Function at 0x10004e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
push ebx
sub esp, 0x238
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x224], ecx
lea ecx, [ebp - 0x21c]
mov word [ebp - 0x214], di
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x220], eax
mov edi, dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov dword [ebp - 0x228], edx
mov dword [ebx], 0
mov dword [ebp - 0x21c], 0x208
mov dword [esp + 0x14], ecx
lea ecx, [ebp - 0x214]
mov dword [esp + 0x10], ecx
lea ecx, [ebp - 0x218]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 0
mov ecx, dword [ebp + 8]
mov dword [esp], eax
mov dword [esp + 4], ecx
call edi
sub esp, 0x18
cmp eax, 0xea
je 0x10004f98
test eax, eax
jne 0x10005019
movzx eax, word [ebp - 0x214]
test ax, ax
je 0x10005019
lea edx, [ebp - 0x214]
mov edi, edx
mov dword [ebp - 0x220], edx
cmp ax, 0x5c
je 0x10005069
test ax, ax
jne 0x10005120
mov eax, dword [ebp - 0x224]
add dword [ebx], eax
test esi, esi
je 0x10005028
cmp eax, dword [ebp + 0x10]
jae 0x10005028
mov eax, dword [ebp - 0x228]
mov dword [esp], esi
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov eax, dword [ebp - 0x224]
sub dword [ebp + 0x10], eax
mov dword [esp], edi
add esi, eax
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x21c], eax
cmp dword [ebp + 0x10], eax
jae 0x100050b8
mov eax, dword [ebp - 0x21c]
xor esi, esi
add dword [ebx], eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
cmp dword [ebp - 0x218], 7
je 0x10005048
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 0x214]
cmp edx, eax
je 0x10004f88
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
test byte [0x1001a0b8], 8
jne 0x10005130
mov eax, dword [ebp - 0x21c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, eax
test eax, eax
je 0x10005019
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x21c]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x218]
mov dword [esp + 0x10], edx
mov dword [ebp - 0x22c], edx
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x220]
mov dword [esp], eax
call edi
mov edx, dword [ebp - 0x22c]
sub esp, 0x18
test eax, eax
jne 0x10005010
movzx eax, word [edx]
test ax, ax
jne 0x10004ee1
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], edi
xor esi, esi
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x21c], eax
jmp 0x10004f57
lea edi, [edi + eax*2 + 2]
cmp word [edi], 0
je 0x100050d8
mov eax, dword [ebp - 0x220]
movzx eax, word [eax]
cmp ax, 0x5c
jne 0x10004ef3
mov eax, dword [ebp - 0x220]
movzx eax, word [eax + 2]
cmp ax, 0x5c
je 0x10005094
cmp ax, 0x3a
jne 0x10004efc
mov eax, dword [ebp - 0x220]
cmp word [eax + 4], 0x5c
jne 0x10004efc
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_wcslen]
lea eax, [eax + eax + 2]
mov dword [ebp - 0x21c], eax
test esi, esi
je 0x10004f57
cmp dword [ebp + 0x10], eax
jb 0x10004f4f
mov dword [esp], esi
mov dword [esp + 4], edi
call dword [sym.imp.ucrtbase.dll_wcscpy]
mov eax, dword [ebp - 0x21c]
sub dword [ebp + 0x10], eax
add esi, eax
jmp 0x10004f57
mov edx, dword [ebp - 0x220]
lea eax, [ebp - 0x214]
cmp edx, eax
je 0x100050f8
mov dword [esp], edx
call dword [sym.imp.ucrtbase.dll_free]
lea esi, [esi]
add dword [ebx], 2
test esi, esi
je 0x10004f88
cmp dword [ebp + 0x10], 1
jbe 0x10004f88
xor eax, eax
mov word [esi], ax
jmp 0x10004f88
mov eax, dword [ebp - 0x220]
movzx eax, word [eax + 2]
jmp 0x10005079
mov eax, dword [ebp - 0x21c]
mov dword [esp + 0xc], str.need_dynamic_buffer:__lu_n
mov dword [esp + 8], str.get_filename_from_reg
mov dword [esp + 4], 0x1001a0b8
mov dword [esp], 3
mov dword [esp + 0x10], eax
call fcn.100032c0
jmp 0x10004fa5