Function at 0x10052e1
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x1008110]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
lea ecx, [edi + 0x4c]
push 8
mov dword [ebp - 0x640], esi
mov dword [ebp - 0x624], esi
call fcn.010046c2
lea eax, [ebp - 0x628]
push eax
push 0x20019
push esi
push 0x1001738
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1005569
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov dword [ebp - 0x62c], esi
push 0x104
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x62c]
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1005525
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x638]
push eax
push esi
push 0x18
push 0x10017f4
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x628]
mov dword [ebp - 0x638], esi
mov dword [ebp - 0x630], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x1005513
cmp dword [ebp - 0x638], esi
je 0x1005513
mov word [ebp - 0x20c], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.01004b67
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x620], esi
call fcn.01004581
lea eax, [ebp - 0x630]
push eax
lea eax, [ebp - 0x63c]
push eax
push esi
push 0x18
push 0x10017dc
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x628]
mov dword [ebp - 0x63c], esi
mov dword [ebp - 0x630], 4
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
push 0x104
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x620]
push dword [ebp - 0x63c]
call fcn.01004a67
cmp word [ebp - 0x61c], si
je 0x1005513
cmp dword [edi + 0x4c], esi
je 0x1005513
lea eax, [ebp - 0x61c]
push eax
push esi
push 0x143
push 0xc9
push dword [edi + 4]
call ebx
mov dword [ebp - 0x620], eax
cmp eax, 0xffffffff
je 0x1005509
lea eax, [ebp - 0x634]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push esi
call fcn.010032b5
cmp eax, esi
mov dword [ebp - 0x624], eax
jl 0x10054db
push esi
push dword [ebp - 0x634]
lea ecx, [edi + 0x4c]
call fcn.0100472a
cmp eax, esi
mov dword [ebp - 0x624], eax
jge 0x10054db
push dword [ebp - 0x634]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push esi
push dword [ebp - 0x620]
push 0x144
push 0xc9
push dword [edi + 4]
call ebx
mov eax, dword [edi + 0x48]
cmp eax, esi
je 0x1005513
push 1
push 0xffffffffffffffff
lea ecx, [ebp - 0x20c]
push ecx
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x1005513
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x640], eax
jmp 0x1005513
mov dword [ebp - 0x624], 0x80004005
inc dword [ebp - 0x62c]
cmp dword [ebp - 0x624], esi
jge 0x1005344
push dword [ebp - 0x628]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x624], esi
jl 0x1005569
cmp dword [edi + 0x4c], esi
je 0x1005569
mov eax, dword [edi + 0x4c]
cmp eax, esi
je 0x1005549
mov eax, dword [eax]
jmp 0x100554b
xor eax, eax
cmp eax, esi
jle 0x1005569
push esi
push dword [ebp - 0x640]
push 0x14e
push 0xc9
push dword [edi + 4]
call ebx
xor eax, eax
jmp 0x100556e
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100677b
leave
ret