Function at 0x105380d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x544
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x538], ecx
xor ecx, ecx
cmp eax, ecx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x530], ecx
mov dword [ebp - 0x534], ecx
mov dword [ebp - 0x52c], ecx
mov ebx, 0x2001f
je 0x1053862
lea edx, [ebp - 0x52c]
push edx
push ebx
push ecx
push eax
push SysReAllocString
jmp 0x1053895
lea eax, [ebp - 0x534]
push eax
push ebx
push ecx
push 0x1007498
push SysReAllocString
call edi
mov esi, eax
test esi, esi
jne 0x1053959
lea eax, [ebp - 0x52c]
push eax
push ebx
push esi
push 0x1003e1c
push dword [ebp - 0x534]
call edi
mov esi, eax
test esi, esi
jne 0x1053959
mov dword [ebp - 0x528], 0x80
mov dword [ebp - 0x520], eax
mov dword [ebp - 0x524], eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x528]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x520]
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x105394d
inc dword [ebp - 0x520]
lea eax, [ebp - 0x524]
push eax
push ebx
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x52c]
mov dword [ebp - 0x528], 0x80
call edi
mov esi, eax
test esi, esi
jne 0x105394d
push dword [ebp - 0x524]
mov ecx, dword [ebp - 0x538]
call fcn.0105348c
test eax, eax
jge 0x105393a
lea eax, [ebp - 0x104]
push eax
push 0x1008aec
push 4
call fcn.0105e5ad
add esp, 0xc
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x10538b7
push dword [ebp - 0x52c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x534], 0
je 0x105396e
push dword [ebp - 0x534]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1053998
cmp esi, 0x103
je 0x1053998
test esi, esi
jg 0x1053986
mov dword [ebp - 0x530], esi
jmp 0x1053998
mov eax, esi
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x530], eax
mov eax, dword [ebp - 0x538]
cmp dword [eax + 0x1c], 3
jne 0x1053b15
push 0x1003e00
push 0x1007498
push 0x1002b4c
lea eax, [ebp - 0x51c]
push 0x105
push eax
call fcn.01034d76
add esp, 0x14
test eax, eax
jl 0x1053b35
and dword [ebp - 0x520], 0
lea eax, [ebp - 0x520]
push eax
push ebx
push 0
lea eax, [ebp - 0x51c]
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x1053b35
mov dword [ebp - 0x540], 0x80
mov dword [ebp - 0x528], eax
mov dword [ebp - 0x524], eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x540]
push eax
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x528]
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x1053b09
inc dword [ebp - 0x528]
lea eax, [ebp - 0x524]
push eax
push ebx
push esi
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x520]
mov dword [ebp - 0x540], 0x80
call edi
mov esi, eax
test esi, esi
jne 0x1053b09
lea eax, [ebp - 0x544]
push eax
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x53c]
push eax
push 0
push 0x10078b4
push dword [ebp - 0x524]
inc esi
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x544], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1053af6
cmp dword [ebp - 0x53c], esi
jne 0x1053af6
mov ecx, dword [ebp - 0x538]
lea eax, [ebp - 0x310]
push eax
call fcn.0104d0d4
test eax, eax
jne 0x1053af6
push dword [ebp - 0x524]
mov ecx, dword [ebp - 0x538]
call fcn.0105348c
test eax, eax
jge 0x1053af6
lea eax, [ebp - 0x104]
push eax
push 0x1008ac4
push 4
call fcn.0105e5ad
add esp, 0xc
push dword [ebp - 0x524]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1053a10
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1053b35
cmp esi, 0x103
je 0x1053b35
test esi, esi
jle 0x1053b33
and esi, 0xffff
or esi, 0x80070000
test esi, esi
jl 0x1053b41
xor esi, esi
cmp dword [ebp - 0x530], esi
jl 0x1053b4a
jmp 0x1053b50
cmp dword [ebp - 0x530], 0
jge 0x1053b50
mov esi, dword [ebp - 0x530]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 4