Function at 0x1013593
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x1016034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x220], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
push 3
pop edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], 0x1007c04
mov dword [ebp - 0x25c], 4
mov dword [ebp - 0x258], 0x1007bf4
mov dword [ebp - 0x254], 1
mov dword [ebp - 0x250], 0x1007bdc
mov dword [ebp - 0x24c], 2
mov dword [ebp - 0x248], 0x1007bc4
mov dword [ebp - 0x244], 5
mov dword [ebp - 0x240], 0x1007bb4
cmp edi, ebx
je 0x1013cdf
xor eax, eax
cmp ax, word [edi]
je 0x1013cdf
push esi
cmp dword [0x10160bc], ebx
je 0x10136df
mov al, byte [0x10160c0]
cmp byte [0x1016081], bl
je 0x101367c
cmp al, 4
jae 0x1013671
cmp al, bl
jne 0x10136df
test byte [0x10160b8], 3
jne 0x10136ba
jmp 0x10136df
cmp al, 4
jae 0x1013684
cmp al, bl
jne 0x10136df
mov eax, dword [0x10160a8]
mov ecx, dword [0x10160ac]
and eax, edx
and ecx, 0x80000000
or eax, ecx
je 0x10136df
mov eax, dword [0x10160b0]
mov esi, dword [0x10160b4]
mov ecx, eax
and ecx, edx
mov edx, esi
and edx, 0x80000000
cmp ecx, eax
jne 0x10136df
cmp edx, esi
jne 0x10136df
push dword [ebp + 0xc]
call fcn.01012f6d
push eax
push edi
push 0x1001340
push 0x1001360
push dword [0x1016094]
push dword [0x1016090]
call fcn.01012d6b
mov esi, dword [ebp + 0xc]
xor eax, eax
cmp esi, dword [ebp + eax*8 - 0x264]
je 0x10136f3
inc eax
cmp eax, 5
jb 0x10136e4
push ebx
push ebx
cmp eax, 5
jae 0x1013bff
mov eax, dword [ebp + eax*8 - 0x260]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x112
push ebx
push 0x100147c
mov edi, 0xf0000
push edi
push dword [ebp - 0x214]
push 0x1007b58
push 0x400008a
call fcn.01007def
add esp, 0xc
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
push dword [ebp - 0x22c]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01012931
cmp eax, ebx
jl 0x1013bb5
push dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01013552
cmp eax, ebx
jl 0x1013bb5
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call fcn.0100d6cf
cmp eax, 1
jne 0x1013b7b
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebx
mov dword [ebp - 0x210], eax
push ebx
cmp eax, ebx
jne 0x1013b3b
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x220]
mov dword [ebp - 0x234], ebx
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x228], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x210], eax
cmp eax, ebx
jne 0x1013ae4
cmp dword [ebp - 0x234], ebx
jbe 0x1013aa8
cmp dword [ebp - 0x228], ebx
jbe 0x1013aa8
cmp dword [ebp - 0x224], ebx
jbe 0x1013aa8
push dword [ebp - 0x224]
mov dword [ebp - 0x218], ebx
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x21c], eax
cmp eax, ebx
je 0x1013a29
mov eax, dword [ebp - 0x228]
lea eax, [eax + eax + 2]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x218], eax
cmp eax, ebx
je 0x1013a29
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x210], ebx
cmp dword [ebp - 0x210], ebx
jne 0x1013a69
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x22c], eax
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x23c], eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x21c]
lea eax, [ebp - 0x230]
push eax
push ebx
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0x218]
mov dword [ebp - 0x230], ebx
push dword [ebp - 0x214]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc dword [ebp - 0x214]
mov dword [ebp - 0x238], eax
cmp eax, ebx
jne 0x10139cd
cmp dword [ebp - 0x230], 1
jne 0x1013989
cmp dword [ebp - 0x22c], ebx
jbe 0x1013989
push ebx
push ebx
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x16a
push ebx
push 0x100147c
push edi
push dword [ebp - 0x21c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x218]
