Function at 0x1042d65
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x404
mov eax, 0x1057b19
call fcn.01022105
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x400], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
mov dword [ebp - 0x3e8], ebx
mov dword [ebp - 0x3dc], edi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3cc]
call fcn.010155dc
mov byte [ebp - 4], 2
push dword [ebp + 8]
push 0x100ef20
push 1
call fcn.0103aac4
add esp, 0xc
push 0x100ef04
call dword [fcn.01001130]
cmp eax, ebx
mov dword [ebp - 0x3f4], eax
jne 0x1042dd7
call dword [fcn.0100131c]
mov esi, eax
jmp 0x1043203
push 0x100eeec
push eax
call dword [fcn.0100112c]
cmp eax, ebx
mov dword [ebp - 0x3f8], eax
jne 0x1042dfa
call dword [fcn.0100131c]
mov esi, eax
jmp 0x10431f7
lea eax, [ebp - 0x3e8]
push eax
push ebx
push 0x104
lea eax, [ebp - 0x3a8]
push eax
push 8
push 1
push ebx
push dword [ebp + 8]
call dword [fcn.01001410]
test eax, eax
jne 0x10431e0
mov esi, dword [fcn.0100131c]
call esi
cmp eax, 0x50
jne 0x10431e0
push dword [ebp - 0x3e8]
lea ecx, [ebp - 0x3cc]
call fcn.01015d13
lea ecx, [ebp - 0x3dc]
call fcn.010424f9
mov edi, dword [ebp - 0x3dc]
push 4
push ebx
push ebx
push ebx
mov ecx, edi
call fcn.0104510d
test eax, eax
je 0x10431f2
lea ecx, [ebp - 0x3c4]
push ecx
mov dword [ebp - 0x3c4], 0x1c
mov eax, dword [edi + 8]
push ebx
push eax
mov dword [ebp - 0x3ec], ebx
mov dword [ebp - 0x3e4], ebx
mov dword [ebp - 0x3e0], ebx
call dword [fcn.010013c4]
jmp 0x10431c4
inc dword [ebp - 0x3e0]
or dword [ebp - 0x3d4], 0xffffffff
lea ecx, [ebp - 0x3c8]
call fcn.010155dc
mov byte [ebp - 4], 3
mov eax, dword [edi + 8]
push ebx
push 0xc8
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x3c4]
push ecx
push eax
mov dword [ebp - 0x3f0], ebx
call dword [0x10013bc]
test eax, eax
jne 0x1042eeb
call esi
mov esi, eax
jmp 0x1043160
mov eax, dword [edi + 8]
push 0x20019
push 2
push ebx
push 1
lea ecx, [ebp - 0x3c4]
push ecx
push eax
call dword [fcn.010013c0]
cmp eax, 0xffffffff
mov dword [ebp - 0x3d8], eax
jne 0x1042f64
call esi
mov esi, eax
mov eax, 0xe0000000
mov ecx, esi
and ecx, eax
cmp ecx, eax
mov eax, esi
jne 0x1042f30
and eax, 0xffff
or eax, 0x800f0000
jmp 0x1042f3e
cmp esi, ebx
jle 0x1042f3e
and eax, 0xffff
or eax, 0x80070000
cmp eax, 0x800f0204
je 0x1043198
lea eax, [ebp - 0x1a0]
push eax
push 0x100ee98
push 2
call fcn.0103aac4
add esp, 0xc
jmp 0x1043160
push 0x104
lea ecx, [ebp - 0x3c8]
call fcn.01015aa6
lea ecx, [ebp - 0x3fc]
push ecx
push eax
push ebx
push ebx
push 0x100ea6c
push dword [ebp - 0x3d8]
mov dword [ebp - 0x3fc], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1042fc9
call esi
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
mov esi, eax
call fcn.01015124
lea eax, [ebp - 0x1a0]
push eax
push 0x100ee40
push 2
call fcn.0103aac4
add esp, 0xc
jmp 0x104314c
push 0xffffffffffffffff
lea ecx, [ebp - 0x3c8]
call fcn.01015124
push dword [ebp - 0x3c8]
lea ecx, [ebp - 0x3cc]
