Function at 0x100d88b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.0100e150
mov eax, dword [0x101c8c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
mov dword [ebp - 0x1008], eax
mov eax, dword [ebp + 0xc]
push esi
push esi
mov dword [ebp - 0x101c], eax
mov dword [ebp - 0x1024], esi
call edi
push eax
call fcn.0100e909
push eax
push 0x1006698
push 0x1005f40
push 0x153
push esi
mov ebx, 0x10052e8
push ebx
push esi
push dword [ebp - 0x101c]
push dword [ebp - 0x1008]
push 0x1006668
push 0x4000000
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
lea eax, [ebp - 0x1024]
push eax
push dword [ebp - 0x1008]
call fcn.0100d1ee
push esi
mov dword [ebp - 0x1010], eax
push esi
cmp eax, esi
jne 0x100ddb7
call edi
push eax
call fcn.0100e909
push eax
push 0x1006698
push 0x1005f40
push 0x159
push esi
push ebx
push esi
push dword [ebp - 0x1008]
push 0x1006638
push 0x4000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
push esi
push esi
lea eax, [ebp - 0x1030]
push eax
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x1034]
push eax
push esi
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x1040]
push eax
push esi
push esi
push esi
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x1010], eax
cmp eax, esi
jne 0x100dd68
inc dword [ebp - 0x1028]
mov eax, dword [ebp - 0x1028]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
inc dword [ebp - 0x102c]
mov dword [ebp - 0x1018], eax
mov eax, dword [ebp - 0x102c]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
inc dword [ebp - 0x1030]
push dword [ebp - 0x1030]
mov dword [ebp - 0x1014], eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0xc
mov dword [ebp - 0x103c], eax
cmp dword [ebp - 0x1018], esi
je 0x100dd2a
cmp dword [ebp - 0x1014], esi
je 0x100dd2a
cmp eax, esi
je 0x100dd3e
mov dword [ebp - 0x100c], esi
cmp dword [ebp - 0x1034], esi
jbe 0x100db2b
mov eax, dword [ebp - 0x102c]
mov dword [ebp - 0x1020], eax
mov eax, dword [ebp - 0x1030]
mov dword [ebp - 0x1044], eax
lea eax, [ebp - 0x1044]
push eax
push dword [ebp - 0x103c]
lea eax, [ebp - 0x104c]
push eax
push esi
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1014]
push dword [ebp - 0x100c]
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x1010], eax
cmp eax, esi
jne 0x100db13
push dword [ebp - 0x1014]
push dword [ebp - 0x101c]
push dword [ebp - 0x1014]
push dword [ebp - 0x1008]
call fcn.0100d7ed
mov dword [ebp - 0x1038], eax
cmp eax, esi
je 0x100db13
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x1006698
push 0x1005f40
push 0x188
push esi
push ebx
push esi
push dword [ebp - 0x1038]
push dword [ebp - 0x1014]
push dword [ebp - 0x101c]
push dword [ebp - 0x1014]
push dword [ebp - 0x1008]
push 0x10065f8
push 0x2000000
call fcn.0100b725
add esp, 0x1c
push eax
call fcn.0100f2dd
inc dword [ebp - 0x100c]
mov eax, dword [ebp - 0x100c]
cmp eax, dword [ebp - 0x1034]
jb 0x100da43
cmp dword [ebp - 0x1034], 1
jae 0x100dc10
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x1006698
push 0x1005f40
push 0x18f
push esi
push ebx
push esi
push dword [ebp - 0x1008]
push 0x10065b0
push 0x4000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
push dword [ebp - 0x101c]
lea eax, [ebp - 0x804]
push 0x400
push eax
call fcn.0100c026
lea eax, [ebp - 0x1020]
push eax
push 0x400
lea eax, [ebp - 0x804]
push eax
call fcn.0100d13a
push esi
lea eax, [ebp - 0x1020]
push eax
push esi
push 0xf003f
push esi
push esi
push esi
lea eax, [ebp - 0x804]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x1010], eax
cmp eax, esi
je 0x100dc10
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x1006698
push 0x1005f40
push 0x197
push esi
push ebx
push esi
push dword [ebp - 0x1010]
push dword [ebp - 0x1008]
push 0x1006540
push 0x4000000
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
mov dword [ebp - 0x100c], esi
cmp dword [ebp - 0x1040], esi
jbe 0x100dd2a
mov eax, dword [ebp - 0x1028]
mov dword [ebp - 0x1020], eax
lea eax, [ebp - 0x1048]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x1020]
push eax
push dword [ebp - 0x1018]
push dword [ebp - 0x100c]
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x1010], eax
cmp eax, esi
jne 0x100dd12
push dword [ebp - 0x1018]
lea eax, [ebp - 0x1004]
push dword [ebp - 0x1008]
push 0x1005ebc
push 0x400
push eax
call fcn.0100c0f1
push dword [ebp - 0x1018]
lea eax, [ebp - 0x804]
push dword [ebp - 0x101c]
push 0x1005ebc
push 0x400
push eax
call fcn.0100c0f1
add esp, 0x28
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0100d88b
mov dword [ebp - 0x1038], eax
cmp eax, esi
je 0x100dd12
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x1006698
push 0x1005f40
push 0x1ad
push esi
push ebx
push esi
push dword [ebp - 0x1038]
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x1004]
push eax
push 0x10064f8
push 0x2000000
call fcn.0100b725
add esp, 0x14
push eax
call fcn.0100f2dd
inc dword [ebp - 0x100c]
mov eax, dword [ebp - 0x100c]
cmp eax, dword [ebp - 0x1040]
jb 0x100dc22
cmp dword [ebp - 0x103c], esi
je 0x100dd3e
push dword [ebp - 0x103c]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x1014], esi
je 0x100dd52
push dword [ebp - 0x1014]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x1018], esi
je 0x100dda3
push dword [ebp - 0x1018]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x100dda3
push esi
push esi
call edi
push eax
call fcn.0100e909
push eax
push 0x1006698
push 0x1005f40
push 0x1b7
push esi
push ebx
push esi
push dword [ebp - 0x1010]
push 0x10064b0
push 0x4000000
call fcn.0100b725
add esp, 0xc
push eax
call fcn.0100f2dd
push dword [ebp - 0x1024]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1010]
jmp 0x100ddf7
call edi
push eax
call fcn.0100e909
mov edi, dword [ebp - 0x1010]
push eax
push 0x1006698
push 0x1005f40
push 0x1bd
push esi
push ebx
push esi
push edi
push dword [ebp - 0x1008]
push 0x100646c
push 0x4000000
call fcn.0100b725
add esp, 0x10
push eax
call fcn.0100f2dd
cmp edi, esi
jle 0x100de07
and edi, 0xffff
or edi, 0x80070000
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100e138
leave
ret 8