Function at 0x105c6d7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], ebx
je 0x105c763
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test byte [ebp + 0x10], 1
je 0x105c734
cmp eax, 2
je 0x105c71f
cmp eax, 3
jne 0x105c734
cmp eax, ebx
jle 0x105c72d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x105c8e8
cmp eax, ebx
je 0x105c769
jle 0x105c744
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0xc]
mov edi, eax
push 0x102f028
push 1
push edi
push 0x4000000
call fcn.0104ea05
add esp, 0x14
jmp 0x105c8e8
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x105c81f
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0105ca2c
mov edi, eax
cmp edi, ebx
jge 0x105c791
push 0x102f184
push 1
push edi
jmp 0x105c7e0
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x105c7f2
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 1
je 0x105c868
cmp dword [ebp - 0xc], 2
je 0x105c868
push 0x102f15c
mov eax, 0x8007000d
push 1
mov edi, eax
push eax
push 0x4000000
call fcn.0104ea05
add esp, 0x10
jmp 0x105c8e7
cmp eax, 0xea
je 0x105c7bd
test byte [ebp + 0x10], 1
je 0x105c804
cmp eax, 2
je 0x105c840
cmp eax, ebx
jle 0x105c812
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x102f108
jmp 0x105c8bd
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test byte [ebp + 0x10], 1
je 0x105c84a
cmp eax, 2
jne 0x105c84a
mov edi, 0x80070002
jmp 0x105c8e7
cmp eax, ebx
je 0x105c7bd
jle 0x105c85e
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x102f0b8
jmp 0x105c8bd
cmp dword [ebp - 0x14], ebx
jne 0x105c8d1
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
inc eax
push eax
push esi
mov dword [ebp - 0x10], eax
call fcn.0105ca9b
mov edi, eax
cmp edi, ebx
jge 0x105c88e
push dword [ebp + 0x14]
push 0x102f07c
jmp 0x105c8bf
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x105c8d1
jle 0x105c8b5
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x102f058
mov edi, eax
push 1
push edi
push 0x4000000
call fcn.0104ea05
add esp, 0x14
jmp 0x105c8e7
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov word [eax + edx*2 - 4], cx
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
mov word [eax + edx*2 - 2], cx
pop esi
cmp dword [ebp + 0xc], ebx
je 0x105c8fb
cmp dword [ebp - 4], ebx
je 0x105c8fb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0x14