Function at 0x100245c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10042fe5
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100c2004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi + 0x38], 1
jne 0x10024891
mov edx, dword [esi + 0x30]
lea ecx, [esi + 0x20]
mov eax, 0x7ffffffe
sub eax, edx
cmp eax, 5
jb 0x10024896
cmp dword [ecx + 0x14], 8
jb 0x1002461b
mov ecx, dword [ecx]
push 5
push str.Mods
push edx
push ecx
push ecx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x4c]
call fcn.100069f0
push 0
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
cmp dword [ebp - 0x38], 8
lea eax, [ebp - 0x4c]
push ecx
cmovae eax, dword [ebp - 0x4c]
push 0
push 0x20119
push 0
push 0
push 0
push eax
push dword [esi + 0x1c]
mov dword [ebp - 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp + 4]
test eax, eax
jne 0x1002489b
xorps xmm0, xmm0
mov dword [ebp - 0x20], eax
movups xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
mov al, 1
mov byte [ebp - 4], 3
mov byte [ebp - 0x51], al
xor edi, edi
mov dword [ebp - 0x58], edi
test al, al
je 0x10024745
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
push 0
push 0
push 0
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [ebp + 4]
test eax, eax
jne 0x100248bd
mov ecx, dword [ebp - 0x34]
mov esi, dword [ebp - 0x20]
add ecx, 1
setb al
neg eax
or eax, ecx
cmp eax, esi
ja 0x100246ef
cmp dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x20], eax
cmovae ecx, dword [ebp - 0x30]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x10024741
mov edi, dword [ebp - 0x1c]
mov edx, eax
mov ecx, edi
sub edx, esi
sub ecx, esi
cmp edx, ecx
ja 0x10024730
cmp edi, 8
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
lea edi, [eax + esi*2]
test edx, edx
je 0x10024722
xor eax, eax
mov ecx, edx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x50]
lea eax, [esi + edx]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x1002473e
push ecx
push edx
push dword [ebp - 0x18]
lea ecx, [ebp - 0x30]
push edx
call fcn.10004fe0
mov edi, dword [ebp - 0x58]
mov byte [ebp - 0x51], 0
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x18]
push 0
push 0
inc eax
cmp dword [ebp - 0x1c], 8
push 0
push 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
cmovae eax, dword [ebp - 0x30]
push ecx
push eax
push edi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x100247b6
cmp eax, 0xea
je 0x10024699
mov ecx, dword [ebp + 4]
test eax, eax
jne 0x100248ac
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
mov ecx, dword [ebp + 0x2c]
cmovae eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
test ecx, ecx
je 0x100248a7
mov eax, dword [ecx]
lea edx, [ebp - 0x50]
push edx
call dword [eax + 8]
mov al, byte [ebp - 0x51]
inc edi
jmp 0x1002468e
mov ecx, dword [ebp - 0x1c]
cmp ecx, 8
jb 0x100247f0
mov edx, dword [ebp - 0x30]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100247e6
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100248b8
push ecx
push edx
call fcn.1002dd79
add esp, 8
xor eax, eax
mov dword [ebp - 0x20], 0
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 7
test eax, eax
je 0x10024812
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x38]
cmp ecx, 8
jb 0x10024848
mov edx, dword [ebp - 0x4c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1002483e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100248b8
push ecx
push edx
call fcn.1002dd79
add esp, 8
mov ecx, dword [ebp + 0x2c]
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
test ecx, ecx
je 0x10024874
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002db4b
mov esp, ebp
pop ebp
ret 0x28
call fcn.10027870
call fcn.10004e80
push eax
push ecx
mov edx, 0x142
call fcn.10026150
call fcn.1002d064
push eax
push ecx
mov edx, 0x162
call fcn.10026150
call fcn.10033a4a
push eax
push ecx
mov edx, 0x14e
call fcn.10026150
int3