Function at 0x1012617
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x102a0ec]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x62c], edi
mov dword [ebp - 0x634], edi
mov dword [ebp - 0x63c], edi
jne 0x1012656
mov eax, 0x80004005
jmp 0x10128f3
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
mov dword [ebp - 0x630], edi
mov esi, 0x105
cmp dword [ebp - 0x630], edi
lea eax, [ebp - 0x418]
je 0x101267e
push 0x10057f4
jmp 0x1012683
push 0x10057a8
push 0x103
push eax
call fcn.0100c535
lea eax, [ebp - 0x62c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x418]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x10128d8
push esi
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x62c]
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x638], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x10128cc
inc dword [ebp - 0x638]
lea eax, [ebp - 0x210]
push eax
push 0x1005798
lea eax, [ebp - 0x418]
push 0x103
mov edi, 0x20a
push eax
mov dword [ebp - 0x624], edi
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x634]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x62c]
call ebx
test eax, eax
jne 0x10128a2
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0x1005774
push dword [ebp - 0x634]
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x624], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x1012777
cmp dword [ebp - 0x628], 1
je 0x10127e3
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0x1005750
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x101283f
cmp dword [ebp - 0x628], 1
jne 0x1012900
lea eax, [ebp - 0x210]
push eax
call fcn.01016cfc
cmp dword [ebp - 0x630], edi
lea eax, [ebp - 0x210]
jne 0x10127d7
push 0x1005730
jmp 0x10127dc
push 0x1005720
push esi
push eax
call fcn.0100d4ff
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0x1005700
push dword [ebp - 0x634]
mov dword [ebp - 0x624], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1012822
cmp dword [ebp - 0x628], 1
je 0x101283f
push 0x103
push 0x10056f4
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.01015f81
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x10128a2
lea eax, [ebp - 0x210]
push eax
call fcn.01018429
test eax, eax
je 0x10128a2
push esi
lea eax, [ebp - 0x210]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0x210]
push eax
call fcn.01016cfc
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x640]
call fcn.010122d9
mov ecx, 0xd2af9
cmp eax, ecx
jne 0x10128a2
mov dword [ebp - 0x63c], ecx
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x638]
mov dword [ebp - 0x624], esi
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x10126da
xor edi, edi
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x630]
cmp dword [ebp - 0x630], 2
jl 0x1012669
mov eax, dword [ebp - 0x63c]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
call fcn.0101672d
leave
ret 4
push 0x1f
pop edi
jmp 0x101283f