Function at 0x1050082
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10bbf70]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
call fcn.0104e941
push 0x10c5db4
mov dword [ebp - 0x4c], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x11
mov ebx, 0x89
push ebx
push 0x18
push 1
push 0xc
call fcn.0104f9a0
cmp dword [ebp - 0x4c], 0x3a4
push 0x17
pop eax
jne 0x10500d6
push 0x1006910
call fcn.010535ae
movzx eax, ax
push 0x11
mov esi, 0x8a
push esi
push eax
xor edi, edi
push edi
push 0xc
call fcn.0104f9a0
cmp dword [ebp - 0x4c], 0x3b5
mov dword [ebp - 0x48], 0xc
jne 0x1050109
push 0x1006908
call fcn.010535ae
movzx eax, ax
mov dword [ebp - 0x48], eax
push 0x31
push ebx
push dword [ebp - 0x48]
push 1
push 0xe
call fcn.0104f9a0
push 0x31
push esi
push dword [ebp - 0x48]
push edi
push 0xe
call fcn.0104f9a0
cmp dword [ebp - 0x4c], 0x3b6
mov dword [ebp - 0x48], 0x1c
jne 0x1050146
push 0x10068fc
call fcn.010535ae
movzx eax, ax
mov dword [ebp - 0x48], eax
movzx eax, word [ebp - 0x48]
push 0x36
push ebx
push dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
push 1
push 0xf
call fcn.0104f9a0
push 0x36
push esi
push dword [ebp - 0x48]
push edi
push 0xf
call fcn.0104f9a0
cmp dword [ebp - 0x4c], 0x3a8
mov dword [ebp - 0x48], 0x1f
jne 0x105018a
push 0x10068f4
call fcn.010535ae
movzx eax, ax
mov dword [ebp - 0x48], eax
push 0x36
push ebx
push dword [ebp - 0x48]
push 1
push 0xd
call fcn.0104f9a0
push 0x36
push esi
push dword [ebp - 0x48]
push edi
push 0xd
call fcn.0104f9a0
push 0x20
mov dword [ebp - 0x48], edi
pop ebx
push ebx
push 8
push 0x24
push 1
push dword [ebp - 0x48]
call fcn.0104f9a0
push ebx
push 0xa
push edi
push edi
push dword [ebp - 0x48]
call fcn.0104f9a0
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 8
jle 0x10501ad
push edi
push 8
push 0x28
push 1
push 0xa
call fcn.0104f9a0
push edi
push 0xa
push 0x28
push edi
push 0xa
call fcn.0104f9a0
push ebx
push 8
call fcn.0104d2ee
movzx eax, al
neg eax
sbb eax, eax
and eax, 0xffffffef
add eax, 0x24
push eax
push 1
push 0xb
call fcn.0104f9a0
push ebx
push 0xe
push 5
push edi
push 0xb
call fcn.0104f9a0
push ebx
mov edi, 0x88
push edi
push 0x21
push 1
push 0x23
call fcn.0104f9a0
push ebx
push esi
push 0x21
push 0
push 0x23
call fcn.0104f9a0
push ebx
push edi
push 0x21
push 1
push 0x13
call fcn.0104f9a0
push ebx
push esi
push 0x21
push 0
push 0x13
call fcn.0104f9a0
push ebx
push edi
push 0x1e
push 1
push 0x19
call fcn.0104f9a0
push ebx
push esi
push 0x1e
push 0
push 0x19
call fcn.0104f9a0
push ebx
push edi
push 0x26
push 1
push 0x1d
call fcn.0104f9a0
push ebx
push esi
push 0x26
push 0
push 0x1d
call fcn.0104f9a0
push ebx
push edi
push 0xb
push 1
push 0x1c
call fcn.0104f9a0
push ebx
push esi
push 0xb
push 0
push 0x1c
call fcn.0104f9a0
push ebx
push edi
push 0x11
push 1
push 0x16
call fcn.0104f9a0
push ebx
push esi
push 0x11
push 0
push 0x16
call fcn.0104f9a0
push ebx
push edi
push 0x10
push 1
push 0x1b
call fcn.0104f9a0
push ebx
push esi
push 0x10
push 0
push 0x1b
call fcn.0104f9a0
push ebx
push edi
push 0xf
push 1
push 0x1e
call fcn.0104f9a0
push ebx
push esi
push 0xf
push 0
push 0x1e
call fcn.0104f9a0
push ebx
push edi
push 0x27
push 1
push 0x17
call fcn.0104f9a0
push ebx
push esi
push 0x27
push 0
push 0x17
call fcn.0104f9a0
push ebx
push edi
push 0x1d
push 1
push 0x18
call fcn.0104f9a0
push ebx
push esi
push 0x1d
push 0
push 0x18
call fcn.0104f9a0
push ebx
push edi
push 9
push 1
mov eax, 0xffff
push 0x14
mov word [0x10c5e3c], ax
call fcn.0104f9a0
push ebx
push esi
push 9
push 0
push 0x14
call fcn.0104f9a0
push ebx
push edi
push 0x19
push 1
push 0x15
