Function at 0x1004c950
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8238
call fcn.1004e500
mov eax, dword [0x1008c224]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x8224], eax
xor eax, eax
push 1
push ebx
mov dword [ebp - 0x8228], edi
mov dword [ebp - 0x821c], ebx
mov dword [ebp - 0x822c], ecx
mov dword [ebp - 0x8218], eax
mov dword [ebp - 0x8210], eax
mov byte [ebp - 0x8205], al
mov byte [ebp - 0x8206], 1
call sym.vmtools.dll_Unicode_GetAllocBytes
add esp, 8
lea edx, [ebp - 0x820c]
push edx
push 9
push 0
mov esi, eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
mov edi, eax
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
test edi, edi
je 0x1004ca00
push ebx
push edi
push 0x100794c0
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s_n
call fcn.10003450
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x820c]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x8218]
push eax
push 0
push 0
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test esi, esi
jne 0x1004cbc1
mov eax, dword [ebp - 0x8218]
test eax, eax
jne 0x1004ca58
push ebx
lea esi, [eax + 0x32]
push esi
push 0x100794c0
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s_n
call fcn.10003450
add esp, 0x10
jmp 0x1004cbc1
mov dword [ebp - 0x8214], 0
test eax, eax
jbe 0x1004cbc1
jmp 0x1004ca76
mov ebx, dword [ebp - 0x821c]
xor edx, edx
push 0x1fc
push edx
lea eax, [ebp - 0x202]
push eax
mov word [ebp - 0x204], dx
call sub.MSVCR90.dll_memset
xor ecx, ecx
push 0x7ffc
push ecx
lea edx, [ebp - 0x8202]
push edx
mov word [ebp - 0x8204], cx
call sub.MSVCR90.dll_memset
add esp, 0x18
lea eax, [ebp - 0x8238]
push eax
lea ecx, [ebp - 0x8220]
push ecx
lea edx, [ebp - 0x8204]
push edx
mov edx, dword [ebp - 0x8214]
push 0
lea eax, [ebp - 0x8230]
push eax
mov eax, dword [ebp - 0x820c]
lea ecx, [ebp - 0x204]
push ecx
push edx
push eax
mov dword [ebp - 0x8230], 0xff
mov dword [ebp - 0x8220], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x1004cba4
push 1
lea ecx, [ebp - 0x204]
push 0xffffffffffffffff
push ecx
call sym.vmtools.dll_Unicode_AllocWithLength
push 1
lea edx, [ebp - 0x8204]
push 0xffffffffffffffff
push edx
mov edi, eax
call sym.vmtools.dll_Unicode_AllocWithLength
mov ecx, dword [ebp - 0x822c]
mov ebx, eax
lea eax, [ebp - 0x8206]
push eax
mov eax, dword [ebp - 0x821c]
push ecx
mov ecx, dword [ebp - 0x8228]
lea edx, [ebp - 0x8238]
push edx
push ebx
push edi
push eax
push ecx
call dword [ebp - 0x8224]
push ebx
mov ebx, dword [sym.imp.MSVCR90.dll_free]
mov esi, eax
call ebx
push edi
call ebx
add esp, 0x3c
cmp byte [ebp - 0x8206], 0
je 0x1004cbb8
cmp byte [ebp - 0x8205], 0
jne 0x1004cb89
test esi, esi
je 0x1004cb89
mov dword [ebp - 0x8210], esi
mov byte [ebp - 0x8205], 1
mov eax, dword [ebp - 0x8214]
inc eax
mov dword [ebp - 0x8214], eax
cmp eax, dword [ebp - 0x8218]
jb 0x1004ca70
jmp 0x1004cbb8
push ebx
push esi
push 0x100794c0
push str._s:_A_Windows_registry_operation_failed:__d._key_path:__s_n
call fcn.10003450
add esp, 0x10
cmp byte [ebp - 0x8205], 0
jne 0x1004cbc7
mov dword [ebp - 0x8210], esi
mov edx, dword [ebp - 0x820c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x8210]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e3f2
mov esp, ebp
pop ebp
ret