Function at 0x10077bc
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x100e324]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov edi, ecx
xor ecx, ecx
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x420], edi
mov dword [ebp - 0x410], esi
mov dword [ebp - 0x414], esi
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x408], esi
mov dword [ebp - 0x40c], esi
mov word [ebp - 0x204], cx
cmp eax, esi
je 0x1007b14
cmp edi, esi
je 0x1007b14
push ebx
lea eax, [ebp - 0x410]
push eax
push 0x20019
push esi
push dword [0x100e058]
mov dword [edi], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
je 0x10078b6
push 0xff
lea eax, [ebp - 0x204]
push eax
cmp ebx, 2
jne 0x1007888
push 0x36b0
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [0x100e058]
lea eax, [ebp - 0x204]
push eax
push 3
call fcn.01004bfe
add esp, 0xc
jmp 0x1007a98
push 0x3714
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
push dword [0x100e058]
lea eax, [ebp - 0x204]
push eax
push ebx
push 4
call fcn.01004ca7
add esp, 0x10
jmp 0x1007a9a
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x414]
push eax
push esi
push esi
push esi
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
cmp ebx, esi
je 0x1007913
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x3778
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push eax
push ebx
push 4
call fcn.01004ca7
add esp, 0xc
jmp 0x1007a9a
mov eax, dword [ebp - 0x414]
cmp eax, esi
jne 0x100794f
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x37dc
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x204]
push eax
push 2
call fcn.01004bfe
pop ecx
pop ecx
jmp 0x1007a9a
push esi
push 0x4ed
push 0x1003164
shl eax, 2
push eax
call fcn.010058aa
mov dword [ebp - 0x408], eax
cmp eax, esi
jne 0x1007975
push 8
pop ebx
jmp 0x1007a9a
mov ecx, dword [ebp - 0x414]
shl ecx, 2
push ecx
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x418], esi
cmp dword [ebp - 0x414], esi
jbe 0x1007a82
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x404]
push eax
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0x100
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x1007af6
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x3840
push dword [0x100e874]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push 7
call fcn.01004bfe
add esp, 0xc
push esi
push 0x508
push 0x1003164
push 0x10
call fcn.010058aa
mov edi, eax
cmp edi, esi
je 0x100796d
mov dword [edi], esi
mov dword [edi + 4], esi
mov dword [edi + 8], esi
mov dword [edi + 0xc], esi
push dword [ebp - 0x410]
mov ecx, edi
lea edx, [ebp - 0x404]
call fcn.01006fd3
test eax, eax
jne 0x1007a5d
mov ecx, dword [ebp - 0x40c]
mov eax, dword [ebp - 0x408]
inc dword [ebp - 0x40c]
mov dword [eax + ecx*4], edi
jmp 0x1007a64
push esi
push edi
call fcn.01005b7d
inc dword [ebp - 0x418]
mov eax, dword [ebp - 0x418]
mov edi, dword [ebp - 0x420]
cmp eax, dword [ebp - 0x414]
jb 0x100799b
mov eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x408]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40c]
mov dword [edi], eax
xor ebx, ebx
cmp dword [ebp - 0x410], esi
je 0x1007aae
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, esi
je 0x1007af1
cmp dword [ebp - 0x408], esi
je 0x1007af1
xor edi, edi
cmp dword [ebp - 0x40c], esi
jbe 0x1007ae5
mov eax, dword [ebp - 0x408]
push esi
push dword [eax + edi*4]
call fcn.01005b7d
mov eax, dword [ebp - 0x408]
mov dword [eax + edi*4], esi
inc edi
cmp edi, dword [ebp - 0x40c]
jb 0x1007ac4
push esi
push dword [ebp - 0x408]
call fcn.01005b7d
mov eax, ebx
pop ebx
jmp 0x1007b17
cmp ebx, 0x103
je 0x1007a82
push 0xff
lea eax, [ebp - 0x204]
push eax
push 0x38a4
jmp 0x10078f0
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01008d3f
leave
ret 4