call fcn.0104f9a0
push ebx
push esi
push 0x19
push 0
push 0x15
call fcn.0104f9a0
push ebx
push edi
push 0xe
push 1
push 0x1a
call fcn.0104f9a0
push ebx
push esi
push 0xe
push 0
push 0x1a
call fcn.0104f9a0
push ebx
push edi
push 0xd
push 1
push 0x1f
call fcn.0104f9a0
push ebx
push esi
push 0xd
push 0
push 0x1f
call fcn.0104f9a0
push ebx
push 0x87
push 8
push 1
push ebx
call fcn.0104f9a0
push ebx
push esi
push 8
push 0
push ebx
call fcn.0104f9a0
push ebx
push 0x8b
push 0x12
push 1
push 0x21
call fcn.0104f9a0
push ebx
push esi
push 0x12
push 0
push 0x21
call fcn.0104f9a0
push ebx
push edi
push 1
push 1
push 0x22
call fcn.0104f9a0
push ebx
push esi
push 1
push 0
push 0x22
call fcn.0104f9a0
push ebx
push edi
push 0x1a
push 1
push 0x25
call fcn.0104f9a0
push ebx
push esi
push 0x1a
push 0
push 0x25
call fcn.0104f9a0
push ebx
push edi
push 0x1b
push 1
push 0x26
call fcn.0104f9a0
push ebx
push esi
push 0x1b
push 0
push 0x26
call fcn.0104f9a0
push ebx
push edi
push 0xa
push 1
push 0x27
call fcn.0104f9a0
push ebx
push esi
push 0xa
push 0
push 0x27
call fcn.0104f9a0
push ebx
push edi
push 0x1a
push 1
push 0x25
call fcn.0104f9a0
push ebx
push esi
push 0x1a
push 0
push 0x25
call fcn.0104f9a0
push ebx
add edi, 3
push edi
push 7
push 1
push 0x2a
call fcn.0104f9a0
push ebx
push esi
push 7
push 0
push 0x2a
call fcn.0104f9a0
push ebx
push edi
push 0x16
push 1
push 0x2b
call fcn.0104f9a0
push ebx
push esi
push 0x16
push 0
push 0x2b
call fcn.0104f9a0
push ebx
push edi
push 0x14
push 1
push 0x2d
call fcn.0104f9a0
push ebx
push esi
push 0x14
push 0
push 0x2d
call fcn.0104f9a0
push ebx
mov edi, 0x8c
push edi
push 0x15
push 1
push 0x2e
call fcn.0104f9a0
push ebx
push edi
push 0x15
push 0
push 0x2e
call fcn.0104f9a0
mov edi, 0x3a8
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x4c], edi
jne 0x10504de
push 0x10068e0
call fcn.010535ae
movzx eax, ax
mov dword [ebp - 0x48], eax
push ebx
push 0x89
push dword [ebp - 0x48]
push 1
push 0x33
call fcn.0104f9a0
push ebx
push esi
push dword [ebp - 0x48]
push 0
push 0x33
call fcn.0104f9a0
push 0x10
push 0xa
push 4
push 0
push 0x34
call fcn.0104f9a0
push 0x10
push 0xa
push 4
push 0
push 0x35
call fcn.0104f9a0
xor eax, eax
cmp dword [0x10c6214], 2
mov dword [ebp - 0x58], eax
jne 0x10505a9
lea ecx, [ebp - 0x54]
push ecx
push 1
push eax
push 0x1006848
push 0x80000002
mov dword [ebp - 0x54], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10505a9
and dword [ebp - 0x5c], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push 0x1006834
push dword [ebp - 0x54]
mov dword [ebp - 0x60], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1050594
cmp dword [ebp - 0x5c], 1
jne 0x1050594
lea eax, [ebp - 0x44]
push eax
call fcn.010535ae
movzx eax, ax
mov dword [ebp - 0x48], eax
movzx eax, ax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], 1
cmp dword [ebp - 0x54], 0
je 0x10505a3
push dword [ebp - 0x54]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x58], 0
jne 0x10505ca
mov eax, 0x100681c
cmp dword [ebp - 0x4c], edi
je 0x10505b8
mov eax, 0x10067e8
push eax
call fcn.010535ae
movzx eax, ax
mov dword [ebp - 0x48], eax
movzx eax, ax
mov dword [ebp - 0x50], eax
push 0x2f
pop edi
movzx eax, word [ebp - 0x48]
cmp edi, 0x30
je 0x10505da
movzx eax, word [ebp - 0x50]
push ebx
push 0x89
push eax
push 1
push edi
call fcn.0104f9a0
movzx eax, word [ebp - 0x48]
cmp edi, 0x30
je 0x10505f6
movzx eax, word [ebp - 0x50]
push ebx
push esi
push eax
push 0
push edi
call fcn.0104f9a0
inc edi
cmp edi, 0x33
jl 0x10505cd
call fcn.0104f94b
push 0x10c5db4
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101def4
leave
ret