Function at 0x102001a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x105
mov dword [ebp - 0x628], edi
mov dword [ebp - 0x618], 0
mov dword [ebp - 0x624], 0
mov dword [ebp - 0x620], 0
call fcn.10450898
add esp, 4
mov dword [ebp - 0x61c], eax
test eax, eax
je 0x102001f7
mov byte [eax], 0
inc dword [0x11d0d904]
cmp byte [0x11d213c0], 0
je 0x1020042d
push 0x5c
push edi
call fcn.10425990
add esp, 8
lea edx, [ebp - 0x60c]
test eax, eax
je 0x10200233
lea ecx, [eax + 1]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10200224
jmp 0x10200244
mov ecx, edi
sub edx, edi
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x10200237
lea eax, [ebp - 0x60c]
push 0x2e
push eax
call fcn.10425990
add esp, 8
test eax, eax
je 0x1020026b
push 0x1046adb0
push eax
call fcn.1043ab70
add esp, 8
test eax, eax
je 0x1020028b
lea ecx, [ebp - 0x60c]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x10200272
mov eax, dword [0x1046adb0]
mov dword [ecx], eax
mov al, byte [0x1046adb4]
mov byte [ecx + 4], al
mov ecx, 0x1046dec0
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10200293
sub ecx, edx
test edi, edi
je 0x102002f3
mov edx, edi
lea esi, [edx + 1]
mov al, byte [edx]
inc edx
test al, al
jne 0x102002a5
sub edx, esi
cmp edx, ecx
jl 0x102002f3
mov bl, byte [edi + ecx]
lea esi, [edi + ecx]
mov ecx, 0x1046dec0
mov byte [esi], al
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x102002c2
sub ecx, edx
push ecx
push 0x1046dec0
push edi
call fcn.1043a494
add esp, 0xc
mov byte [esi], bl
test eax, eax
jne 0x102002f3
lea eax, [ebp - 0x60c]
push eax
call fcn.100f8ea0
mov bl, al
jmp 0x102005a2
push 0
push edi
lea ecx, [ebp - 0x624]
call fcn.101ffd90
mov bl, al
test bl, bl
je 0x102005a2
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop dword [eax]
nop word [eax + eax]
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x610], 0x100
test eax, eax
je 0x10200579
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x610]
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10200579
xor bl, bl
cmp byte [0x11d213c0], bl
je 0x102003a2
cmp dword [ebp - 0x624], eax
je 0x102003a2
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.100f6950
test al, al
je 0x10200420
push dword [ebp - 0x614]
call fcn.100f8a10
mov bl, al
jmp 0x10200420
cmp dword [ebp - 0x620], 0
je 0x10200420
mov eax, dword [ebp - 0x61c]
xor edi, edi
push 0x1046de20
mov dword [ebp - 0x610], eax
lea ebx, [edi + 5]
call esi
mov esi, eax
call fcn.101fedc0
test al, al
je 0x10200415
test esi, esi
jne 0x102003e9
call fcn.101ff770
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1046de20
call eax
mov esi, eax
test esi, esi
je 0x102003f7
push 0x1046de30
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10200415
call edi
test eax, eax
je 0x10200415
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x10c]
push ecx
push dword [ebp - 0x610]
call eax
mov ebx, eax
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test ebx, ebx
sete bl
test bl, bl
jne 0x10200320
jmp 0x10200579
push 0
push edi
lea ecx, [ebp - 0x624]
call fcn.101ffd90
mov bl, al
test bl, bl
je 0x102005a2
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop dword [eax + eax]
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x614], 0x100
test eax, eax
je 0x10200579
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x614]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10200579
xor bl, bl
cmp byte [0x11d213c0], bl
je 0x102004f3
cmp dword [ebp - 0x624], eax
je 0x102004f3
mov dword [ebp - 0x610], eax
mov edi, 0x11c247f0
xor esi, esi
nop
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1043ab70
add esp, 8
test eax, eax
je 0x102004dd
inc dword [ebp - 0x610]
add esi, 0x6c
add edi, 0x6c
cmp esi, 0x4b84
jb 0x102004b0
jmp 0x1020056b
imul eax, dword [ebp - 0x610], 0x6c
push dword [eax + 0x11c24854]
call fcn.100f8a10
mov bl, al
jmp 0x1020056b
cmp dword [ebp - 0x620], 0
je 0x10200571
mov eax, dword [ebp - 0x61c]
xor edi, edi
push 0x1046de20
mov dword [ebp - 0x614], eax
lea ebx, [edi + 5]
call esi
mov esi, eax
call fcn.101fedc0
test al, al
je 0x10200566
test esi, esi
jne 0x1020053a
call fcn.101ff770
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x1046de20
call eax
mov esi, eax
test esi, esi
je 0x10200548
push 0x1046de30
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10200566
call edi
test eax, eax
je 0x10200566
mov eax, dword [eax + 0xc]
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0x614]
call eax
mov ebx, eax
test ebx, ebx
sete bl
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test bl, bl
jne 0x10200450
lea ecx, [ebp - 0x624]
mov dword [ebp - 0x624], 0
call fcn.102000a0
test bl, bl
je 0x102005a2
mov ecx, dword [ebp - 0x628]
call fcn.101ff8e0
test eax, eax
sete bl
cmp dword [ebp - 0x620], 0
je 0x102005b6
lea ecx, [ebp - 0x624]
call fcn.102000a0
mov eax, dword [0x11d0d904]
dec eax
mov dword [0x11d0d904], eax
test eax, eax
jg 0x1020063f
mov eax, dword [0x11d0d920]
mov dword [0x11d0d920], 0
test eax, eax
je 0x102005e1
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d918]
mov dword [0x11d0d918], 0
test eax, eax
je 0x102005fd
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d91c]
mov dword [0x11d0d91c], 0
test eax, eax
je 0x10200619
push eax
call fcn.10450877
add esp, 4
mov eax, dword [0x11d0d914]
mov dword [0x11d0d914], 0
test eax, eax
je 0x10200635
push eax
call fcn.10450877
add esp, 4
mov dword [0x11d0d904], 0
mov eax, dword [ebp - 0x61c]
test eax, eax
je 0x10200652
push eax
call fcn.10450877
add esp, 4
mov esi, dword [ebp - 0x618]
test esi, esi
je 0x1020066e
mov ecx, esi
call fcn.101ffa20
push 0x10
push esi
call fcn.1045088a
add esp, 8
mov ecx, dword [ebp - 8]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1045066c
mov esp, ebp
pop ebp
ret 4