Function at 0x1047ede
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x85c
mov eax, dword [0x1079e94]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x83c], eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x85c], eax
lea eax, [ebp - 0x414]
mov dword [ebp - 0x858], eax
push ebx
lea eax, [ebp - 0x61c]
push esi
mov dword [ebp - 0x854], eax
push edi
lea eax, [ebp - 0x824]
mov dword [ebp - 0x850], eax
lea eax, [ebp - 0x82c]
push eax
push 0x100d820
xor edi, edi
push Ordinal_6
mov dword [ebp - 0x82c], edi
mov dword [ebp - 0x84c], 0x100d804
mov dword [ebp - 0x848], 0x100d7e4
mov dword [ebp - 0x844], 0x100d7c0
mov dword [ebp - 0x840], 0x100d7a0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov esi, eax
cmp esi, edi
je 0x1047f8e
push esi
push 0x930013c
jmp 0x104815b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x838]
push eax
push dword [ebp + edi - 0x85c]
mov dword [ebp - 0x838], 0x208
push 0
push 0
push dword [ebp + edi - 0x84c]
push dword [ebp - 0x82c]
call ebx
mov esi, eax
test esi, esi
jne 0x104802f
add edi, 4
cmp edi, 0x10
jb 0x1047f94
push dword [ebp - 0x834]
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
call esi
mov edi, 0x100d794
push edi
mov dword [ebp - 0x830], eax
call esi
mov ecx, dword [ebp - 0x830]
add ecx, eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x830], ecx
call esi
mov ecx, dword [ebp - 0x830]
lea eax, [ecx + eax + 1]
add esp, 0xc
cmp eax, 0x104
jb 0x104803a
mov esi, 0x8007006f
push esi
push 0x944013c
push dword [ebp - 0x834]
call fcn.0105364b
jmp 0x1048160
push esi
push 0x93c013c
jmp 0x104815b
mov esi, dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x20c]
push 0x1006b9c
push eax
call esi
push dword [ebp - 0x834]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push edi
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x838]
push eax
lea eax, [ebp - 0x828]
push eax
xor edi, edi
push edi
push edi
mov esi, 0x10095f8
push esi
push dword [ebp - 0x82c]
mov dword [ebp - 0x838], 4
call ebx
cmp eax, edi
je 0x10480ae
push eax
push 0x954013c
push esi
call fcn.0105364b
mov dword [ebp - 0x828], 0xb8
and dword [ebp - 0x828], 0xfffffffe
lea eax, [ebp - 0x20c]
push eax
push 0x1b9
call fcn.01052a94
push eax
call fcn.0105b329
push 0x1003410
call fcn.0105b329
mov ebx, dword [ebp - 0x83c]
add esp, 0xc
push ebx
push 0x1013560
push 1
push edi
push 0x1013590
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, edi
je 0x1048101
push esi
push 0x964013c
jmp 0x104815b
cmp dword [ebp + 0xc], edi
je 0x104810f
or dword [ebp - 0x828], 1
jmp 0x104811e
cmp dword [0x107b254], edi
je 0x104811e
or dword [ebp - 0x828], 2
mov eax, dword [ebx]
mov ecx, dword [eax]
lea edx, [ebp - 0x824]
push edx
lea edx, [ebp - 0x61c]
push edx
lea edx, [ebp - 0x414]
push edx
lea edx, [ebp - 0x20c]
push edx
push 0x100371c
push 2
push dword [ebp - 0x828]
push eax
call dword [ecx + 0xc]
mov esi, eax
cmp esi, edi
je 0x1048175
push esi
push 0x976013c
call fcn.01053610
mov edi, dword [ebp - 0x83c]
mov eax, dword [edi]
test eax, eax
je 0x1048175
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [edi], 0
cmp dword [ebp - 0x82c], 0
je 0x104818a
push dword [ebp - 0x82c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
pop ebx
call fcn.0104b509
leave
ret 0xc