmp 0x1098726
cmp dword [ebp - 0x430], esi
mov word [eax], si
jne 0x1098679
cmp dword [ebp - 0x434], esi
jne 0x1098679
test byte [ebp + 0x10], 1
je 0x1098679
mov eax, dword [ebp - 0x41c]
push 0x101aba8
shr eax, 1
push eax
push dword [edi]
call fcn.01028f74
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x41c]
shr eax, 1
push eax
push dword [edi]
call fcn.0102920e
cmp word [ebp - 0x20c], si
jne 0x10986b0
mov eax, dword [ebp - 0x41c]
mov ecx, dword [edi]
shr eax, 1
lea eax, [ecx + eax*2 - 4]
cmp word [eax], 0x5c
jne 0x10986b0
mov word [eax], si
cmp dword [ebp - 0x440], esi
je 0x10986ff
mov eax, dword [ebp - 0x418]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10986c1
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
lea eax, [edi + edi]
push eax
push esi
call ebx
cmp eax, esi
mov ecx, dword [ebp - 0x440]
mov dword [ecx], eax
jne 0x10986f2
mov edi, 0x8007000e
push edi
push 0xaa001b5
jmp 0x1098726
push dword [ebp - 0x418]
push edi
push eax
call fcn.01028f74
mov eax, dword [ebp - 0x454]
cmp eax, esi
je 0x1098717
mov ecx, dword [ebp - 0x420]
mov dword [eax], ecx
mov dword [ebp - 0x420], esi
xor edi, edi
jmp 0x109872b
mov edi, 0x80070057
push edi
push 0xa1a01b5
call fcn.0107ae44
cmp dword [ebp - 0x428], 0x80000002
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1098751
cmp dword [ebp - 0x428], 0x80000001
je 0x1098751
push dword [ebp - 0x428]
call esi
xor ebx, ebx
cmp dword [ebp - 0x42c], ebx
je 0x1098763
push dword [ebp - 0x42c]
call esi
cmp dword [ebp - 0x448], ebx
je 0x1098773
push dword [ebp - 0x448]
call esi
cmp dword [ebp - 0x420], ebx
je 0x1098783
push dword [ebp - 0x420]
call esi
cmp dword [ebp - 0x438], ebx
mov esi, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1098799
push dword [ebp - 0x438]
call esi
cmp edi, ebx
je 0x10987c9
mov ebx, dword [ebp - 0x450]
test ebx, ebx
je 0x10987b3
mov eax, dword [ebx]
test eax, eax
je 0x10987b3
push eax
call esi
and dword [ebx], 0
mov ebx, dword [ebp - 0x440]
test ebx, ebx
je 0x10987c9
mov eax, dword [ebx]
test eax, eax
je 0x10987c9
push eax
call esi
and dword [ebx], 0
push edi
call fcn.010a47cf
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01068363
leave
ret 0x18