Function at 0x10023f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
xor edi, edi
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x218], esi
mov dword [ebp - 0x20c], esi
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x21c], esi
cmp eax, esi
jne 0x1002445
mov dword [ebp - 0x208], 0x57
jmp 0x10026c5
push ebx
lea eax, [ebp - 0x214]
push eax
call fcn.0100196a
mov dword [ebp - 0x208], eax
cmp eax, esi
jne 0x1002669
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
je 0x100265d
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x214]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
test eax, eax
je 0x100265d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x218]
push eax
push 0x20019
push esi
push 0x1001388
push 0x80000001
call ebx
mov dword [ebp - 0x208], eax
cmp eax, esi
jne 0x1002669
mov dword [ebp - 0x210], esi
cmp dword [ebp - 0x220], esi
jne 0x1002669
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x224], 0x100
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 0x210]
mov dword [ebp - 0x208], eax
cmp eax, esi
jne 0x100264e
push esi
push 0xffffffffffffffff
push dword [ebp - 0x21c]
lea eax, [ebp - 0x204]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x100253f
push dword [ebp - 0x214]
dec dword [ebp - 0x210]
call fcn.01001910
jmp 0x10024c1
lea eax, [ebp - 0x20c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x218]
call ebx
mov dword [ebp - 0x208], eax
cmp eax, esi
jne 0x1002669
push 0x40c
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
cmp eax, esi
je 0x1002583
mov ecx, eax
call fcn.0100157c
mov edi, eax
jmp 0x1002585
xor edi, edi
cmp edi, esi
je 0x1002642
lea eax, [ebp - 0x204]
push eax
mov ecx, edi
call fcn.010015bb
test eax, eax
je 0x10025bc
lea eax, [ebp - 0x204]
push eax
call fcn.010018c3
mov dword [ebp - 0x208], esi
push 1
mov ecx, edi
call fcn.01001ac3
jmp 0x100263b
push edi
push dword [ebp - 0x20c]
call fcn.01002278
mov dword [ebp - 0x208], eax
cmp eax, 0xea
je 0x10025ab
cmp eax, esi
jne 0x1002669
cmp dword [ebp - 0x20c], esi
je 0x10025f7
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x20c], esi
push 0x1001370
mov ecx, edi
call fcn.010015fe
push esi
mov ecx, edi
call fcn.010015fe
cmp dword [edi + 8], esi
jne 0x1002629
cmp dword [edi + 4], esi
jne 0x1002629
dec dword [ebp - 0x210]
lea eax, [ebp - 0x204]
push eax
call fcn.010018c3
jmp 0x10025b1
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x220], 1
mov dword [eax], edi
xor edi, edi
jmp 0x10024c1
mov dword [ebp - 0x208], 0xe
jmp 0x1002669
cmp eax, 0x103
jne 0x1002669
mov dword [ebp - 0x208], esi
jmp 0x1002669
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x208], eax
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x214], esi
je 0x100267f
push dword [ebp - 0x214]
call ebx
cmp dword [ebp - 0x21c], esi
je 0x100268f
push dword [ebp - 0x21c]
call ebx
pop ebx
cmp edi, esi
je 0x100269d
push 1
mov ecx, edi
call fcn.01001ac3
cmp dword [ebp - 0x218], esi
je 0x10026b1
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20c], esi
je 0x10026c5
push dword [ebp - 0x20c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
pop edi
xor ecx, ebp
pop esi
call fcn.01002b9c
leave
ret 4