push eax
push 0x1007b08
push 0x400008b
call fcn.01007def
add esp, 0x14
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
push dword [ebp - 0x21c]
call fcn.01012fb5
mov dword [ebp - 0x210], eax
jmp 0x10138a3
push ebx
push ebx
mov dword [ebp - 0x210], 0xb
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x177
push ebx
push 0x100147c
push edi
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
push 0x1007ab0
push 0x200008c
jmp 0x1013a16
cmp eax, 0x103
je 0x1013a69
push ebx
push ebx
mov dword [ebp - 0x210], eax
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x187
push ebx
push 0x100147c
push edi
push dword [ebp - 0x238]
lea eax, [ebp - 0x20c]
push eax
push 0x1007a58
push 0x200008d
call fcn.01007def
add esp, 0x10
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
jmp 0x10138a3
call esi
push ebx
push ebx
mov dword [ebp - 0x210], eax
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x195
push ebx
push 0x100147c
push edi
push 0x1007a20
push 0x200008e
call fcn.01007def
pop ecx
pop ecx
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp - 0x21c], ebx
je 0x1013a87
push dword [ebp - 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
cmp dword [ebp - 0x218], ebx
je 0x1013b2a
push dword [ebp - 0x218]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call esi
jmp 0x1013b2a
push ebx
push ebx
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x1af
push ebx
push 0x100147c
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x10079e0
push 0x300008f
call fcn.01007def
add esp, 0xc
jmp 0x1013b24
push ebx
push ebx
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x1b5
push ebx
push 0x100147c
push edi
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push 0x1007998
push 0x2000090
call fcn.01007def
add esp, 0x10
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1013c49
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x1c0
push ebx
push 0x100147c
push edi
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
push 0x1007948
push 0x2000091
call fcn.01007def
add esp, 0x10
jmp 0x1013bf7
push ebx
push ebx
mov dword [ebp - 0x210], ebx
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x1c6
push ebx
push 0x100147c
push edi
lea eax, [ebp - 0x20c]
push eax
push 0x10078f8
push 0x3000092
jmp 0x1013bef
movzx eax, ax
push ebx
push ebx
mov dword [ebp - 0x210], eax
call esi
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x1cc
push ebx
push 0x100147c
push edi
push dword [ebp - 0x210]
push 0x10078a8
push 0x2000093
call fcn.01007def
add esp, 0xc
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
jmp 0x1013c49
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call sub.WDSCORE.dll_CurrentIP
push eax
push 0x1007b94
push 0x10077e8
push 0x1d3
push ebx
push 0x100147c
push 0xf0000
push esi
push 0x1007870
push 0x2000094
call fcn.01007def
add esp, 0xc
push eax
call sub.WDSCORE.dll_WdsSetupLogMessageW
mov dword [ebp - 0x210], 0x57
cmp dword [0x10160bc], ebx
je 0x1013cd6
mov al, byte [0x10160c0]
cmp byte [0x1016081], bl
je 0x1013c75
cmp al, 4
jae 0x1013c6a
cmp al, bl
jne 0x1013cd6
test byte [0x10160b8], 3
jne 0x1013cb5
jmp 0x1013cd6
cmp al, 4
jae 0x1013c7d
cmp al, bl
jne 0x1013cd6
mov eax, dword [0x10160a8]
mov ecx, dword [0x10160ac]
and eax, 3
and ecx, 0x80000000
or eax, ecx
je 0x1013cd6
mov eax, dword [0x10160b0]
mov esi, dword [0x10160b4]
mov ecx, eax
mov edx, esi
and ecx, 3
and edx, 0x80000000
cmp ecx, eax
jne 0x1013cd6
cmp edx, esi
jne 0x1013cd6
push dword [ebp - 0x210]
push 0x1001340
push 0x1001370
push dword [0x1016094]
push dword [0x1016090]
call fcn.01011526
mov eax, dword [ebp - 0x210]
pop esi
jmp 0x1013ce2
push 0x57
pop eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.0100a4c9
leave
ret 8