Function at 0x10075fb
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x100a018]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
push edi
mov dword [ebp - 0x2b4], ecx
lea ecx, [ebp - 0x2a4]
push ecx
lea ecx, [ebp - 0x2ac]
push ecx
lea ecx, [ebp - 0x2a8]
push ecx
xor esi, esi
push esi
push dword [0x100a03c]
mov dword [ebp - 0x2c0], eax
push eax
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2a4], 4
call ebx
mov edi, eax
cmp edi, esi
jne 0x10079e3
mov eax, dword [ebp - 0x2b4]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 0x2ac]
cmp ecx, dword [eax + 8]
je 0x1007682
push 0xd
pop edi
jmp 0x10079e3
push 0x20a
lea eax, [ebp - 0x290]
push esi
push eax
mov dword [ebp - 0x2a8], esi
mov dword [ebp - 0x2a4], 0x208
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x2a8]
push eax
push esi
push dword [0x100a040]
push dword [ebp - 0x2c0]
call ebx
mov edi, eax
cmp edi, esi
jne 0x10079e3
mov eax, dword [ebp - 0x2b4]
push dword [eax + 0x18]
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
lea eax, [ebp - 0x290]
push eax
call edi
pop ecx
pop ecx
test eax, eax
je 0x1007758
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp + eax*2 - 0x292]
cmp word [eax], 0x5c
je 0x100767a
lea ecx, [ebp - 0x290]
cmp eax, ecx
jb 0x100767a
cmp word [eax], 0x5c
je 0x1007731
dec eax
dec eax
lea ecx, [ebp - 0x290]
cmp eax, ecx
jae 0x100771f
lea ecx, [ebp - 0x290]
cmp eax, ecx
jb 0x100767a
mov ecx, dword [ebp - 0x2b4]
push dword [ecx + 0x18]
add eax, 2
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x100767a
push 0x80
lea eax, [ebp - 0x84]
push esi
push eax
mov dword [ebp - 0x2b0], esi
mov dword [ebp - 0x2a4], 0x40
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x84]
push eax
push esi
jmp 0x100799c
inc dword [ebp - 0x2b0]
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x2a4]
lea eax, [ebp - 0x84]
push eax
call fcn.01006b2e
mov edi, eax
cmp edi, esi
jne 0x10079b7
lea eax, [ebp - 0x2a0]
push eax
push dword [ebp - 0x2b4]
call fcn.010075ca
mov dword [ebp - 0x2bc], eax
cmp eax, esi
je 0x10079b4
lea eax, [ebp - 0x2b8]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x2c0]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x10079b7
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x2a8]
push eax
push esi
push dword [0x100a044]
mov dword [ebp - 0x2a8], esi
push dword [ebp - 0x2b8]
mov dword [ebp - 0x2a4], 4
call ebx
mov edi, eax
cmp edi, esi
jne 0x1007955
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x2bc]
cmp eax, dword [ecx + 0x24]
jne 0x1007952
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x2a8]
push eax
push esi
push dword [0x100a048]
mov dword [ebp - 0x2a8], esi
push dword [ebp - 0x2b8]
mov dword [ebp - 0x2a4], 4
call ebx
mov edi, eax
cmp edi, esi
jne 0x1007955
mov eax, dword [ebp - 0x2ac]
mov ecx, dword [ebp - 0x2bc]
cmp eax, dword [ecx + 0x28]
jne 0x1007952
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x2a8]
push eax
push esi
push dword [0x100a04c]
mov dword [ebp - 0x2a8], esi
push dword [ebp - 0x2b8]
mov dword [ebp - 0x2a4], 4
call ebx
mov edi, eax
cmp edi, esi
jne 0x1007955
mov eax, dword [ebp - 0x2bc]
mov eax, dword [eax + 0x1c]
mov ecx, dword [ebp - 0x2ac]
cmp ecx, dword [eax + 8]
jne 0x1007952
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x2a8]
push eax
push esi
push dword [0x100a050]
mov dword [ebp - 0x2a8], esi
push dword [ebp - 0x2b8]
mov dword [ebp - 0x2a4], 4
call ebx
mov edi, eax
cmp edi, esi
jne 0x1007955
mov eax, dword [ebp - 0x2bc]
mov eax, dword [eax + 4]
xor ecx, ecx
jmp 0x1007946
mov eax, dword [eax]
inc ecx
cmp eax, esi
jne 0x1007943
cmp dword [ebp - 0x2ac], ecx
je 0x1007955
push 0xd
pop edi
push dword [ebp - 0x2b8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x10079b7
push 0x80
lea eax, [ebp - 0x84]
push esi
push eax
mov dword [ebp - 0x2a4], 0x40
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x2b0]
push dword [ebp - 0x2c0]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
je 0x1007795
jmp 0x10079b7
push 0xd
pop edi
cmp edi, 0x103
jne 0x10079e3
mov eax, dword [ebp - 0x2b4]
mov eax, dword [eax + 4]
jmp 0x10079d2
dec dword [ebp - 0x2b0]
mov eax, dword [eax]
cmp eax, esi
jne 0x10079ca
mov edi, dword [ebp - 0x2b0]
neg edi
sbb edi, edi
and edi, 0xd
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010055b7
leave
ret 8