Function at 0x100484c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov eax, 0x10dc
lea ebp, [esp - 0x74]
call fcn.01007220
lea eax, [ebp + 0x2c]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x30]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x24]
push esi
xor esi, esi
mov dword [ebp - 4], eax
mov ebx, 0x80000002
lea eax, [ebp + 8]
push edi
mov dword [ebp + 0x28], esi
mov dword [ebp + 0x70], esi
mov dword [ebp + 0x6c], esi
mov dword [ebp + 0x58], esi
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x48], esi
mov dword [ebp + 0x4c], esi
mov dword [ebp + 0x60], esi
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x50], esi
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x64], esi
mov dword [ebp + 0x3c], esi
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x54], esi
mov dword [ebp + 0x2c], esi
mov dword [ebp + 0x34], esi
mov dword [ebp + 0x20], esi
mov dword [ebp + 0x10], esi
mov dword [ebp + 0x30], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x24], esi
mov dword [ebp + 8], esi
mov dword [ebp - 0x40], 0x1f43
mov dword [ebp - 0x38], 0x1f44
mov dword [ebp - 0x30], 0x1f45
mov dword [ebp - 0x28], 0x1f46
mov dword [ebp - 0x20], 0x1f47
mov dword [ebp - 0x18], 0x1f48
mov dword [ebp - 0x10], 0x1f49
mov dword [ebp - 8], 0x1f4a
mov dword [ebp], 0x1f4b
mov dword [ebp + 4], eax
xor edi, edi
push dword [ebp + edi*8 - 0x3c]
push dword [ebp + edi*8 - 0x40]
push 0x800
call fcn.010076b8
add esp, 0xc
test eax, eax
je 0x10049a0
inc edi
cmp edi, 9
jb 0x1004924
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1068]
push 0x1001b30
push eax
call edi
pop ecx
pop ecx
mov dword [ebp + 0x5c], eax
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x3c]
push eax
push 0x1001b1c
push dword [ebp + 0x7c]
call fcn.01002b73
cmp al, 1
jne 0x10049ef
push dword [ebp + 0x54]
push dword [ebp + 0x7c]
call fcn.01002bbb
cmp dword [ebp + 0x3c], esi
jne 0x10049c8
push 0x641
call fcn.0100763f
mov dword [ebp + 0x28], 1
mov edi, 0x80070057
jmp 0x1004cb7
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x10049b3
call edi
jmp 0x1004d4d
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x1004cb7
mov eax, dword [ebp + 0x5c]
lea eax, [ebp + eax*2 - 0x1068]
push 0x1001b18
push eax
call edi
mov ecx, dword [ebp + 0x5c]
push dword [ebp + 0x3c]
add ecx, eax
lea eax, [ebp + ecx*2 - 0x1068]
push eax
call edi
add esp, 0x10
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x18]
push eax
push 0x10016c4
push dword [ebp + 0x7c]
call fcn.01002b73
cmp al, 1
jne 0x1004a3f
push dword [ebp + 0x54]
push dword [ebp + 0x7c]
call fcn.01002bbb
lea eax, [ebp + 0x50]
push eax
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, esi
je 0x1004a3a
jle 0x1004d4d
and eax, 0xffff
or eax, 0x80070000
jmp 0x1004d4d
mov ebx, dword [ebp + 0x50]
jmp 0x1004a42
mov ebx, dword [ebp + 0x38]
push dword [ebp + 0x7c]
call fcn.01002bf5
mov edi, eax
cmp edi, esi
jl 0x1004cb7
lea eax, [ebp + 0x60]
push eax
push 1
push esi
lea eax, [ebp - 0x1068]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1004a25
push esi
push esi
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x1004a25
cmp dword [ebp + 0x58], esi
jne 0x1004a9d
mov edi, 0x80070103
jmp 0x1004cb7
add dword [ebp + 0x70], 2
mov eax, dword [ebp + 0x70]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp + 0x68], eax
jne 0x1004ac2
mov edi, 0x8007000e
jmp 0x1004cb7
push dword [ebp + 0x6c]
push 0x40
call edi
cmp eax, esi
mov dword [ebp + 0x64], eax
je 0x1004ab8
mov ebx, dword [ebp + 0x70]
add ebx, 3
push 0xfffffffffffffff5
mov dword [ebp + 0x38], ebx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp + 0x5c], edi
je 0x10049a0
push 0x100124c
push edi
call fcn.01002f94
push dword [ebp + 0x20]
