Function at 0x1018c5f
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
xor edi, edi
cmp eax, esi
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x21c], esi
jne 0x1018cb4
mov dword [ebp - 0x208], 0x57
jmp 0x1018f18
push ebx
lea eax, [ebp - 0x214]
push eax
call fcn.01018239
cmp eax, esi
mov dword [ebp - 0x208], eax
jne 0x1018ebc
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x1018eb0
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x214]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x1018eb0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
push 0x1001778
push 0x80000001
call ebx
cmp eax, esi
mov dword [ebp - 0x208], eax
jne 0x1018ebc
mov dword [ebp - 0x210], esi
cmp dword [ebp - 0x220], esi
jne 0x1018ebc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x224], 0x100
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x210]
cmp eax, esi
mov dword [ebp - 0x208], eax
jne 0x1018ea1
push esi
push 0xffffffffffffffff
push dword [ebp - 0x21c]
lea eax, [ebp - 0x204]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x1018dae
push dword [ebp - 0x214]
dec dword [ebp - 0x210]
call fcn.0101819a
jmp 0x1018d30
lea eax, [ebp - 0x20c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x218]
call ebx
cmp eax, esi
mov dword [ebp - 0x208], eax
jne 0x1018ebc
push 0x40c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, esi
pop ecx
je 0x1018df9
lea ecx, [ebp - 0x204]
push ecx
mov ecx, eax
call fcn.01017df6
mov edi, eax
jmp 0x1018dfb
xor edi, edi
cmp edi, esi
je 0x1018e95
push edi
push dword [ebp - 0x20c]
call fcn.01018ae7
cmp eax, 0xea
mov dword [ebp - 0x208], eax
jne 0x1018e2d
mov dword [ebp - 0x208], esi
push 1
mov ecx, edi
call fcn.01018399
jmp 0x1018e8e
cmp eax, esi
jne 0x1018ebc
cmp dword [ebp - 0x20c], esi
je 0x1018e4f
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20c], esi
push 0x1001760
mov ecx, edi
call fcn.01017e48
push esi
mov ecx, edi
call fcn.01017e48
cmp dword [edi + 8], esi
jne 0x1018e7c
cmp dword [edi + 4], esi
jne 0x1018e7c
push dword [edi]
dec dword [ebp - 0x210]
call fcn.0101819a
jmp 0x1018e22
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x220], 1
mov dword [eax], edi
xor edi, edi
jmp 0x1018d30
mov dword [ebp - 0x208], 0xe
jmp 0x1018ebc
cmp eax, 0x103
jne 0x1018ebc
mov dword [ebp - 0x208], esi
jmp 0x1018ebc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x214], esi
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
je 0x1018ed2
push dword [ebp - 0x214]
call ebx
cmp dword [ebp - 0x21c], esi
je 0x1018ee2
push dword [ebp - 0x21c]
call ebx
cmp edi, esi
pop ebx
je 0x1018ef0
push 1
mov ecx, edi
call fcn.01018399
cmp dword [ebp - 0x218], esi
je 0x1018f04
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], esi
je 0x1018f18
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
pop edi
xor ecx, ebp
pop esi
call fcn.010193f0
leave
ret 4