Function at 0x1002e8a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006ff42
mov eax, dword fs:[0]
push eax
sub esp, 0x44c
mov eax, dword [0x100f38c4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x100e8014]
mov ecx, str.ProfileName
shr ecx, 0x10
mov dword [ebp - 0x458], edi
mov dword [ebp - 0x454], ebx
mov dword [ebp - 0x42c], eax
test ecx, ecx
jne 0x1002e90d
mov edx, str.ProfileName
movzx eax, dx
push eax
lea ecx, [ebp - 0x42c]
call fcn.100015c0
jmp 0x1002e94d
push str.ProfileName
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x1002e94d
push esi
lea ecx, [ebp - 0x42c]
call fcn.10001200
test eax, eax
je 0x1002e94d
lea eax, [esi + esi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x1002e94d
mov edx, dword [ebp - 0x42c]
push eax
push str.ProfileName
push edx
call fcn.100558b0
add esp, 0xc
mov eax, dword [0x100e8014]
mov ecx, str.SoftwareConexantSAEQ1
shr ecx, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 0x424], eax
test ecx, ecx
jne 0x1002e981
mov edx, str.SoftwareConexantSAEQ1
movzx eax, dx
push eax
lea ecx, [ebp - 0x424]
call fcn.100015c0
jmp 0x1002e9c1
push str.SoftwareConexantSAEQ1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
test esi, esi
je 0x1002e9c1
push esi
lea ecx, [ebp - 0x424]
call fcn.10001200
test eax, eax
je 0x1002e9c1
lea eax, [esi + esi]
lea ecx, [eax + 2]
cmp ecx, eax
jb 0x1002e9c1
mov edx, dword [ebp - 0x424]
push eax
push str.SoftwareConexantSAEQ1
push edx
call fcn.100558b0
add esp, 0xc
mov esi, dword [0x100e8014]
mov dword [ebp - 0x438], 0
mov dword [ebp - 0x444], esi
movzx eax, word [ebx]
mov edx, dword [ebp - 0x424]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 0x430]
push ecx
push 0x20019
push 0
push edx
push edi
mov byte [ebp - 4], 2
mov dword [ebp - 0x43c], eax
call ebx
test eax, eax
je 0x1002ea26
mov ecx, dword [ebp - 0x424]
lea eax, [ebp - 0x430]
push eax
push 0x20119
push 0
push ecx
push edi
call ebx
test eax, eax
jne 0x1002ec73
mov eax, dword [ebp - 0x430]
push 0x104
lea edx, [ebp - 0x218]
push edx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1002ec56
mov edi, dword [0x100e8014]
inc dword [ebp - 0x438]
push 0x10078b70
mov dword [ebp - 0x428], edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
test esi, esi
je 0x1002ead4
push esi
lea ecx, [ebp - 0x428]
call fcn.10001200
test eax, eax
je 0x1002eace
lea eax, [esi + 1]
mov esi, dword [ebp - 0x428]
test eax, eax
jne 0x1002ea8d
test esi, esi
jne 0x1002eaab
push eax
push esi
push 0xffffffffffffffff
push 0x10078b70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jle 0x1002eaab
xor ecx, ecx
mov word [esi + eax*2 - 2], cx
lea ecx, [ebp - 0x428]
call fcn.10001480
mov edi, dword [ebp - 0x428]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
mov dword [edi - 8], eax
mov word [edi + eax*2], dx
jmp 0x1002ead4
mov edi, dword [ebp - 0x428]
lea eax, [ebp - 0x428]
push eax
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x448]
push edx
mov byte [ebp - 4], 3
call fcn.1001fa00
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x440]
push edx
mov byte [ebp - 4], 4
call fcn.1001fa70
push eax
lea ecx, [ebp - 0x444]
mov byte [ebp - 4], 5
call fcn.1001e0e0
mov eax, dword [ebp - 0x440]
lea ecx, [eax - 0xc]
cmp ecx, dword [0x100e8010]
je 0x1002eb4b
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1002eb4b
mov eax, dword [ebp - 0x440]
add eax, 0xfffffff4
push eax
call fcn.10055c11
add esp, 4
mov eax, dword [ebp - 0x448]
lea edx, [eax - 0xc]
cmp edx, dword [0x100e8010]
je 0x1002eb7c
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1002eb7c
mov eax, dword [ebp - 0x448]
add eax, 0xfffffff4
push eax
call fcn.10055c11
add esp, 4
lea eax, [edi - 0xc]
mov byte [ebp - 4], 2
cmp eax, dword [0x100e8010]
je 0x1002eba2
lea esi, [edi - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x1002eba2
push esi
call fcn.10055c11
add esp, 4
mov esi, dword [ebp - 0x444]
mov edi, dword [ebp - 0x458]
lea ecx, [ebp - 0x434]
push ecx
push 1
push 0
push esi
push edi
call ebx
test eax, eax
je 0x1002ebd7
lea edx, [ebp - 0x434]
push edx
push 0x101
push 0
push esi
push edi
call ebx
test eax, eax
jne 0x1002ec2e
lea eax, [ebp - 0x450]
push eax
mov eax, dword [ebp - 0x42c]
lea ecx, [ebp - 0x420]
push ecx
mov ecx, dword [ebp - 0x434]
lea edx, [ebp - 0x44c]
push edx
push 0
push eax
mov edi, 1
push ecx
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x450], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ec21
add dword [ebp - 0x43c], edi
mov edx, dword [ebp - 0x434]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x438]
mov edx, dword [ebp - 0x430]
push 0x104
lea eax, [ebp - 0x218]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x1002ea49
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov cx, word [ebp - 0x43c]
mov edx, dword [ebp - 0x454]
mov word [edx], cx
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi - 0xc]
cmp eax, dword [0x100e8010]
je 0x1002ec97
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x1002ec97
push esi
call fcn.10055c11
add esp, 4
mov esi, dword [ebp - 0x424]
lea ecx, [esi - 0xc]
cmp ecx, dword [0x100e8010]
je 0x1002ecbb
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x1002ecbb
push esi
call fcn.10055c11
add esp, 4
mov esi, dword [ebp - 0x42c]
lea edx, [esi - 0xc]
cmp edx, dword [0x100e8010]
je 0x1002ecdf
add esi, 0xfffffff4
push esi
call edi
test eax, eax
jg 0x1002ecdf
push esi
call fcn.10055c11
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10055898
mov esp, ebp
pop ebp
ret 8