Function at 0x100430d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4ac
mov eax, dword [0x100702c]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x47c]
push eax
push 0x20019
xor esi, esi
push esi
mov ebx, ecx
push 0x1001348
mov edi, 0x80000002
push edi
mov dword [ebp - 0x480], ebx
mov dword [ebx], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1004379
push esi
lea eax, [ebp - 0x47c]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push 0x1001348
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1004379
xor eax, eax
jmp 0x1004771
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push 0x12c
lea eax, [ebp - 0x464]
push eax
mov dword [ebp - 0x478], esi
push esi
jmp 0x10043ae
inc dword [ebp - 0x478]
inc dword [ebx]
push 0x12c
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 0x478]
push dword [ebp - 0x47c]
call edi
test eax, eax
je 0x1004394
mov eax, dword [ebx]
cmp eax, esi
je 0x1004760
imul eax, eax, 0x14d0
push 1
push eax
mov edi, 0x10014f4
push edi
mov dword [ebp - 0x474], eax
call fcn.01001e79
cmp eax, esi
mov dword [0x100752c], eax
jne 0x10043ee
mov dword [ebx], esi
jmp 0x1004763
lea eax, [ebp - 0x490]
push eax
push 0xf001f
push dword [ebp - 0x474]
push edi
call fcn.01001ed6
mov edi, eax
cmp edi, esi
mov dword [ebp - 0x484], edi
jne 0x1004425
push dword [0x100752c]
call fcn.01001f50
mov dword [0x100752c], esi
jmp 0x10043e7
mov ecx, dword [ebp - 0x474]
mov edx, ecx
shr ecx, 2
xor eax, eax
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
push 1
rep stosb byte es:[edi], al
mov dword [ebp - 0x478], esi
mov dword [ebp - 0x474], esi
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, dword [ebp - 0x484]
push 0x12c
push edi
push esi
push dword [ebp - 0x47c]
mov dword [ebp - 0x488], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1004730
add edi, 0x4b8
inc dword [ebp - 0x478]
lea ecx, [ebp - 0x468]
push ecx
push 0x20019
push esi
lea eax, [edi - 0x4b8]
push eax
push dword [ebp - 0x47c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004704
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x470]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x46c]
push eax
push esi
push 0x1001324
push dword [ebp - 0x468]
mov dword [ebp - 0x470], 0x208
call ebx
test eax, eax
jne 0x10046f2
cmp dword [ebp - 0x46c], 1
jne 0x10046f2
push esi
push esi
push 3
push esi
push esi
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x10046f2
lea ecx, [ebp - 0x470]
push ecx
lea eax, [edi - 0x260]
push eax
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x46c]
push eax
push esi
push 0x1001788
push dword [ebp - 0x468]
mov dword [ebp - 0x470], 0x258
call ebx
test eax, eax
jne 0x100454f
cmp dword [ebp - 0x46c], 1
je 0x1004562
lea eax, [edi - 0x4b8]
push eax
push dword [ebp - 0x48c]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x470]
push ecx
lea eax, [edi - 8]
push eax
lea eax, [ebp - 0x46c]
push eax
push esi
push 0x1001764
push dword [ebp - 0x468]
mov dword [ebp - 0x470], 4
call ebx
test eax, eax
jne 0x10046f2
push 4
pop ecx
cmp dword [ebp - 0x46c], ecx
jne 0x10046f2
mov eax, dword [edi - 8]
cmp eax, 1
je 0x10045b4
cmp eax, 2
jne 0x10046f2
lea eax, [ebp - 0x470]
push eax
lea eax, [edi - 4]
push eax
lea eax, [ebp - 0x46c]
push eax
push esi
push 0x100173c
push dword [ebp - 0x468]
mov dword [ebp - 0x470], ecx
call ebx
test eax, eax
jne 0x10046f2
cmp dword [ebp - 0x46c], 4
jne 0x10046f2
mov eax, 0x258
cmp dword [edi - 4], eax
jbe 0x10045fc
mov dword [edi - 4], eax
lea eax, [ebp - 0x470]
push eax
push edi
lea eax, [ebp - 0x46c]
push eax
push esi
push 0x1001724
push dword [ebp - 0x468]
mov dword [ebp - 0x470], 1
call ebx
test eax, eax
jne 0x1004630
cmp dword [ebp - 0x46c], 3
je 0x1004637
xor eax, eax
inc eax
mov dword [edi], eax
jmp 0x100463a
xor eax, eax
inc eax
cmp dword [edi], esi
jne 0x1004640
mov dword [edi], eax
cmp dword [edi - 8], 2
je 0x100464b
mov eax, 0xff
cmp dword [edi], eax
jbe 0x1004651
mov dword [edi], eax
lea ecx, [ebp - 0x470]
push ecx
lea eax, [edi + 4]
push eax
lea eax, [ebp - 0x46c]
push eax
push esi
push 0x1001700
push dword [ebp - 0x468]
mov dword [ebp - 0x470], 4
call ebx
test eax, eax
jne 0x100469b
cmp dword [ebp - 0x46c], 4
jne 0x100469b
push dword [ebp - 0x474]
mov ebx, dword [ebp - 0x484]
call fcn.0100404d
jmp 0x100469e
mov dword [edi + 4], esi
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [edi - 8], 2
jne 0x10046d2
lea eax, [ebp - 0x4ac]
push eax
lea eax, [edi - 0x4b8]
push eax
call fcn.0100275e
test eax, eax
je 0x10046d2
xor eax, eax
inc eax
mov dword [edi + 0x24], eax
mov dword [edi + 0x20], eax
jmp 0x10046d5
mov dword [edi + 0x24], esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01003764
inc dword [ebp - 0x474]
mov dword [edi + 0xc], eax
add edi, 0x14d0
jmp 0x10046fe
push dword [ebp - 0x468]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp - 0x480]
push 0x12c
lea eax, [edi - 0x4b8]
push eax
push dword [ebp - 0x478]
push dword [ebp - 0x47c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x100447c
mov edi, dword [ebp - 0x484]
push dword [ebp - 0x488]
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x474]
push edi
push ebx
mov dword [ebx], eax
call fcn.01003c95
mov eax, dword [ebx]
mov edx, edi
call fcn.01004273
push dword [ebp - 0x490]
push edi
call fcn.01001f24
xor esi, esi
inc esi
push dword [ebp - 0x47c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100508f
leave
ret