Function at 0x10027da2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007078f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028066
lea eax, [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x1002805e
mov dword [ebp - 0x48], 0x7229
mov dword [ebp - 0x54], 0x100085bc
cmp dword [ebp - 0x48], 0x75b3
jle 0x10027e82
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
and dword [ebp - 0x20], 0
jmp 0x10027e22
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x798e
jge 0x10027e82
and dword [ebp - 0x24], 0
jmp 0x10027e38
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7d07
jge 0x10027e80
mov eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x84]
call fcn.1000a83a
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
call fcn.1000ef04
push eax
call fcn.10057a33
pop ecx
lea ecx, [ebp - 0x84]
call fcn.1000eefa
jmp 0x10027e31
jmp 0x10027e1b
mov dword [ebp - 0x18], 0xffffffff
push 3
lea ecx, [ebp - 0x6c]
call fcn.1000f17c
and dword [ebp - 4], 0
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x28], 0
jmp 0x10027eae
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10027ec7
push dword [ebp - 0x28]
lea ecx, [ebp - 0x6c]
call fcn.1000f21a
mov dword [eax], 0xfffffffe
jmp 0x10027ea7
cmp dword [ebp - 0x18], 0
je 0x10027ee3
cmp dword [ebp - 0x18], 0
je 0x10027ee3
push 9
pop eax
test eax, eax
je 0x10027ee3
mov dword [ebp - 0x30], 1
jmp 0x10027ee7
and dword [ebp - 0x30], 0
cmp dword [ebp - 0x30], 1
jge 0x10027ef1
cmp dword [ebp - 0x18], 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.1000f21a
imul eax, dword [eax], 0x9869
test eax, eax
je 0x10027f0b
cmp dword [ebp - 0x18], 0
jne 0x10027f20
push 2
lea ecx, [ebp - 0x6c]
call fcn.1000f21a
cmp dword [eax], 0
jne 0x10027f20
and dword [ebp - 0x34], 0
jmp 0x10027f27
mov dword [ebp - 0x34], 1
cmp dword [ebp - 0x34], 0xe441
jge 0x10027f39
mov dword [ebp - 0x38], 1
jmp 0x10027f3d
and dword [ebp - 0x38], 0
cmp dword [ebp - 0x38], 0x9193
jge 0x10027f4f
mov dword [ebp - 0x3c], 1
jmp 0x10027f53
and dword [ebp - 0x3c], 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.1000f21a
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [eax]
jle 0x10027f6d
mov dword [ebp - 0x40], 1
jmp 0x10027f71
and dword [ebp - 0x40], 0
cmp dword [ebp - 0x40], 0x2806
jge 0x10027f83
mov dword [ebp - 0x44], 1
jmp 0x10027f87
and dword [ebp - 0x44], 0
push 0
lea ecx, [ebp - 0x6c]
call fcn.1000f21a
mov ecx, dword [ebp - 0x44]
add ecx, dword [eax]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 2
jmp 0x10027fa9
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10028011
mov dword [ebp - 0x18], 2
jmp 0x10027fbf
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x10027ffd
mov dword [ebp - 0x2c], 0xb597857
mov dword [ebp - 0x2c], 0
jmp 0x10027fdc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10027ffb
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10027ff9
push 1
push 1
call fcn.100245fe
pop ecx
pop ecx
jmp 0x10027fd5
jmp 0x10027fb8
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6c]
call fcn.1000f21a
cmp dword [eax], 0
je 0x1002800f
jmp 0x10027fa2
jmp 0x10027fa2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000f1fe
mov dword [ebp - 4], 1
cmp dword [ebp - 0x48], 0x7132
jge 0x10028036
push dword [ebp - 0x54]
call fcn.10057a33
pop ecx
jmp 0x10028052
or dword [ebp - 4], 0xffffffff
jmp 0x1002805c
jmp 0x10028064
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x10028097
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
push 1
push 0x453c
push 0x6923
push 0x2135
push 0x504c
push 0x5bc6
push 0x7883
call fcn.10016a55
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret