Function at 0x10179390
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x610], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x60c], edx
mov dword [ebp - 0x618], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x614], edi
test ecx, ecx
je 0x101793e1
push dword [ebp + 0x1c]
mov eax, dword [ecx]
push 0x200
push edx
push edi
push ecx
call dword [eax + 0x10]
call fcn.10003180
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101793f9
push esi
call ebx
push 0x2f
call fcn.10003680
add esp, 4
test eax, eax
je 0x10179419
lea ecx, [ebp - 0x608]
push ecx
push dword [ebp - 0x60c]
push edi
call eax
jmp 0x1017942d
lea eax, [ebp - 0x608]
push eax
push dword [ebp - 0x60c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test esi, esi
je 0x1017943a
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x101794b0
cmp edi, 5
jne 0x10179492
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x10179492
mov eax, dword [ebp - 0x610]
test eax, eax
je 0x10179492
push dword [ebp - 0x618]
push eax
call fcn.100dc890
add esp, 8
test eax, eax
je 0x101799de
lea eax, [ebp - 0x608]
push eax
push dword [ebp - 0x60c]
push dword [ebp - 0x614]
call fcn.100e5610
test eax, eax
jne 0x10179a13
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push 0x400
lea eax, [ebp - 0x604]
push 0
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x618]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10179512
lea ecx, [ebp - 0x604]
mov edx, 0x100
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefe]
test eax, eax
je 0x10179506
movzx eax, word [ecx + esi]
test ax, ax
je 0x10179506
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x101794e6
jmp 0x1017950a
test edx, edx
jne 0x1017950d
sub ecx, 2
xor eax, eax
mov word [ecx], ax
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call sub.msvcrt.dll_memset
mov edi, dword [ebp - 0x608]
add esp, 0xc
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10179540
push esi
call ebx
push 0x3b
call fcn.10003680
add esp, 4
push 0x100
test eax, eax
je 0x10179561
lea ecx, [ebp - 0x204]
push ecx
push 0
push edi
call eax
jmp 0x10179571
lea eax, [ebp - 0x204]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov ebx, eax
test esi, esi
je 0x10179582
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call esi
jmp 0x10179588
mov esi, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 5
jne 0x10179810
mov eax, dword [0x102568c0]
test eax, eax
jne 0x101796bb
mov eax, dword [0x102568dc]
mov edi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test al, 1
jne 0x101795f4
or eax, 1
mov dword [0x102568dc], eax
xor eax, eax
push eax
push 0x102568c4
mov dword [0x102568c4], eax
mov dword [0x102568c8], eax
mov dword [0x102568cc], eax
mov dword [0x102568d0], eax
mov dword [0x102568d4], eax
mov dword [0x102568d8], eax
call edi
test eax, eax
jne 0x101795e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x101fff90
call fcn.101c8090
add esp, 4
push 0x102568c4
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10256a3c]
test al, 1
jne 0x101796aa
or eax, 1
mov dword [0x102568e0], 0x10202980
mov dword [0x10256a3c], eax
xor eax, eax
push eax
push 0x10256a1c
mov dword [0x10256a1c], eax
mov dword [0x10256a20], eax
mov dword [0x10256a24], eax
mov dword [0x10256a28], eax
mov dword [0x10256a2c], eax
mov dword [0x10256a30], eax
call edi
test eax, eax
jne 0x10179650
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x128
push 0
push 0x102568e4
mov dword [0x10256a34], 0x10256a1c
mov dword [0x10256a10], 0
call sub.msvcrt.dll_memset
push 0x101fffa0
mov dword [0x10256a0c], 0
mov dword [0x10256a18], 0
mov dword [0x10256a14], 1
mov dword [0x10256a38], 0
call fcn.101c8090
add esp, 0x10
push 0x102568c4
call esi
mov eax, 0x102568e0
mov dword [0x102568c0], eax
cmp dword [eax + 0x12c], 0
jne 0x101799de
mov edi, dword [ebp - 0x610]
test edi, edi
je 0x101799de
push dword [ebp - 0x618]
push edi
call fcn.100dc890
add esp, 8
test eax, eax
je 0x1017997b
mov edi, dword [ebp - 0x608]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10179709
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x44
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x1017971c
call eax
jmp 0x10179722
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1017972d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x608], 0
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1017974d
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x2f
call fcn.10003680
add esp, 4
test eax, eax
je 0x10179772
lea ecx, [ebp - 0x608]
push ecx
push dword [ebp - 0x60c]
push dword [ebp - 0x614]
call eax
jmp 0x1017978b
lea eax, [ebp - 0x608]
push eax
push dword [ebp - 0x60c]
push dword [ebp - 0x614]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test esi, esi
je 0x10179798
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x10179492
mov edi, dword [ebp - 0x608]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101797bc
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3b
call fcn.10003680
add esp, 4
push 0x100
test eax, eax
je 0x101797dd
lea ecx, [ebp - 0x204]
push ecx
push 0
push edi
call eax
jmp 0x101797ed
lea eax, [ebp - 0x204]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, eax
test esi, esi
je 0x101797fa
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x103
je 0x10179975
test edi, edi
jne 0x10179492
jmp 0x10179824
cmp ebx, 0x103
je 0x10179975
test ebx, ebx
jne 0x10179962
push 0x10202940
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x10179962
mov ecx, 0x200
lea eax, [ebp - 0x604]
lea esp, [esp]
cmp word [eax], 0
je 0x1017985e
add eax, 2
sub ecx, 1
jne 0x10179850
mov eax, 0x200
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x101798b7
mov edx, 0x200
lea eax, [ebp - 0x604]
lea eax, [eax + esi*2]
sub edx, esi
je 0x101798af
mov edi, 0x10202944
mov esi, SysReAllocString
sub edi, eax
nop
test esi, esi
je 0x101798ab
movzx ecx, word [edi + eax]
test cx, cx
je 0x101798ab
mov word [eax], cx
dec esi
add eax, 2
sub edx, 1
jne 0x10179890
jmp 0x101798af
test edx, edx
jne 0x101798b2
sub eax, 2
xor ecx, ecx
mov word [eax], cx
mov ecx, 0x200
lea eax, [ebp - 0x604]
cmp word [eax], 0
je 0x101798d0
add eax, 2
sub ecx, 1
jne 0x101798c2
mov eax, 0x200
mov esi, ecx
sub eax, ecx
neg esi
sbb esi, esi
and esi, eax
test ecx, ecx
je 0x10179929
mov edx, 0x200
lea eax, [ebp - 0x604]
lea eax, [eax + esi*2]
sub edx, esi
je 0x10179921
lea edi, [ebp - 0x204]
mov esi, SysReAllocString
sub edi, eax
test esi, esi
je 0x1017991d
movzx ecx, word [edi + eax]
test cx, cx
je 0x1017991d
mov word [eax], cx
dec esi
add eax, 2
sub edx, 1
jne 0x10179902
jmp 0x10179921
test edx, edx
jne 0x10179924
sub eax, 2
xor ecx, ecx
mov word [eax], cx
push 0
push 0
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x608]
push dword [ebp - 0x610]
call fcn.10179390
add esp, 0x18
test eax, eax
jne 0x10179a13
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x101794b0
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x610]
mov eax, dword [ebp - 0x608]
test eax, eax
je 0x1017998b
push eax
call fcn.10034ac0
push dword [ebp - 0x60c]
mov ebx, dword [ebp - 0x614]
push ebx
call fcn.10058350
mov esi, eax
test esi, esi
jne 0x101799b4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
cmp esi, 5
jne 0x10179a11
test edi, edi
je 0x10179a11
call fcn.10003180
cmp dword [eax + 0x12c], 0
jne 0x10179a11
push dword [ebp - 0x618]
push edi
call fcn.100dc890
add esp, 8
test eax, eax
jne 0x101799f4
pop edi
pop esi
mov eax, 5
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x60c]
push ebx
call fcn.10058350
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret