Function at 0x1005f1d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov edi, 0x1002398
push edi
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005f86
test byte [0x100a0bc], 1
je 0x1006586
cmp byte [0x100a0b9], 2
jb 0x1006586
push eax
push edi
push 0x10020fc
push 0x1a
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.01002932
jmp 0x1006586
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea edi, [esi + 0x74]
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0x1002358
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1005fb6
cmp dword [ebp - 8], 4
je 0x1005fe6
test byte [0x100a0bc], 1
je 0x1005fe0
cmp byte [0x100a0b9], 3
jb 0x1005fe0
push 0x10020fc
push 0x1b
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
mov dword [edi], 0x3c
test byte [0x100a0bc], 1
je 0x1006012
cmp byte [0x100a0b9], 5
jb 0x1006012
push dword [edi]
push 0x10020fc
push 0x1c
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
mov edi, dword [edi]
cmp edi, 0x3c
jbe 0x1006051
test byte [0x100a0bc], 1
je 0x100657c
cmp byte [0x100a0b9], 3
jb 0x100657c
push edi
push 0x10020fc
push 0x1d
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
jmp 0x100657c
push 4
pop edi
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x78]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x100231c
push dword [ebp - 0xc]
mov dword [ebp - 4], edi
call ebx
test eax, eax
jne 0x1006078
cmp dword [ebp - 8], edi
je 0x10060b3
test byte [0x100a0bc], 1
je 0x10060a5
cmp byte [0x100a0b9], 3
jb 0x10060a5
mov edi, 0x10020fc
push edi
push 0x1e
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
jmp 0x10060aa
mov edi, 0x10020fc
mov dword [esi + 0x78], 0x3c
jmp 0x10060b8
mov edi, 0x10020fc
test byte [0x100a0bc], 1
je 0x10060e1
cmp byte [0x100a0b9], 5
jb 0x10060e1
push dword [esi + 0x78]
push edi
push 0x1f
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
mov eax, dword [esi + 0x78]
cmp eax, 0x3c
jbe 0x100610c
test byte [0x100a0bc], 1
je 0x100657c
cmp byte [0x100a0b9], 3
jb 0x100657c
push eax
push edi
push 0x20
jmp 0x100603b
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x7c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10022f0
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1006135
cmp dword [ebp - 8], 4
je 0x1006162
test byte [0x100a0bc], 1
je 0x100615b
cmp byte [0x100a0b9], 3
jb 0x100615b
push edi
push 0x21
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
mov dword [esi + 0x7c], 3
test byte [0x100a0bc], 1
je 0x100618b
cmp byte [0x100a0b9], 5
jb 0x100618b
push dword [esi + 0x7c]
push edi
push 0x22
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
mov eax, dword [esi + 0x7c]
cmp eax, 3
jbe 0x10061b6
test byte [0x100a0bc], 1
je 0x100657c
cmp byte [0x100a0b9], 3
jb 0x100657c
push eax
push edi
push 0x23
jmp 0x100603b
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x80]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10022bc
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x10061e2
cmp dword [ebp - 8], 4
je 0x1006212
test byte [0x100a0bc], 1
je 0x1006208
cmp byte [0x100a0b9], 3
jb 0x1006208
push edi
push 0x24
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
mov dword [esi + 0x80], 5
test byte [0x100a0bc], 1
je 0x100623e
cmp byte [0x100a0b9], 5
jb 0x100623e
push dword [esi + 0x80]
push edi
push 0x25
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
mov eax, dword [esi + 0x80]
cmp eax, 5
jbe 0x100626c
test byte [0x100a0bc], 1
je 0x100657c
cmp byte [0x100a0b9], 3
jb 0x100657c
push eax
push edi
push 0x26
jmp 0x100603b
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x84]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1002284
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1006298
cmp dword [ebp - 8], 4
je 0x10062c8
test byte [0x100a0bc], 1
je 0x10062be
cmp byte [0x100a0b9], 3
jb 0x10062be
push edi
push 0x27
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
mov dword [esi + 0x84], 3
test byte [0x100a0bc], 1
je 0x10062f4
cmp byte [0x100a0b9], 5
jb 0x10062f4
push dword [esi + 0x84]
push edi
push 0x28
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
mov eax, dword [esi + 0x84]
cmp eax, 0x258
jbe 0x1006324
test byte [0x100a0bc], 1
je 0x100657c
cmp byte [0x100a0b9], 3
jb 0x100657c
push eax
push edi
push 0x29
jmp 0x100603b
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x88]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1002268
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1006350
cmp dword [ebp - 8], 4
je 0x100637d
test byte [0x100a0bc], 1
je 0x1006376
cmp byte [0x100a0b9], 3
jb 0x1006376
push edi
push 0x2a
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
and dword [esi + 0x88], 0
test byte [0x100a0bc], 1
je 0x10063a9
cmp byte [0x100a0b9], 5
jb 0x10063a9
push dword [esi + 0x88]
push edi
push 0x2b
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x1002250
push dword [ebp - 0xc]
call fcn.01005352
test eax, eax
mov dword [esi + 0x94], eax
jne 0x1006406
test byte [0x100a0bc], 4
je 0x10063f3
cmp byte [0x100a0b9], 2
jb 0x10063f3
push 0x1002250
push edi
push 0x2c
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028e7
and dword [esi + 0x98], 0
mov dword [esi + 0x94], 0x100223c
jmp 0x1006410
mov dword [esi + 0x98], 1
test byte [0x100a0bc], 1
je 0x100643c
cmp byte [0x100a0b9], 5
jb 0x100643c
push dword [esi + 0x94]
push edi
push 0x2d
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028e7
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x8c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1002228
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1006468
cmp dword [ebp - 8], 4
je 0x1006495
test byte [0x100a0bc], 1
je 0x100648e
cmp byte [0x100a0b9], 3
jb 0x100648e
push edi
push 0x2e
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
and dword [esi + 0x8c], 0
test byte [0x100a0bc], 1
je 0x10064c1
cmp byte [0x100a0b9], 5
jb 0x10064c1
push dword [esi + 0x8c]
push edi
push 0x2f
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
lea eax, [ebp - 4]
push eax
add esi, 0x90
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x1002210
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x10064ed
cmp dword [ebp - 8], 4
je 0x1006519
test byte [0x100a0bc], 1
je 0x1006513
cmp byte [0x100a0b9], 3
jb 0x1006513
push edi
push 0x30
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
mov dword [esi], 3
cmp dword [esi], 0xff
jbe 0x100654d
test byte [0x100a0bc], 1
je 0x1006547
cmp byte [0x100a0b9], 3
jb 0x1006547
push edi
push 0x31
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010028c1
mov dword [esi], 3
test byte [0x100a0bc], 1
je 0x1006575
cmp byte [0x100a0b9], 5
jb 0x1006575
push dword [esi]
push edi
push 0x32
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100528f
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret