Function at 0x186cf280
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x186c1011
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x1870626c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x21c], esi
mov ebx, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x250], ecx
mov byte [ebp - 0x215], 0
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x244], eax
mov eax, dword [esi]
push ecx
mov ecx, esi
mov dword [ebp - 4], edi
call dword [eax + 0x14]
test eax, eax
jne 0x186cf7be
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea ebx, [edi + 1]
test eax, eax
jne 0x186cf585
push 0
lea eax, [ebp - 0x210]
mov ecx, esi
push eax
push dword [ebp - 0x224]
call fcn.186ce630
sub eax, 0
je 0x186cf4c2
sub eax, 1
je 0x186cf509
sub eax, 1
jne 0x186cf7eb
push 4
call fcn.1861577c
mov esi, eax
add esp, 4
mov dword [ebp - 0x220], esi
mov byte [ebp - 4], 1
test esi, esi
je 0x186cf3d6
call fcn.185a8970
test eax, eax
je 0x186cf7dc
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.185b090d
test al, al
jne 0x186cf3d8
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x186cf3b6
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.185b0f02
jmp 0x186cf3d8
xor esi, esi
mov dword [ebp - 0x238], 0x18868d78
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x230], 0
push dword [ebp - 0x220]
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 3
push esi
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 0
call fcn.186359f0
mov ecx, dword [ebp - 0x240]
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x230], eax
mov byte [ebp - 4], 4
test ecx, ecx
je 0x186cf512
lea eax, [ebp - 0x238]
push eax
cmp dword [ebp - 0x228], edi
je 0x186cf465
mov ecx, edi
call fcn.186ccf00
add edi, 0xc
mov dword [ebp - 0x248], edi
jmp 0x186cf483
push edi
lea ecx, [ebp - 0x24c]
call fcn.18635330
mov eax, dword [ebp - 0x244]
mov edi, dword [ebp - 0x248]
mov dword [ebp - 0x228], eax
mov esi, dword [ebp - 0x230]
mov byte [ebp - 4], 0
mov dword [ebp - 0x238], 0x18868d78
test esi, esi
je 0x186cf4bc
or eax, 0xffffffff
lock xadd dword [esi + 4], eax
jne 0x186cf4bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
or eax, 0xffffffff
lock xadd dword [esi + 8], eax
jne 0x186cf4bc
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov esi, dword [ebp - 0x21c]
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0xff
push eax
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc ebx
test eax, eax
je 0x186cf333
mov ebx, dword [ebp - 0x24c]
mov dword [ebp - 0x220], ebx
jmp 0x186cf587
mov byte [ebp - 0x215], 1
jmp 0x186cf4c2
lea ecx, [ebp - 0x238]
call fcn.186cd620
mov ebx, dword [ebp - 0x24c]
test ebx, ebx
je 0x186cf7be
mov esi, ebx
cmp esi, edi
je 0x186cf540
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
add esi, 0xc
cmp esi, edi
jne 0x186cf531
mov ecx, dword [ebp - 0x228]
mov eax, 0x2aaaaaab
sub ecx, ebx
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ecx, [eax + eax*2]
mov eax, ebx
shl ecx, 2
cmp ecx, 0x1000
jb 0x186cf7b4
mov ebx, dword [ebx - 4]
add ecx, 0x23
sub eax, ebx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x186cf7e6
jmp 0x186cf7b4
xor ebx, ebx
mov ecx, edi
mov eax, 0x2aaaaaab
sub ecx, ebx
imul ecx
sar edx, 1
mov esi, edx
shr esi, 0x1f
add esi, edx
mov dword [ebp - 0x22c], esi
je 0x186cf78b
cmp byte [ebp - 0x215], 0
jne 0x186cf620
push dword [ebp - 0x250]
lea ecx, [ebp - 0x214]
call fcn.185b0640
mov esi, dword [ebp - 0x21c]
lea eax, [ebp - 0x214]
push 0
push 0
push 2
push eax
push dword [ebp - 0x224]
lea ecx, [esi + 4]
mov byte [ebp - 4], 6
call fcn.186d5f30
lea eax, [ebp - 0x214]
push eax
lea ecx, [esi + 0x44]
call fcn.186362a0
mov edx, dword [ebp - 0x214]
or eax, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x186cf78b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x186cf78b
test esi, esi
je 0x186cf78b
mov edi, dword [ebp - 0x22c]
mov eax, ebx
mov dword [ebp - 0x23c], eax
nop word [eax + eax]
push eax
lea ecx, [ebp - 0x238]
call fcn.186ccf00
push dword [ebp - 0x250]
lea ecx, [ebp - 0x214]
mov byte [ebp - 4], 7
call fcn.185b0640
mov ecx, 0x1885e1fc
mov byte [ebp - 4], 8
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x186cf670
sub ecx, edx
sar ecx, 1
push ecx
push 0x1885e1fc
lea ecx, [ebp - 0x214]
call fcn.185b4a40
mov ebx, dword [ebp - 0x234]
mov edx, dword [ebx]
test edx, edx
jne 0x186cf6a0
xor ecx, ecx
jmp 0x186cf6b4
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x186cf6a5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x214]
call fcn.185b4a40
lea eax, [ebp - 0x22c]
push eax
push 0xf013f
push 0
push dword [ebx]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x186cf70c
mov ecx, dword [ebp - 0x21c]
push eax
push eax
push 2
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 0x22c]
lea ecx, [ecx + 4]
call fcn.186d5f30
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x214]
or ebx, 0xffffffff
mov byte [ebp - 4], 7
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x186cf730
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x230]
mov byte [ebp - 4], 0
mov dword [ebp - 0x238], 0x18868d78
test esi, esi
je 0x186cf767
mov eax, ebx
lock xadd dword [esi + 4], eax
jne 0x186cf767
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov eax, ebx
lock xadd dword [esi + 8], eax
jne 0x186cf767
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [ebp - 0x23c]
add eax, 0xc
mov dword [ebp - 0x23c], eax
sub edi, 1
jne 0x186cf640
mov edi, dword [ebp - 0x248]
mov ebx, dword [ebp - 0x220]
test ebx, ebx
je 0x186cf7be
mov esi, ebx
cmp esi, edi
je 0x186cf540
nop dword [eax]
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax]
add esi, 0xc
cmp esi, edi
jne 0x186cf7a0
jmp 0x186cf540
push ecx
push ebx
call fcn.186157ac
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.18615399
mov esp, ebp
pop ebp
ret 8
push 0x80004005
call fcn.185b08f0
call fcn.1863ff19
push 0x1c
call fcn.1861577c
mov esi, eax
add esp, 4
mov dword [ebp - 0x23c], esi
mov byte [ebp - 4], 5
test esi, esi
je 0x186cf824
call fcn.1864444e
push 0x3de
push 0x18868d80
push 0x18868e9c
push dword [eax]
mov ecx, esi
call fcn.1869dc40
jmp 0x186cf826
xor eax, eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push 0x186fd854
push eax
mov byte [ebp - 4], 0
call fcn.1863ba86
int3