Function at 0x100a724
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x578
mov eax, 0x10445c4
call fcn.01007986
mov eax, dword [ebp + 0x10]
xor esi, esi
mov dword [ebp - 0x530], eax
mov dword [eax], esi
lea eax, [ebp - 0x518]
push eax
push 0x20019
push esi
push 0x100a670
push 0x80000001
mov dword [ebp - 0x518], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100a980
cmp dword [ebp - 0x518], esi
je 0x100a980
lea eax, [ebp - 0x584]
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x514], esi
mov dword [ebp - 0x53c], esi
mov dword [ebp - 0x540], 0x10
mov dword [ebp - 0x544], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], esi
mov dword [ebp - 0x528], esi
push 0x80
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x528]
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
jne 0x100a93e
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x110]
push 0x100af48
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0xc
cmp eax, 1
jne 0x100a92c
mov eax, dword [ebp - 0x52c]
cmp eax, dword [ebp - 0x514]
jne 0x1012c84
inc dword [ebp - 0x514]
lea eax, [ebp - 0x51c]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x518]
mov dword [ebp - 0x51c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100a92c
cmp dword [ebp - 0x51c], esi
je 0x100a92c
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x534]
push eax
push esi
push 0x1009ea8
push dword [ebp - 0x51c]
mov dword [ebp - 0x524], 4
call edi
cmp eax, esi
jne 0x100a920
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x538]
jne 0x100a920
cmp dword [ebp + 8], esi
je 0x100a988
xor eax, eax
push 0x3fe
mov word [ebp - 0x510], ax
lea eax, [ebp - 0x50e]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x534]
push eax
push esi
push 0x100cac0
push dword [ebp - 0x51c]
mov dword [ebp - 0x524], 0x400
call edi
cmp eax, esi
jne 0x100a920
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x510]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x10127ea
cmp dx, si
je 0x100a91a
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x10127ea
add ecx, 4
add eax, 4
cmp dx, si
jne 0x100a8f0
xor eax, eax
cmp eax, esi
je 0x100a988
push dword [ebp - 0x51c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x528]
cmp dword [ebp - 0x520], esi
je 0x100a7ae
push dword [ebp - 0x518]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x544]
cmp dword [ebp - 0x520], esi
je 0x101b742
mov eax, dword [ebp - 0x52c]
mov edx, dword [ebp - 0x530]
mov dword [edx], eax
or dword [ebp - 4], 0xffffffff
cmp ecx, esi
je 0x100a980
lea eax, [ebp - 0x584]
cmp ecx, eax
jne 0x101b773
call fcn.010079c3
ret 0xc
mov dword [ebp - 0x520], 1
jmp 0x100a920
sbb eax, eax
sbb eax, 0xffffffff
jmp 0x100a91c
push 1
push eax
lea ecx, [ebp - 0x584]
call fcn.01012c9c
jmp 0x100a811
xor eax, eax
cmp dword [ebp - 0x53c], esi
jbe 0x101b760
mov edx, dword [ecx + eax*4]
cmp edx, dword [ebp - 0x514]
je 0x101b77f
inc eax
cmp eax, dword [ebp - 0x53c]
jb 0x101b74c
mov eax, dword [ebp - 0x530]
mov edx, dword [ebp - 0x514]
mov dword [eax], edx
jmp 0x100a96a
push ecx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x100a980
inc dword [ebp - 0x514]
jmp 0x101b742