Function at 0x100179f
Capabilities:
Query or enumerate registry key
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x64]
sub esp, 0x4c4
push ebx
lea eax, [ebp + 0x6c]
push eax
push 0x2000000
xor ebx, ebx
push ebx
push dword [ebp + 0x70]
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10019fe
test byte [ebp + 0x74], 0x10
push esi
push edi
je 0x100183a
mov esi, dword [ebp + 0x74]
and esi, 0xffffffef
xor edi, edi
jmp 0x100182d
push 0x50
pop eax
push eax
mov dword [ebp + 0x50], eax
lea eax, [ebp - 0x50]
push eax
push edi
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0xea
je 0x100182c
cmp eax, ebx
jne 0x10019f3
push dword [ebp + 0x7c]
lea eax, [ebp - 0x50]
push dword [ebp + 0x78]
push esi
push eax
push dword [ebp + 0x6c]
call fcn.0100179f
test byte [ebp + 0x74], 1
je 0x100182c
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
test eax, eax
jne 0x100182c
dec edi
inc edi
cmp dword [0x100313c], ebx
je 0x10017dd
jmp 0x10019f3
cmp dword [0x100313c], ebx
mov dword [ebp + 0x60], ebx
mov dword [ebp + 0x58], ebx
jne 0x10019f3
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, 0x104
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp + 0x5c]
push eax
push 0
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x50]
push eax
push dword [ebp + 0x58]
mov dword [ebp + 0x50], 0x50
push dword [ebp + 0x6c]
mov dword [ebp + 0x54], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0xea
je 0x1001953
test eax, eax
jne 0x1001963
cmp dword [ebp + 0x5c], 1
je 0x10018ad
cmp dword [ebp + 0x5c], 2
jne 0x1001953
cmp dword [ebp + 0x5c], 2
jne 0x10018e0
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
call esi
push ebx
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x460]
push eax
call dword [sym.imp.SHLWAPI.dll_Ordinal_460]
test eax, eax
je 0x1001953
cmp eax, ebx
ja 0x1001953
cmp dword [0x1003138], 0
je 0x10018f0
cmp word [ebp - 0x50], 0x2a
jne 0x1001953
push 0x618
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x1001953
push dword [ebp + 0x70]
push edi
call esi
lea eax, [ebp - 0x50]
push eax
lea eax, [edi + 0x208]
push eax
call esi
lea eax, [ebp - 0x258]
push eax
lea eax, [edi + 0x410]
push eax
call esi
cmp dword [ebp + 0x60], 0
jne 0x1001944
push 5
call dword [sym.imp.COMCTL32.dll_DPA_Create]
test eax, eax
mov dword [ebp + 0x60], eax
jne 0x1001944
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001953
push edi
push 0x7fffffff
push dword [ebp + 0x60]
call dword [sym.imp.COMCTL32.dll_DPA_InsertPtr]
inc dword [ebp + 0x58]
cmp dword [0x100313c], 0
je 0x1001857
mov eax, dword [ebp + 0x60]
test eax, eax
je 0x10019f1
mov eax, dword [eax]
and dword [ebp + 0x70], 0
test eax, eax
mov dword [ebp + 0x54], eax
jle 0x10019e8
mov edi, dword [ebp + 0x74]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
and edi, 1
push dword [ebp + 0x70]
push dword [ebp + 0x60]
call dword [sym.imp.COMCTL32.dll_DPA_GetPtr]
test edi, edi
mov esi, eax
je 0x10019af
lea eax, [esi + 0x208]
cmp word [eax], 0x21
je 0x10019af
push eax
push dword [ebp + 0x6c]
call ebx
test eax, eax
jne 0x10019d6
push dword [ebp + 0x7c]
lea eax, [esi + 0x410]
push dword [ebp + 0x74]
push eax
push esi
call dword [ebp + 0x78]
test edi, edi
je 0x10019d6
lea eax, [esi + 0x208]
cmp word [eax], 0x21
jne 0x10019d6
push eax
push dword [ebp + 0x6c]
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp + 0x70]
mov eax, dword [ebp + 0x70]
cmp eax, dword [ebp + 0x54]
jl 0x1001987
push dword [ebp + 0x60]
call dword [sym.imp.COMCTL32.dll_DPA_Destroy]
xor ebx, ebx
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
cmp dword [0x100313c], ebx
je 0x1001a0d
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
pop ebx
add ebp, 0x64
leave
ret 0x14