Function at 0x108061b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x1099a38]
push ebx
push esi
push edi
mov edi, dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldW]
lea ecx, [ebp - 0xa34]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov esi, 0x104
push esi
lea ecx, [ebp - 0x20c]
push ecx
mov dword [ebp - 0xa30], eax
mov eax, dword [ebp + 0x10]
push 2
xor ebx, ebx
push eax
mov dword [ebp - 0xa40], eax
inc ebx
call edi
test eax, eax
je 0x108070f
lea eax, [ebp - 0x20c]
push 0x1018d08
push eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
jne 0x1080693
mov dword [ebp - 0xa3c], SysStringLen
jmp 0x1080724
lea eax, [ebp - 0x20c]
push 0x1018cfc
push eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
jne 0x10806b6
mov dword [ebp - 0xa3c], SysStringLen
jmp 0x1080724
lea eax, [ebp - 0x20c]
push 0x1018cf0
push eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
jne 0x10806d9
mov dword [ebp - 0xa3c], SysStringLen
jmp 0x1080724
lea eax, [ebp - 0x20c]
push 0x1018ce8
push eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
jne 0x10806fc
mov dword [ebp - 0xa3c], SysStringLen
jmp 0x1080724
push dword [ebp - 0xa30]
or ebx, 0xffffffff
push 0x10293c4
jmp 0x10808f6
push dword [ebp - 0xa30]
or ebx, 0xffffffff
push 0x10293a4
call fcn.01071ac0
pop ecx
pop ecx
lea eax, [ebp - 0xa34]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push 3
push dword [ebp - 0xa40]
call edi
test eax, eax
jne 0x108075b
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0xa30]
push 0x102937c
jmp 0x1080b1a
lea eax, [ebp - 0xa34]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
push 4
push dword [ebp - 0xa40]
call edi
test eax, eax
jne 0x108080b
cmp dword [ebp + 0x14], 1
je 0x108079c
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0xa30]
push 0x1029354
jmp 0x1080b1a
and word [ebp - 0x61c], 0
lea eax, [ebp - 0xa38]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa3c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp + 0x14], 1
jne 0x1080902
xor ebx, ebx
cmp eax, ebx
jne 0x10808ea
cmp word [ebp - 0x61c], bx
jne 0x108091f
lea eax, [ebp - 0x414]
push eax
push 0x1029340
inc ebx
call fcn.01071ac0
pop ecx
pop ecx
push dword [ebp - 0xa38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1080d79
lea eax, [ebp - 0xa34]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 5
push dword [ebp - 0xa40]
call edi
test eax, eax
jne 0x1080842
or ebx, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0xa30]
push 0x1029318
jmp 0x1080b1a
push 0
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_wcstoul
add esp, 0xc
test al, 1
je 0x1080889
test eax, 0x10001
je 0x108086f
mov dword [ebp - 0xa48], 4
jmp 0x10807a4
and eax, 0x20001
neg eax
sbb eax, eax
and eax, 0xfffffffd
add eax, 3
mov dword [ebp - 0xa48], eax
jmp 0x10807a4
test eax, 0x10000
je 0x108089f
mov dword [ebp - 0xa48], 7
jmp 0x10807a4
test eax, 0x20000
je 0x10808b5
mov dword [ebp - 0xa48], 2
jmp 0x10807a4
test eax, eax
jne 0x10808c8
mov dword [ebp - 0xa48], 1
jmp 0x10807a4
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa30]
push 0x10292ec
call fcn.01071ac0
add esp, 0xc
or ebx, 0xffffffff
jmp 0x1080d79
lea eax, [ebp - 0x414]
push eax
push 0x10292d4
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1080d79
test eax, eax
je 0x108091f
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa30]
xor ebx, ebx
push 0x10292ac
jmp 0x1080b1a
lea eax, [ebp - 0xa34]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa4c]
push eax
push 0
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa38]
mov dword [ebp - 0xa34], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp + 0x14], 1
mov ecx, dword [ebp - 0xa34]
mov byte [ebp + ecx - 0x825], 0
jne 0x1080995
test eax, eax
lea eax, [ebp - 0x61c]
push eax
jne 0x1080984
push 0x102929c
call fcn.01071ac0
xor ebx, ebx
inc ebx
jmp 0x10807f8
push 0x1029288
call fcn.01071ac0
xor ebx, ebx
jmp 0x10807f8
test eax, eax
je 0x10809c5
push dword [ebp - 0xa38]
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xa30]
push 0x1029250
jmp 0x1080d71
lea eax, [ebp - 0xa34]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 6
push dword [ebp - 0xa40]
call edi
mov eax, dword [ebp + 0x14]
lea eax, [eax + eax*2]
shl eax, 5
lea eax, [eax + 0x1099a54]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll__wcsicmp
test eax, eax
pop ecx
pop ecx
je 0x1080a29
push dword [ebp - 0xa38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa30]
or ebx, 0xffffffff
push 0x1029224
call fcn.01071ac0
add esp, 0xc
mov eax, dword [ebp - 0xa4c]
cmp dword [ebp - 0xa48], eax
je 0x1080a5a
push dword [ebp - 0xa38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa30]
push 0x10291fc
jmp 0x1080b17
cmp eax, 1
je 0x1080a64
cmp eax, 2
jne 0x1080abf
lea eax, [ebp - 0xa34]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 7
push dword [ebp - 0xa40]
call edi
test eax, eax
je 0x1080af9
and dword [ebp - 0xa3c], 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push eax
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
push 1
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0xa44]
push eax
push 1
push dword [ebp + 0x14]
call fcn.0107f6d6
mov ebx, eax
cmp dword [ebp - 0xa4c], 7
jne 0x1080bb3
cmp dword [ebp + 0x14], 9
lea eax, [ebp - 0xa34]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 7
push dword [ebp - 0xa40]
jne 0x1080aed
call edi
jmp 0x1080af3
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetMultiSzFieldW]
xor ecx, ecx
cmp eax, ecx
jne 0x1080b27
push dword [ebp - 0xa38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa30]
push 0x10291c0
or ebx, 0xffffffff
call fcn.01071ac0
add esp, 0xc
jmp 0x1080d79
xor ebx, ebx
cmp dword [ebp + 0x14], 9
lea esi, [ebp - 0x824]
lea edi, [ebp - 0x20c]
mov dword [ebp - 0xa3c], ecx
jne 0x1080c09
cmp word [ebp - 0x20c], cx
je 0x1080c09
cmp word [ebp - 0x824], cx
je 0x1080bb3
push 3
pop edi
mov dword [ebp + 0x14], edi
lea eax, [ebp - 0x20c]
push eax
push esi
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
push 1
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0xa44]
push eax
push 1
push edi
call fcn.0107f6d6
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10807fa
cmp ebx, 1
je 0x10807fa
push esi
call sub.msvcrt.dll_wcslen
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
pop ecx
jne 0x1080b61
cmp dword [ebp - 0xa48], 4
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x102918c
jne 0x1080c94
lea eax, [ebp - 0xa44]
push eax
push 7
push dword [ebp - 0xa40]
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetIntField]
test eax, eax
je 0x1080c78
push 1
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0x824]
push eax
push 1
push dword [ebp + 0x14]
call fcn.0107f6d6
mov ebx, eax
jmp 0x1080cfd
cmp word [ebp - 0x824], cx
je 0x1080bb3
jmp 0x1080c16
xor ecx, ecx
cmp word [edi], cx
je 0x1080bb3
push edi
push esi
call sub.msvcrt.dll_wcscmp
pop ecx
pop ecx
push 1
mov dword [ebp - 0xa44], eax
lea eax, [ebp - 0xa3c]
push eax
lea eax, [ebp - 0xa44]
push eax
push 1
push dword [ebp + 0x14]
call fcn.0107f6d6
mov ebx, eax
cmp ebx, 0xffffffff
je 0x10807fa
test ebx, ebx
je 0x10807fa
push esi
call sub.msvcrt.dll_wcslen
push edi
lea esi, [esi + eax*2 + 2]
call sub.msvcrt.dll_wcslen
cmp word [esi], 0
pop ecx
pop ecx
lea edi, [edi + eax*2 + 2]
jne 0x1080c14
jmp 0x1080bb3
or ebx, 0xffffffff
call esi
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa30]
push edi
call fcn.01071ac0
add esp, 0x10
cmp dword [ebp - 0xa48], 3
jne 0x1080cfd
lea eax, [ebp - 0xa34]
push eax
push 0x208
lea eax, [ebp - 0xa2c]
push eax
push 7
push dword [ebp - 0xa40]
call dword [sym.imp.UPDSPAPI.dll_UpdSpGetBinaryField]
test eax, eax
je 0x1080ce1
mov eax, dword [ebp - 0xa34]
shr eax, 2
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x824]
push eax
push 2
jmp 0x1080bfa
or ebx, 0xffffffff
call esi
push eax
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0xa30]
push edi
call fcn.01071ac0
add esp, 0x10
push dword [ebp - 0xa38]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, 1
jne 0x1080d2b
mov eax, dword [ebp + 0x14]
cmp eax, 9
jne 0x1080d1d
push 0x1099dbe
jmp 0x1080d3c
lea eax, [eax + eax*2]
shl eax, 5
lea eax, [eax + 0x1099a5e]
jmp 0x1080d5d
test ebx, ebx
jne 0x1080d79
mov eax, dword [ebp + 0x14]
cmp eax, 9
jne 0x1080d51
push 0x1099de6
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x102916c
jmp 0x1080d71
lea eax, [eax + eax*2]
shl eax, 5
lea eax, [eax + 0x1099a86]
push eax
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x102914c
call fcn.01071ac0
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.0106bc50
leave
ret 0x10