Function at 0x100c5c28
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 8
mov eax, 0x101c9fe7
call fcn.101947a2
mov edi, ecx
mov dword [ebp - 0x14], edi
mov edx, dword [ebp + 8]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ecx
mov eax, dword [edx + 0x14]
cmp eax, 8
ja case.0x100c5a4e.4
jmp dword [eax*4 + 0x100c5c28]
mov edi, dword [edi]
mov esi, dword [edi + 0xdc]
mov ecx, esi
call dword [0x101d4b00]
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call esi
mov esi, dword [edi + 0xd0]
mov ecx, eax
mov eax, dword [ebp + 8]
add eax, 0x28
push eax
push ecx
mov ecx, esi
call dword [0x101d4b00]
mov ecx, ebx
call esi
mov eax, dword [ebx]
mov esi, dword [eax + 0x104]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, ebx
call esi
test eax, eax
jne 0x100c5c13
call fcn.1003f6c4
xor ebx, ebx
push ebx
push ebx
mov edi, dword [eax + 4]
push ebx
push 0xe100
mov eax, dword [edi]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
mov esi, dword [ebp - 0x14]
test eax, eax
jne 0x100c5ad5
mov ecx, esi
call fcn.100c54e5
xor ecx, ecx
cmp dword [esi + 0x20], ebx
setne cl
jmp case.0x100c5a4e.4
mov eax, dword [edi]
push dword [edx + 0x18]
mov esi, dword [eax + 0xa4]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
neg eax
sbb ecx, ecx
neg ecx
jmp case.0x100c5a4e.4
mov eax, dword [edi]
xor ebx, ebx
mov dword [edi + 0x4c], ebx
push dword [edx + 0x18]
mov esi, dword [eax + 0xa4]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
test eax, eax
je 0x100c5b52
mov eax, dword [ebp + 8]
mov dword [edi + 0x94], eax
mov eax, dword [edi + 0x20]
test eax, eax
je 0x100c5c20
push ebx
push 0xe108
push 0x111
push dword [eax + 0x20]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [edi + 0x94], ebx
mov ecx, ebx
jmp case.0x100c5a4e.4
mov eax, dword [edi + 0x4c]
and dword [edi + 0x4c], 0
mov dword [edi + 0x94], eax
jmp case.0x100c5a4e.4
mov eax, dword [edi]
mov esi, dword [eax + 0x98]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
xor ebx, ebx
mov ecx, ebx
mov dword [ebp - 0x10], ecx
cmp dword [edi + 0x94], ebx
jne case.0x100c5a4e.4
push 0x2c
call fcn.10031509
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
jmp 0x100c5bf9
mov eax, dword [edi]
mov esi, dword [eax + 0x9c]
mov ecx, esi
call dword [0x101d4b00]
mov ecx, edi
call esi
mov ecx, eax
xor ebx, ebx
mov eax, dword [ebp + 8]
cmp dword [eax + 8], ebx
jne 0x100c5bda
push 0xffffffffffffffff
push ebx
test ecx, ecx
je 0x100c5bd0
push 0xf10b
jmp 0x100c5bd5
push 0xf10c
call fcn.1003eef4
mov ecx, ebx
mov dword [ebp - 0x10], ecx
cmp dword [edi + 0x94], ebx
jne case.0x100c5a4e.4
push 0x2c
call fcn.10031509
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x100c5c06
mov ecx, eax
call fcn.100c2bda
mov ebx, eax
mov dword [edi + 0x94], ebx
mov dword [ebx + 0x14], 7
mov ecx, dword [ebp - 0x10]
mov eax, ecx
call fcn.10194770
ret 4
call fcn.1003decd
nop dword [eax]
movsb byte es:[edi], byte [esi]
pop edx
or al, 0x10
loop 0x100c5c88
or al, 0x10
add al, 0x5b
or al, 16
add al, 0x5b
or al, 16
push ss
pop esp
or al, 0x10
pop ecx
pop ebx
or al, 0x10
imul ebx, dword [ebx + 0xc], 0x10
mov byte [1427115099], al
pop edx
or al, 0x10
push 0x228
mov eax, 0x101ca02a
call fcn.101947d5
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x234], ebx
call fcn.100c59db
mov dword [ebp - 0x22c], eax
test eax, eax
je 0x100c5cb1
lea eax, [ebp - 0x22c]
mov ecx, edi
push eax
call fcn.100c59fc
mov ebx, eax
test ebx, ebx
je 0x100c5ca6
mov ecx, dword [ebx]
xor eax, eax
push eax
push eax
push 0xfffffffffffffffc
mov esi, dword [ecx + 0xc]
mov ecx, esi
push eax
call dword [0x101d4b00]
mov ecx, ebx
call esi
cmp dword [ebp - 0x22c], 0
jne 0x100c5c7a
xor ebx, ebx
cmp dword [edi + 0x58], ebx
je 0x100c5dd6
cmp dword [edi + 0x6c], ebx
je 0x100c5ddf
push str.Software_
lea ecx, [ebp - 0x220]
call fcn.10027f20
mov esi, dword [edi + 0x58]
mov dword [ebp - 4], ebx
test esi, esi
jne 0x100c5ce1
mov eax, ebx
jmp 0x100c5ce8
push esi
call fcn.101a4e8f
pop ecx
push eax
push esi
lea ecx, [ebp - 0x220]
call fcn.1003230b
mov esi, dword [edi + 0x6c]
lea eax, [ebp - 0x220]
push 0x101d5908
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.10040395
push esi
push eax
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 1
push eax
call fcn.10040395
add esp, 0x18
mov ecx, dword [ebp - 0x230]
mov byte [ebp - 4], 3
lea ecx, [ecx - 0x10]
call fcn.100023f0
push ebx
lea eax, [ebp - 0x228]
mov esi, SysReAllocString
push eax
push esi
call fcn.100c583a
lea eax, [ebp - 0x224]
push eax
push 8
push ebx
push dword [ebp - 0x220]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100c5d9f
push 0x104
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x100c5d93
push ebx
lea eax, [ebp - 0x220]
push eax
push esi
call fcn.100c583a
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x228]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.100023f0
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.100023f0
xor eax, eax
inc eax
call fcn.10194784
ret
call fcn.1003decd
int3