call fcn.01014f10
test eax, eax
jne 0x1043135
lea eax, [ebp - 0x1a0]
push eax
push 0x100edc0
push 1
call fcn.0103aac4
add esp, 0xc
push ebx
push dword [ebp - 0x3b0]
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x404]
push eax
mov dword [ebp - 0x3f0], 1
call dword [0x10013c8]
cmp eax, 0xd
je 0x10430c8
cmp eax, 0x25
je 0x10430c8
lea eax, [ebp - 0x1a0]
push eax
push 0x100ed18
push 1
call fcn.0103aac4
add esp, 0xc
push ebx
push ebx
call dword [0x10013b4]
cmp eax, 0xffffffff
mov dword [ebp - 0x3d4], eax
jne 0x104306e
call esi
mov esi, eax
jmp 0x104314c
push dword [ebp - 0x400]
lea eax, [ebp - 0x1a0]
push dword [ebp - 0x3f8]
push ecx
mov ecx, esp
mov dword [ebp - 0x408], esp
push eax
call fcn.01016a0f
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3cc]
call fcn.01014f3a
push ecx
mov ecx, esp
mov dword [ebp - 0x410], esp
push eax
call fcn.01016a0f
mov byte [ebp - 4], 5
push dword [ebp - 0x3d4]
mov byte [ebp - 4], 3
call fcn.01042358
mov esi, eax
cmp esi, ebx
jne 0x1043137
jmp 0x1043135
lea eax, [ebp - 0x1a0]
push eax
push 0x100ec88
push 1
call fcn.0103aac4
add esp, 0xc
push ebx
push 4
lea ecx, [ebp - 0x3d0]
push ecx
push ebx
push 0xa
lea ecx, [ebp - 0x3c4]
mov dword [ebp - 0x3d0], ebx
mov eax, dword [edi + 8]
push ecx
push eax
call dword [0x10013e8]
test eax, eax
je 0x1043065
or dword [ebp - 0x3d0], 0x20
mov eax, dword [edi + 8]
push 4
lea ecx, [ebp - 0x3d0]
push ecx
push 0xa
lea ecx, [ebp - 0x3c4]
push ecx
push eax
call dword [0x10013cc]
test eax, eax
je 0x1043065
xor esi, esi
cmp dword [ebp - 0x3d4], 0xffffffff
je 0x104314c
push dword [ebp - 0x3d4]
call dword [fcn.01001430]
cmp dword [ebp - 0x3d8], ebx
je 0x1043160
push dword [ebp - 0x3d8]
call dword [entry0]
cmp esi, ebx
je 0x1043198
cmp dword [ebp - 0x3f0], ebx
je 0x104318e
lea eax, [ebp - 0x1a0]
push eax
push 0x100ec30
push 3
call fcn.0103aac4
add esp, 0xc
mov dword [ebp - 0x3ec], 1
jmp 0x1043198
mov dword [ebp - 0x3e4], 1
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3c8]
call fcn.010151a6
mov eax, dword [edi + 8]
lea ecx, [ebp - 0x3c4]
push ecx
push dword [ebp - 0x3e0]
push eax
call dword [fcn.010013c4]
mov esi, dword [fcn.0100131c]
test eax, eax
jne 0x1042e9e
call esi
cmp eax, 0x103
je 0x10431dc
call esi
jmp 0x1042df3
xor esi, esi
jmp 0x10431f7
push dword [ebp + 8]
push 0x100ebc0
push 3
call fcn.0103aac4
add esp, 0xc
mov esi, 0x65b
push dword [ebp - 0x3f4]
call dword [fcn.01001108]
cmp esi, ebx
jne 0x1043238
cmp dword [ebp - 0x3ec], ebx
je 0x1043222
push 0x100eb10
push 3
call fcn.0103aac4
mov esi, 0x643
jmp 0x1043236
cmp dword [ebp - 0x3e4], ebx
je 0x1043238
push 0x100ea80
push 2
call fcn.0103aac4
pop ecx
pop ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3cc]
call fcn.010151a6
mov byte [ebp - 4], bl
cmp edi, ebx
je 0x104325b
mov ecx, edi
call fcn.0101ab3d
mov dword [ebp - 0x3dc], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.010151a6
mov eax, esi
call fcn.01022197
ret 8