Function at 0x1004ef3
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x42c
push ebx
push edi
xor edi, edi
push 0x3fc
lea eax, [ebp - 0x428]
mov ebx, ecx
push edi
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov byte [ebp - 5], 0
mov dword [ebp - 0x42c], edi
call fcn.01010f7a
add esp, 0xc
cmp byte [ebx + 4], 0
jne 0x1004f0a
mov edi, 0x8000ffff
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005424
test byte [eax + 0x1c], 1
je 0x1005424
push edi
push 0x1001380
push 0x46
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x1005424
push esi
mov esi, dword [ebp + 0xc]
cmp word [esi + 4], di
je 0x1004f3c
movzx eax, word [esi + 6]
cmp ax, di
je 0x1004f3c
mov ecx, 0x80
cmp ax, cx
ja 0x1004f3c
cmp dword [esi + 0x28], edi
je 0x1004f3c
lea eax, [esi + 0x2c]
cmp byte [eax], 0
mov dword [ebp - 0x24], eax
je 0x1004f3c
test byte [esi], 0xe0
je 0x1004f6e
mov edi, 0x8007000d
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005423
test byte [eax + 0x1c], 1
je 0x1005423
push edi
push 0x1001380
push 0x47
push dword [eax + 0x14]
push dword [eax + 0x10]
jmp 0x100541e
lea eax, [ebp - 0x10]
lea ecx, [ebx + 8]
push eax
mov dword [ebp - 0x1c], ecx
call fcn.01003068
mov edi, eax
test edi, edi
jge 0x1004fa7
mov eax, dword [section..data]
cmp eax, section..data
je 0x1005423
test byte [eax + 0x1c], 1
je 0x1005423
push edi
push 0x1001380
push 0x48
jmp 0x1004f63
lea eax, [ebp - 0x14]
push eax
movzx eax, word [esi + 4]
push 0x1e4
dec eax
push eax
call fcn.0101597e
mov edi, eax
test edi, edi
jge 0x1004ff3
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x49
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
jmp 0x10053ed
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.010030d5
mov edi, eax
test edi, edi
jge 0x100502f
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x4a
jmp 0x1004fe3
mov ecx, dword [ebx + 0x28]
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp + 8]
push eax
call fcn.0100c2bd
mov edi, eax
test edi, edi
jge 0x100506e
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x4b
jmp 0x1004fe3
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x10050c7
mov eax, dword [section..data]
mov esi, section..data
cmp eax, esi
je 0x10050a3
test byte [eax + 0x1c], 4
je 0x10050a3
push dword [ebp + 8]
push 0x1001380
push 0x4c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002fd5
mov eax, dword [section..data]
mov edi, 0x8000ffff
cmp eax, esi
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x4d
jmp 0x1004fe3
movzx ecx, word [esi + 2]
movzx edx, word [eax + 4]
cmp cx, dx
je 0x100512b
mov eax, dword [section..data]
mov esi, section..data
cmp eax, esi
je 0x1005107
test byte [eax + 0x1c], 4
je 0x1005107
movzx edx, dx
push edx
movzx ecx, cx
push ecx
push 0x1001380
push 0x4e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100e441
mov eax, dword [section..data]
mov edi, 0x8000ffff
cmp eax, esi
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x4f
jmp 0x1004fe3
push 0x15
lea edi, [esi + 0x10]
push edi
add eax, 0x14
push eax
call dword [sym.imp.ntdll.dll_RtlCompareMemory]
cmp eax, 0x15
je 0x1005182
mov eax, dword [ebp - 4]
lea ecx, [eax + 0x7a]
push ecx
add eax, 0x20
push eax
push edi
call fcn.01003dc9
mov edi, eax
test edi, edi
jge 0x1005208
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x50
jmp 0x1004fe3
mov eax, dword [ebp - 0xc]
add eax, 0x2a
push eax
mov eax, dword [ebp - 4]
push 0x2d
add eax, 0x20
push eax
call fcn.01003716
mov edi, eax
test edi, edi
jge 0x10051c4
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x51
jmp 0x1004fe3
mov eax, dword [ebp - 0xc]
add eax, 0x84
push eax
mov eax, dword [ebp - 4]
push 0x2d
add eax, 0x7a
push eax
call fcn.01003716
mov edi, eax
test edi, edi
jge 0x1005208
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x52
jmp 0x1004fe3
and dword [ebp + 0xc], 0
xor eax, eax
cmp ax, word [esi + 6]
jae 0x10052b7
mov edi, dword [section..data]
mov eax, dword [ebp + 0xc]
cmp eax, 0x80
jae 0x10052b7
mov edx, eax
mov eax, dword [esi + 0x28]
shl edx, 3
mov ecx, dword [edx + eax]
mov eax, dword [edx + eax + 4]
lea ebx, [ebp + edx - 0x42c]
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
push eax
push ecx
mov dword [ebp - 0x28], eax
call fcn.0100342e
mov eax, dword [ebx]
test eax, eax
jne 0x1005289
and dword [ebx + 4], eax
cmp edi, section..data
je 0x10052a4
test byte [edi + 0x1c], 2
je 0x10052a4
push 0x8000ffff
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x1001380
push RtlGUIDFromString
push dword [edi + 0x14]
push dword [edi + 0x10]
call fcn.010033ab
jmp 0x100529e
cmp dword [eax + 8], 0
jne 0x10052a4
mov ecx, dword [ebp - 0x18]
push eax
call fcn.01003e84
mov edi, eax
test edi, edi
jl 0x10052f8
mov edi, dword [section..data]
movzx eax, word [esi + 6]
inc dword [ebp + 0xc]
mov ebx, dword [ebp - 0x18]
cmp dword [ebp + 0xc], eax
jb 0x100521e
movzx eax, word [esi + 6]
push dword [ebp - 4]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.01004c9c
mov edi, eax
test edi, edi
jge 0x100531f
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x55
jmp 0x1004fe3
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push reloc.ntdll.dll_RtlGUIDFromString
jmp 0x1004fe3
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
mov word [ecx + 8], ax
mov ecx, dword [ebp - 4]
push 2
pop eax
push dword [ebp - 0x24]
mov word [ecx + 0xa], ax
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
movzx eax, byte [esi]
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov ax, word [esi + 4]
mov ecx, dword [ebp - 4]
mov word [ecx + 0xc], ax
mov eax, dword [esi + 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 0xc]
push ecx
add eax, 0x1e2
push eax
call fcn.010036ae
mov edi, eax
test edi, edi
jge 0x1005393
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x56
jmp 0x1004fe3
mov ecx, dword [ebx + 0x34]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 5]
push eax
mov eax, dword [ebp - 0x14]
push eax
add eax, 0xfffffff4
push eax
push dword [ebp - 4]
call fcn.0100c385
mov edi, eax
test edi, edi
jge 0x10053d3
mov eax, dword [section..data]
cmp eax, section..data
je 0x10053ed
test byte [eax + 0x1c], 1
je 0x10053ed
push edi
push 0x1001380
push 0x57
jmp 0x1004fe3
cmp byte [ebp - 5], 0
je 0x10053eb
mov eax, dword [ebp - 0x20]
mov ecx, 0xffff
cmp word [eax + 8], cx
je 0x10053eb
inc word [eax + 8]
xor edi, edi
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
call fcn.01003207
test eax, eax
jge 0x1005423
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1005423
test byte [ecx + 0x1c], 1
je 0x1005423
push eax
push 0x1001380
push 0x58
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01002fd5
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret 8