Function at 0x100572e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x1009f7c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x20]
push esi
push edi
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x468], eax
mov eax, dword [ebp + 0xc]
xor esi, esi
push 0x50
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x56]
push esi
push eax
mov dword [ebp - 0x474], esi
mov dword [ebp - 0x470], esi
mov dword [ebp - 0x478], esi
mov word [ebp - 0x58], si
call sub.MSVCR80.dll_memset
mov eax, dword [ebp - 0x46c]
mov word [eax], si
add esp, 0xc
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
push edi
push dword [ebp + 0x14]
call fcn.01003a5f
pop ecx
pop ecx
lea eax, [ebp - 0x470]
push eax
push 0x20019
push esi
lea eax, [edi + 0x618]
push eax
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp ebx, esi
je 0x10057cc
mov dword [ebx], esi
cmp eax, esi
jne 0x1005814
cmp ebx, esi
je 0x10057da
mov dword [ebx], 1
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48c]
push eax
push esi
push 0x100190c
push dword [ebp - 0x470]
mov dword [ebp - 0x478], 0x50
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
mov word [ebp - 8], si
je 0x100589f
lea eax, [ebp - 0x464]
push 0x105
push eax
call fcn.01005703
cmp eax, esi
pop ecx
pop ecx
mov dword [ebp - 0x468], eax
jne 0x1005978
cmp dword [ebp + 0x1c], esi
mov ebx, dword [ebp + 0x10]
je 0x100584f
push ebx
push 0x1001924
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x1001a5c
push ebx
push dword [ebp - 0x46c]
call fcn.01002ebb
add edi, 0x820
push edi
push ebx
push dword [ebp - 0x46c]
call fcn.01004c41
add esp, 0xc
push 0x1001cf0
push ebx
push dword [ebp - 0x46c]
call fcn.01002ebb
lea eax, [ebp - 0x464]
push eax
push ebx
push dword [ebp - 0x46c]
call fcn.01002ebb
jmp 0x1005978
push 0x1001cd4
mov edi, 0xff
push edi
lea eax, [ebp - 0x258]
push eax
call fcn.01002aa5
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1005978
lea eax, [ebp - 0x58]
push eax
push edi
lea eax, [ebp - 0x258]
push eax
call fcn.01002c26
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1005978
push 0x1001cd0
push edi
lea eax, [ebp - 0x258]
push eax
call fcn.01002c26
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1005978
lea eax, [ebp - 0x474]
push eax
push 0x1002918
lea eax, [ebp - 0x258]
push eax
call dword [0x100a608]
cmp eax, esi
mov dword [ebp - 0x468], eax
jl 0x1005978
mov eax, dword [ebp - 0x474]
mov ecx, dword [eax]
lea edx, [ebp - 0x488]
push edx
push 0x1001850
push eax
call dword [ecx + 0x3c]
cmp dword [ebp - 0x480], esi
mov dword [ebp - 0x468], eax
je 0x1005978
cmp dword [ebp + 0x1c], esi
je 0x1005961
push dword [ebp + 0x10]
push 0x1001924
push dword [ebp - 0x46c]
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp - 0x480]
push dword [ebp + 0x10]
push dword [ebp - 0x46c]
call fcn.01004c41
add esp, 0xc
lea eax, [ebp - 0x488]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [ebp - 0x470], esi
je 0x1005999
push dword [ebp - 0x470]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x474]
pop edi
cmp eax, esi
pop esi
pop ebx
je 0x10059ac
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x468]
xor ecx, ebp
call fcn.01006b3a
leave
ret