lea eax, [ebx + 0x14]
push eax
push dword [ebp + 0x34]
push ebx
push dword [ebp + 0x2c]
push esi
push edi
call fcn.01004773
mov ecx, dword [ebp + 0x6c]
shr ecx, 1
lea eax, [ebx + 0x14]
add ecx, eax
mov dword [ebp + 0x7c], esi
je 0x1004b3b
push 0x100159c
push edi
call fcn.01002f94
mov ecx, dword [ebp + 0x6c]
inc dword [ebp + 0x7c]
shr ecx, 1
lea eax, [ebx + 0x14]
add ecx, eax
cmp dword [ebp + 0x7c], ecx
jb 0x1004b1e
push 0x1001b10
push edi
call fcn.01002f94
cmp dword [ebp + 0x58], esi
mov dword [ebp + 0x7c], esi
jbe 0x1004caa
mov eax, dword [ebp + 0x70]
mov ecx, dword [ebp + 0x6c]
mov edi, dword [ebp + 0x68]
mov dword [ebp + 0x4c], ecx
mov dword [ebp + 0x48], eax
mov ecx, eax
xor eax, eax
rep stosw word es:[edi], ax
mov ecx, dword [ebp + 0x6c]
mov edi, dword [ebp + 0x64]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp + 0x64]
lea eax, [ebp + 0x4c]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x48]
push eax
push dword [ebp + 0x68]
push dword [ebp + 0x7c]
push dword [ebp + 0x60]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1004d47
mov eax, dword [ebp + 0x48]
cmp eax, dword [ebp + 0x70]
ja 0x1004d54
mov eax, dword [ebp + 0x4c]
cmp eax, dword [ebp + 0x6c]
ja 0x1004d54
mov eax, dword [ebp + 0xc]
dec eax
je 0x1004c80
dec eax
je 0x1004c7b
dec eax
dec eax
je 0x1004c62
sub eax, 3
je 0x1004be5
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 8]
jmp 0x1004c85
xor eax, eax
mov word [ebp - 0x868], si
mov ecx, 0x1ff
lea edi, [ebp - 0x866]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp + 0x64]
mov word [ebp + 0x40], si
mov word [ebp + 0x42], si
mov word [ebp + 0x44], si
xor ebx, ebx
jmp 0x1004c4f
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + ebx*2 - 0x868]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add ebx, eax
lea eax, [ebp + ebx*2 - 0x868]
push edi
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
add ebx, eax
mov word [ebp + 0x40], 0x2c
mov word [ebp + 0x42], 0x20
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x14
lea edi, [edi + eax*2 + 2]
cmp word [edi], si
jne 0x1004c10
mov eax, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x38]
lea ecx, [ebp - 0x868]
jmp 0x1004c85
push 0xa
lea eax, [ebp - 0x68]
push eax
push dword [edi]
call dword [sym.imp.msvcrt.dll__ltow]
mov eax, dword [ebp + 0x10]
add esp, 0xc
lea ecx, [ebp - 0x68]
jmp 0x1004c85
mov eax, dword [ebp + 0x14]
jmp 0x1004c83
mov eax, dword [ebp + 0x30]
mov ecx, edi
push ecx
lea ecx, [ebx + 0x14]
push ecx
push eax
push ebx
push dword [ebp + 0x68]
push esi
push dword [ebp + 0x5c]
call fcn.01004773
inc dword [ebp + 0x7c]
mov eax, dword [ebp + 0x7c]
cmp eax, dword [ebp + 0x58]
jb 0x1004b52
mov edi, dword [ebp + 0x5c]
push 0x100124c
push edi
call fcn.01002f94
xor edi, edi
xor ebx, ebx
mov eax, dword [ebp + ebx*8 - 0x3c]
mov eax, dword [eax]
cmp eax, esi
je 0x1004cca
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc ebx
cmp ebx, 9
jb 0x1004cb9
cmp dword [ebp + 0x60], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x1004ce0
push dword [ebp + 0x60]
call ebx
cmp dword [ebp + 0x50], esi
je 0x1004cea
push dword [ebp + 0x50]
call ebx
cmp dword [ebp + 0x68], esi
je 0x1004cf8
push dword [ebp + 0x68]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp + 0x64], esi
je 0x1004d06
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, esi
jge 0x1004d3b
cmp dword [ebp + 0x28], esi
jne 0x1004d3b
lea eax, [ebp + 0x7c]
push eax
push edi
call fcn.01007d63
test eax, eax
jl 0x1004d3b
push dword [ebp + 0x7c]
push 0x10015e4
push 0x579
call fcn.010075e6
add esp, 0xc
push dword [ebp + 0x7c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4
jg 0x1004a2b
mov edi, eax
jmp 0x1004cb7
mov edi, 0x8000ffff
jmp 0x1004cb7