Function at 0x100fc7c0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014f2c2
mov eax, dword fs:[0]
push eax
sub esp, 0x3bc
mov eax, dword [0x101ba518]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.Registry_
lea eax, [ebp - 0x3b0]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov eax, dword [esi + 4]
push 1
mov eax, dword [eax + 0x1c]
push dword [eax + 8]
lea eax, [ebp - 0x3b0]
push eax
call dword [sym.imp.ntdll.dll_RtlPrefixUnicodeString]
cmp al, 1
jne 0x100fc867
mov eax, dword [esi + 4]
lea edx, [eax + 4]
mov eax, dword [eax + 0x1c]
mov ecx, dword [eax + 8]
movzx eax, word [ecx]
shr eax, 1
push eax
push dword [ecx + 4]
mov ecx, edx
call fcn.100be310
mov dword [ebp - 0x374], eax
test eax, eax
js 0x100fc84b
mov ecx, esi
call fcn.100fde00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10115289
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 8]
cmp dword [eax + 0x10], 0
je 0x100fc9c5
mov eax, dword [eax + 0x14]
test eax, eax
je 0x100fc9c5
mov eax, dword [eax + 4]
test eax, eax
je 0x100fc9c5
mov ecx, dword [esi + 8]
mov ecx, dword [ecx + 0x10]
call fcn.10101b20
mov dword [ebp - 0x374], eax
test eax, eax
js 0x100fc84b
mov eax, dword [esi + 8]
mov ecx, dword [esi + 4]
add ecx, 4
mov eax, dword [eax + 0x10]
add eax, 0x30
push eax
call fcn.100c3bc0
mov dword [ebp - 0x374], eax
test eax, eax
jns 0x100fd18c
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x17c]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x39c], eax
call fcn.100062a0
mov dword [ebp - 4], 0x1b
lea ecx, [ebp - 0x11c]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 0x1c
call fcn.10010ed0
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x310]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1c8]
push 0xc5
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 0x1e
lea eax, [ebp - 0x39c]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0x11c]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x1c8]
call fcn.1000fb80
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x310]
call fcn.10035360
mov byte [ebp - 4], 0x1b
lea ecx, [ebp - 0x11c]
call fcn.10006340
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x17c]
call fcn.10006340
mov eax, dword [ebp - 0x374]
jmp 0x100fc84b
mov ecx, dword [esi + 4]
mov eax, dword [ecx + 0x1c]
cmp dword [eax + 4], 0
jne 0x100fcb19
mov dword [ebp - 0x374], 0xc000000d
mov eax, dword [ecx + 0x1c]
lea ecx, [ebp - 0x40]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
mov eax, dword [eax + 8]
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x3a0], eax
call fcn.100062a0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 1
call fcn.10010ed0
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x2b0]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
push 0x73
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 3
lea eax, [ebp - 0x3a0]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x48], 0x10
jb 0x100fca98
push dword [ebp - 0x5c]
call fcn.10115284
add esp, 4
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x4c], 0
mov byte [ebp - 0x5c], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2b0]
call fcn.10035360
mov byte [ebp - 4], 0
cmp dword [ebp - 0x14], 8
jb 0x100fcace
push dword [ebp - 0x28]
call fcn.10115284
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2c], 8
jb 0x100fcafa
push dword [ebp - 0x40]
call fcn.10115284
add esp, 4
xor eax, eax
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov eax, dword [ebp - 0x374]
mov dword [ebp - 0x30], 0
jmp 0x100fc84b
mov edi, dword [sym.imp.ntdll.dll_NtQueryKey]
mov dword [ebp - 0x378], 0
mov eax, dword [ecx + 0x1c]
mov ecx, dword [0x101c9bf0]
mov eax, dword [eax + 4]
test ecx, ecx
je 0x100fcb4b
lea edx, [ebp - 0x378]
push edx
push 0
push 0
push 3
push eax
call ecx
jmp 0x100fcb5b
lea ecx, [ebp - 0x378]
push ecx
push 0
push 0
push 3
push eax
call edi
mov dword [ebp - 0x374], eax
cmp eax, 0x80000005
je 0x100fcc7a
cmp eax, 0xc0000023
je 0x100fcc7a
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x1ac]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x38c], eax
call fcn.100062a0
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x14c]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 6
call fcn.10010ed0
lea eax, [ebp - 0x1ac]
push eax
lea eax, [ebp - 0x2f0]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x21c]
push 0x81
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x38c]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0x14c]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x21c]
call fcn.1000fb80
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2f0]
call fcn.10035360
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14c]
call fcn.10006340
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1ac]
call fcn.10006340
mov eax, dword [ebp - 0x374]
jmp 0x100fc84b
mov dword [ebp - 0x388], 0
mov dword [ebp - 0x384], 0
mov dword [ebp - 0x380], 0
mov dword [ebp - 4], 9
lea ecx, [ebp - 0x388]
push dword [ebp - 0x378]
call fcn.100bcbf0
mov dword [ebp - 0x374], eax
test eax, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x1c]
jns 0x100fcdbb
mov eax, dword [eax + 8]
lea ecx, [ebp - 0x164]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x3a8], eax
call fcn.100062a0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x194]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 0xb
call fcn.10010ed0
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x330]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1e4]
push 0x8d
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0x3a8]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0x194]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x1e4]
