Function at 0x100084d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10013520
push 0x10012488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x474
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x24], esi
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x270]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [ebp - 0x230]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [ebp - 0x480]
rep stosd dword es:[edi], eax
mov dword [ebp - 4], esi
lea eax, [ebp - 0x484]
push eax
push 0x20019
push esi
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000856d
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 4], 0xffffffff
call fcn.100088c4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x24]
cmp eax, 3
ja case.0x10008585.5
jmp dword [eax*4 + 0x100088f0]
mov eax, dword [ebp + 0x14]
dec eax
cmp eax, 6
ja case.0x10008585.5
jmp dword [eax*4 + 0x10008900]
mov dword [ebp - 0x1c], 0x208
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x230]
push edx
lea eax, [ebp + 0x14]
push eax
push esi
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x484]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x10008585.5
lea eax, [ebp - 0x230]
push eax
call fcn.10008490
add esp, 4
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x24], 1
mov dword [ebp - 4], 0xffffffff
call fcn.100088c4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x208
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp + 0x14]
push ecx
push esi
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x10008585.5
lea esi, [ebp - 0x230]
mov dword [ebp - 0x28], esi
mov edi, dword [sym.imp.MSVCRT.dll_wcsncat]
mov ebx, dword [sym.imp.MSVCRT.dll_wcschr]
cmp word [esi], 0
je 0x10008674
push 0x208
push esi
lea ecx, [ebp - 0x480]
push ecx
call edi
push 0x208
push 0x100170c0
lea edx, [ebp - 0x480]
push edx
call edi
push 0
push esi
call ebx
add esp, 0x20
add eax, 2
mov esi, eax
mov dword [ebp - 0x28], esi
jmp 0x1000863a
lea eax, [ebp - 0x480]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 8
jmp case.0x10008575.3
mov dword [ebp - 0x1c], 4
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp + 0x14]
push ecx
push esi
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x10008585.5
mov ecx, dword [ebp - 0x274]
push ecx
push 0x100183f8
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp case.0x10008575.3
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x1c]
push edx
lea eax, [ebp + 0x14]
push eax
push esi
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x484]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x10008585.5
jmp case.0x10008575.3
mov ebx, dword [ebp + 0x18]
mov ecx, 0x82
xor eax, eax
lea edi, [ebp - 0x230]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0x208
mov eax, esi
inc esi
mov dword [ebp - 0x278], esi
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x230]
push edx
push eax
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne case.0x10008585.5
lea ecx, [ebp - 0x230]
push ecx
push str.__s__r_n
lea edx, [ebp - 0x480]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x480]
push eax
push ebx
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 0x14
mov dword [ebp - 0x24], 1
jmp 0x1000870f
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x270]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [ebp - 0x230]
rep stosd dword es:[edi], eax
mov ecx, 0x82
lea edi, [ebp - 0x480]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], 0x208
mov eax, esi
inc esi
mov dword [ebp - 0x278], esi
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x230]
push edx
lea ecx, [ebp + 0x14]
push ecx
push 0
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x270]
push ecx
push eax
mov edx, dword [ebp - 0x484]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne case.0x10008585.5
mov eax, dword [ebp + 0x14]
dec eax
cmp eax, 6
ja case.0x1000880f.5
jmp dword [eax*4 + 0x1000891c]
lea ecx, [ebp - 0x230]
push ecx
push str.REG_SZ
jmp 0x10008830
lea ecx, [ebp - 0x230]
push ecx
push str.REG_EXPAND_SZ
lea edx, [ebp - 0x270]
push edx
push str.__24s___15s__s__r_n
lea eax, [ebp - 0x480]
push eax
call ebx
add esp, 0x14
jmp case.0x1000880f.5
lea ecx, [ebp - 0x230]
push ecx
lea edx, [ebp - 0x230]
push edx
push str.REG_DWORD
lea eax, [ebp - 0x270]
push eax
push str.__24s___15s_0x_x__d___r_n
lea ecx, [ebp - 0x480]
push ecx
call ebx
add esp, 0x18
jmp case.0x1000880f.5
push str.REG_MULTI_SZ
lea edx, [ebp - 0x270]
push edx
push str.__24s___15s__r_n
lea eax, [ebp - 0x480]
push eax
call ebx
add esp, 0x10
jmp case.0x1000880f.5
push str.__24s___15s__r_n
lea ecx, [ebp - 0x480]
push ecx
call ebx
add esp, 8
lea edx, [ebp - 0x480]
push edx
mov eax, dword [ebp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x24], 1
jmp 0x10008790