Function at 0x108d94f
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x604c
call fcn.0106f850
push ebx
push esi
xor esi, esi
push edi
push dword [ebp + 0x10]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], esi
call fcn.0109aa99
mov edi, dword [ebp + 8]
test byte [edi + 0x60], 0x80
mov ebx, eax
mov dword [ebp - 0x44], ebx
je 0x108d9a5
push ebx
call fcn.0109ab19
push eax
push esi
push edi
call fcn.0109ad82
push eax
mov dword [ebp - 0x2c], eax
call fcn.0109ab19
jmp 0x108d9a7
mov eax, ebx
cmp ebx, esi
je 0x108dfd1
cmp eax, esi
je 0x108dfd1
push eax
push 0x1011360
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x2000000
jne 0x108dec2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10114b8
push dword [ebp + 0xc]
call edi
cmp eax, esi
jne 0x108dec2
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
push esi
push 0x10114a8
push dword [ebp - 0xc]
mov dword [ebp - 0x24], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], esi
jne 0x108dec2
mov eax, dword [ebp + 8]
test byte [eax + 0x4a], 8
je 0x108da92
push 0x10116d0
push dword [ebp - 0x28]
lea eax, [ebp - 0x204c]
push 0x1011690
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x204c]
push eax
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x108da92
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
call fcn.0108d326
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1011458
push dword [ebp - 0x28]
lea eax, [ebp - 0x204c]
push 0x1011690
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x204c]
push eax
push dword [ebp + 0xc]
call edi
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x108daf1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
call fcn.0108d326
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp + 8]
test byte [eax + 0x4a], 8
pop ecx
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
je 0x108db68
push 0x10116d0
lea eax, [ebp - 0x204c]
push 0x1011658
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x14], esi
jne 0x108db68
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x204c]
push eax
push dword [ebp + 0xc]
call edi
cmp eax, esi
jne 0x108db68
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
call fcn.0108d326
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1011458
lea eax, [ebp - 0x204c]
push 0x1011658
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x14], esi
jne 0x108dbc9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x204c]
push eax
push dword [ebp + 0xc]
call edi
cmp eax, esi
mov dword [ebp - 0x14], eax
jne 0x108dbc9
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0xc]
call fcn.0108d326
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp - 0x14], esi
pop ecx
jne 0x108dec2
mov eax, dword [ebp - 0x20]
jmp 0x108deb7
mov eax, dword [ebp - 8]
cmp word [eax], si
je 0x108dec2
push 0x1011630
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x1011630
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x108dc3d
push 0x1011630
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax*2]
push eax
push dword [ebp - 0x28]
lea eax, [ebp - 0x204c]
push 0x1011690
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
jmp 0x108dc55
push dword [ebp - 8]
lea eax, [ebp - 0x204c]
push 0x101160c
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push dword [ebp - 8]
lea eax, [ebp - 0x404c]
push 0x10115f8
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x10115e8
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x108dea6
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 8]
cmp word [ecx + eax*2 - 2], 0x2a
lea eax, [ebp - 0x204c]
jne 0x108de93
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov word [ebp + eax*2 - 0x2050], si
lea eax, [ebp - 0x404c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
mov word [ebp + eax*2 - 0x4050], si
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x204c]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x108dea6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x34]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x404c]
push eax
push 0x80000002
call edi
cmp eax, esi
jne 0x108de6b
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x10], esi
je 0x108dd2a
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
lea eax, [ebp - 0x4c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x604c]
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 0x40], 0x1000
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x108de51
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x604c]
push eax
push dword [ebp - 0x34]
call edi
cmp eax, esi
je 0x108dd78
mov dword [ebp - 0x10], esi
cmp eax, esi
mov dword [ebp - 4], esi
jne 0x108ddd3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push 4
push 0x10020dc
push esi
lea eax, [ebp - 0x604c]
push eax
push dword [ebp - 0x24]
call edi
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x108de76
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push 0x10020dc
push esi
lea eax, [ebp - 0x604c]
push eax
push dword [ebp - 0x24]
call edi
cmp eax, esi
mov dword [ebp - 0x14], eax
je 0x108de76
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
push 0x10115dc
push dword [ebp - 0x10]
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x108de31
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x3c]
push eax
push esi
push 0x10115dc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x108de31
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x30]
jae 0x108de31
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0108d28f
mov dword [ebp - 0x14], esi
cmp dword [ebp - 4], esi
je 0x108de45
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x14], esi
je 0x108dd19
cmp dword [ebp - 0x10], esi
je 0x108de62
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x10], esi
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x108dea6
cmp dword [ebp - 0x18], 1
jne 0x108ddd3
push dword [ebp + 0x10]
push dword [ebp - 4]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0108d28f
jmp 0x108de34
push dword [ebp + 0x10]
push eax
lea eax, [ebp - 0x404c]
push eax
push dword [ebp + 8]
call fcn.0108d7d8
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax*2 + 2]
cmp eax, esi
mov dword [ebp - 8], eax
jne 0x108dbe4
cmp word [0x10dd2a8], si
je 0x108df52
push 0x5c
push 0x10dd2a8
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x108dee7
mov eax, 0x10dd2a8
add eax, 2
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x108defe
mov eax, 0x10dd2a8
add eax, 2
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x204c]
push 0x1011598
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push dword [ebp - 0x30]
lea eax, [ebp - 0x404c]
push 0x1011558
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
push dword [ebp + 0x10]
lea eax, [ebp - 0x204c]
push eax
lea eax, [ebp - 0x404c]
push eax
push dword [ebp + 8]
call fcn.0108d7d8
mov word [0x10dd2a8], si
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011548
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x108dfa9
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011360
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x108dfa0
push esi
push esi
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.SYSSETUP.dll_AsrRestorePlugPlayRegistryData
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x20]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x1011360
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x44]
jmp 0x108dfd8
mov esi, dword [sym.imp.msvcrt.dll_free]
push ebx
call esi
push dword [ebp - 0x2c]
call esi
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc