Function at 0xed01dd1
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x864
mov eax, dword [0xed3e248]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x858], edi
mov word [ebp - 0x414], ax
cmp dword [edi], ebx
jne 0xed0265c
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0ed01b36
leave
ret 8
push 0x104
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
jmp 0xed026ab
push esi
push 0x2c
xor esi, esi
push esi
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
add edi, 4
push 0xa
or eax, 0xffffffff
pop ecx
mov dword [ebp - 0x82c], edi
rep stosd dword es:[edi], eax
mov eax, dword [ebp - 0x858]
mov dword [eax], ebx
cmp word [0xed3efa0], si
je 0xed0c39c
cmp word [0xed3f378], si
je 0xed0c39c
cmp word [0xed3efa0], si
jne 0xed0c3a7
cmp word [ebp - 0x414], si
je 0xed0286a
mov edi, 0x20019
push edi
push 0xed026f0
push 0x80000002
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x830], esi
mov dword [ebp - 0x854], esi
mov dword [ebp - 0x850], esi
mov dword [ebp - 0x84c], esi
call fcn.0ed02875
jmp 0xed0d596
test eax, eax
je 0xed0d5d3
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x824]
push eax
push 0xed3efa0
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x828], ebx
call fcn.0ed0260b
test eax, eax
je 0xed0d5d3
lea ecx, [ebp - 0x854]
call fcn.0ed028b1
mov ecx, 0xed02838
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
je 0xed0c384
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0xed0d904
mov ecx, 0xed02818
lea eax, [ebp - 0x414]
mov dx, word [eax]
cmp dx, word [ecx]
je 0xed0d916
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
je 0xed0d93f
lea ecx, [ebp - 0x854]
call fcn.0ed028b1
jmp 0xed0286a
pop esi
jmp 0xed01e05
cmp dx, si
je 0xed0c3b9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xed027da
jmp 0xed0d8f0
push esi
call fcn.0ed03a0c
jmp 0xed0269e
cmp word [0xed3f378], si
jne 0xed02647
jmp 0xed026ab
xor eax, eax
jmp 0xed027df
test eax, eax
jne 0xed027b8
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x828]
push eax
lea eax, [ebp - 0x824]
push eax
mov ebx, 0x104
push 0xed3f378
lea ecx, [ebp - 0x854]
mov dword [ebp - 0x828], ebx
call fcn.0ed0260b
jmp 0xed02784
xor eax, eax
mov word [ebp - 0x61e], ax
push edi
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0x854]
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x848], esi
mov dword [ebp - 0x844], esi
mov dword [ebp - 0x840], esi
call fcn.0ed02875
test eax, eax
jne 0xed0d8e0
push esi
push esi
push esi
mov word [ebp - 0x61c], ax
mov word [ebp - 0x20c], ax
push esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x830], ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x828], esi
push esi
jmp 0xed0d704
inc dword [ebp - 0x828]
lea eax, [ebp - 0x20c]
mov ecx, 0xed3f590
mov dx, word [ecx]
cmp dx, word [eax]
jne 0xed0d67e
cmp dx, si
je 0xed0d67a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0xed0d67e
add ecx, 4
add eax, 4
cmp dx, si
jne 0xed0d658
xor eax, eax
jmp 0xed0d683
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jle 0xed0d6e3
cmp word [ebp - 0x61c], si
je 0xed0d6cb
lea ecx, [ebp - 0x61c]
lea eax, [ebp - 0x20c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0xed0d6c2
cmp dx, si
je 0xed0d6be
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xed0d6c2
add eax, 4
add ecx, 4
cmp dx, si
jne 0xed0d69c
xor eax, eax
jmp 0xed0d6c7
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, esi
jle 0xed0d6e3
lea eax, [ebp - 0x20c]
push eax
push 0x104
lea eax, [ebp - 0x61c]
push eax
call fcn.0ed03935
push esi
push esi
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
push esi
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x828]
push dword [ebp - 0x848]
call ebx
test eax, eax
je 0xed0d647
cmp word [ebp - 0x61c], si
je 0xed0d822
push edi
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x848]
lea ecx, [ebp - 0x864]
mov dword [ebp - 0x864], esi
mov dword [ebp - 0x860], esi
mov dword [ebp - 0x85c], esi
call fcn.0ed02875
test eax, eax
jne 0xed0d817
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x864]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0ed02875
test eax, eax
jne 0xed0d7c5
mov ebx, dword [ebp - 0x82c]
xor edi, edi
cmp dword [ebx], 0xffffffff
jne 0xed0d7ba
lea eax, [ebp - 0x828]
push eax
push dword [edi + 0xed3f9ac]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x828], esi
call fcn.0ed1769b
test eax, eax
jne 0xed0d7ba
mov eax, dword [ebp - 0x828]
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x28
jb 0xed0d78b
mov ebx, dword [ebp - 0x82c]
xor edi, edi
cmp dword [ebx], 0xffffffff
jne 0xed0d7fc
lea eax, [ebp - 0x828]
push eax
push dword [edi + 0xed3f9ac]
lea ecx, [ebp - 0x864]
mov dword [ebp - 0x828], esi
call fcn.0ed1769b
test eax, eax
jne 0xed0d7fc
mov eax, dword [ebp - 0x828]
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x28
jb 0xed0d7cd
lea ecx, [ebp - 0x83c]
call fcn.0ed028b1
mov edi, 0x20019
lea ecx, [ebp - 0x864]
call fcn.0ed028b1
push edi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x848]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], esi
call fcn.0ed02875
test eax, eax
jne 0xed0d893
mov ebx, dword [ebp - 0x82c]
xor edi, edi
cmp dword [ebx], 0xffffffff
jne 0xed0d888
lea eax, [ebp - 0x828]
push eax
push dword [edi + 0xed3f9ac]
lea ecx, [ebp - 0x83c]
mov dword [ebp - 0x828], esi
call fcn.0ed1769b
test eax, eax
jne 0xed0d888
mov eax, dword [ebp - 0x828]
mov dword [ebx], eax
add edi, 4
add ebx, 4
cmp edi, 0x28
jb 0xed0d859
mov edi, dword [ebp - 0x82c]
xor ebx, ebx
cmp dword [edi], 0xffffffff
jne 0xed0d8ca
lea eax, [ebp - 0x828]
push eax
push dword [ebx + 0xed3f9ac]
lea ecx, [ebp - 0x848]
mov dword [ebp - 0x828], esi
call fcn.0ed1769b
test eax, eax
jne 0xed0d8ca
mov eax, dword [ebp - 0x828]
mov dword [edi], eax
add ebx, 4
add edi, 4
cmp ebx, 0x28
jb 0xed0d89b
lea ecx, [ebp - 0x83c]
call fcn.0ed028b1
lea ecx, [ebp - 0x848]
call fcn.0ed028b1
jmp 0xed027b8
add eax, 4
add ecx, 4
cmp dx, si
je 0xed0c3b9
jmp 0xed027ce
mov eax, dword [ebp - 0x858]
mov dword [eax + 0xc], 1
jmp 0xed0280b
cmp dx, si
je 0xed0d938
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0xed027fe
add eax, 4
add ecx, 4
cmp dx, si
jne 0xed027f2
xor eax, eax
jmp 0xed02803
mov eax, dword [ebp - 0x82c]
mov dword [eax], esi
jmp 0xed0280b