call fcn.1000fb80
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x330]
call fcn.10035360
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x194]
call fcn.10006340
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x164]
call fcn.10006340
mov esi, dword [ebp - 0x374]
jmp 0x100fd14c
mov ecx, dword [eax + 4]
mov eax, dword [0x101c9bf0]
mov ebx, dword [ebp - 0x380]
test eax, eax
je 0x100fcde2
lea edx, [ebp - 0x378]
push edx
push dword [ebp - 0x388]
push ebx
push 3
push ecx
call eax
jmp 0x100fcdf5
lea eax, [ebp - 0x378]
push eax
push dword [ebp - 0x388]
push ebx
push 3
push ecx
call edi
mov dword [ebp - 0x374], eax
test eax, eax
jns 0x100fcef7
mov eax, dword [esi + 4]
lea ecx, [ebp - 0xec]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x394], eax
call fcn.100062a0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x74]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 0xf
call fcn.10010ed0
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x370]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x200]
push 0x99
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 0x11
lea eax, [ebp - 0x394]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0x74]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x200]
call fcn.1000fb80
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x370]
call fcn.10035360
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x74]
call fcn.10006340
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xec]
call fcn.10006340
mov esi, dword [ebp - 0x374]
jmp 0x100fd14c
mov ecx, dword [ebx]
lea edx, [ebp - 0x37c]
call fcn.100b9880
mov dword [ebp - 0x374], eax
test eax, eax
jns 0x100fd00f
mov eax, dword [esi + 4]
lea ecx, [ebp - 0xa4]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x398], eax
call fcn.100062a0
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x8c]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 0x13
call fcn.10010ed0
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0x2d0]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x238]
push 0xa7
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 0x15
lea eax, [ebp - 0x398]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0x8c]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x238]
call fcn.1000fb80
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2d0]
call fcn.10035360
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x8c]
call fcn.10006340
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa4]
call fcn.10006340
mov esi, dword [ebp - 0x374]
jmp 0x100fd14c
lea ecx, [ebp - 0x3c4]
call fcn.100bc4d0
mov byte [ebp - 4], 0x16
movzx eax, word [ebp - 0x37c]
mov ecx, dword [esi + 4]
shr eax, 1
add ecx, 4
push eax
lea eax, [ebx + 4]
push eax
call fcn.100be310
mov dword [ebp - 0x374], eax
test eax, eax
jns 0x100fd16d
mov eax, dword [esi + 4]
lea ecx, [ebp - 0x134]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x3a4], eax
call fcn.100062a0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x104]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 0x18
call fcn.10010ed0
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x290]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x270]
push 0xb4
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 0x1a
lea eax, [ebp - 0x3a4]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0x104]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x270]
call fcn.1000fb80
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x290]
call fcn.10035360
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x104]
call fcn.10006340
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x134]
call fcn.10006340
mov esi, dword [ebp - 0x374]
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c4]
call fcn.100bc560
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x380]
test ecx, ecx
je 0x100fd166
push ecx
call fcn.101160e1
add esp, 4
mov eax, esi
jmp 0x100fc84b
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x3c4]
call fcn.100bc560
mov dword [ebp - 4], 0xffffffff
push ebx
call fcn.101160e1
add esp, 4
mov ecx, esi
call fcn.100fdda0
mov dword [ebp - 0x374], eax
test eax, eax
jns 0x100fc844
mov eax, dword [esi + 4]
lea ecx, [ebp - 0xd4]
push str.Failed_to_build_full_path_for_a_registry_open_or_create_request._nPartial_path:__2__nNTSTATUS:__3_
mov eax, dword [eax + 0x1c]
mov eax, dword [eax + 8]
movzx eax, word [eax]
shr eax, 1
mov dword [ebp - 0x390], eax
call fcn.100062a0
mov dword [ebp - 4], 0x1f
lea ecx, [ebp - 0xbc]
push str.VReg
call fcn.100062a0
mov byte [ebp - 4], 0x20
call fcn.10010ed0
lea eax, [ebp - 0xd4]
push eax
lea eax, [ebp - 0x350]
push eax
call fcn.10036150
mov ebx, eax
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x254]
push 0xd2
push str.reparse_and_set_full_path_class_open_key_vreg_request_class_validate_open_key_params_::doit
call fcn.100361d0
mov edi, eax
mov byte [ebp - 4], 0x22
lea eax, [ebp - 0x390]
mov ecx, dword [esi + 4]
push eax
mov esi, dword [ecx + 0x1c]
mov ecx, ebx
call fcn.100116c0
mov ecx, dword [esi + 8]
add ecx, 4
push ecx
mov ecx, ebx
call fcn.1002c750
lea eax, [ebp - 0x374]
mov ecx, ebx
push eax
call fcn.10020350
push ebx
lea eax, [ebp - 0xbc]
mov ecx, edi
push eax
push 1
call fcn.100363f0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x254]
call fcn.1000fb80
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x350]
call fcn.10035360
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xbc]
call fcn.10006340
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd4]
call fcn.10006340
mov eax, dword [ebp - 0x374]
jmp 0x100fc84b