Function at 0x1005de5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0x10], 0
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov edi, 0x1002378
push edi
push 0x80000002
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1005e4e
test byte [0x100a0bc], 1
je 0x100644e
cmp byte [0x100a0b9], 2
jb 0x100644e
push eax
push edi
push 0x10020dc
push 0x1a
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.0100280d
jmp 0x100644e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea edi, [esi + 0x74]
push edi
lea eax, [ebp - 8]
push eax
push 0
push 0x1002338
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1005e7e
cmp dword [ebp - 8], 4
je 0x1005eae
test byte [0x100a0bc], 1
je 0x1005ea8
cmp byte [0x100a0b9], 3
jb 0x1005ea8
push 0x10020dc
push 0x1b
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
mov dword [edi], 0x3c
test byte [0x100a0bc], 1
je 0x1005eda
cmp byte [0x100a0b9], 5
jb 0x1005eda
push dword [edi]
push 0x10020dc
push 0x1c
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
mov edi, dword [edi]
cmp edi, 0x3c
jbe 0x1005f19
test byte [0x100a0bc], 1
je 0x1006444
cmp byte [0x100a0b9], 3
jb 0x1006444
push edi
push 0x10020dc
push 0x1d
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
jmp 0x1006444
push 4
pop edi
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x78]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10022fc
push dword [ebp - 0xc]
mov dword [ebp - 4], edi
call ebx
test eax, eax
jne 0x1005f40
cmp dword [ebp - 8], edi
je 0x1005f7b
test byte [0x100a0bc], 1
je 0x1005f6d
cmp byte [0x100a0b9], 3
jb 0x1005f6d
mov edi, 0x10020dc
push edi
push 0x1e
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
jmp 0x1005f72
mov edi, 0x10020dc
mov dword [esi + 0x78], 0x3c
jmp 0x1005f80
mov edi, 0x10020dc
test byte [0x100a0bc], 1
je 0x1005fa9
cmp byte [0x100a0b9], 5
jb 0x1005fa9
push dword [esi + 0x78]
push edi
push 0x1f
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
mov eax, dword [esi + 0x78]
cmp eax, 0x3c
jbe 0x1005fd4
test byte [0x100a0bc], 1
je 0x1006444
cmp byte [0x100a0b9], 3
jb 0x1006444
push eax
push edi
push 0x20
jmp 0x1005f03
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x7c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x10022d0
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1005ffd
cmp dword [ebp - 8], 4
je 0x100602a
test byte [0x100a0bc], 1
je 0x1006023
cmp byte [0x100a0b9], 3
jb 0x1006023
push edi
push 0x21
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
mov dword [esi + 0x7c], 3
test byte [0x100a0bc], 1
je 0x1006053
cmp byte [0x100a0b9], 5
jb 0x1006053
push dword [esi + 0x7c]
push edi
push 0x22
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
mov eax, dword [esi + 0x7c]
cmp eax, 3
jbe 0x100607e
test byte [0x100a0bc], 1
je 0x1006444
cmp byte [0x100a0b9], 3
jb 0x1006444
push eax
push edi
push 0x23
jmp 0x1005f03
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x80]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x100229c
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x10060aa
cmp dword [ebp - 8], 4
je 0x10060da
test byte [0x100a0bc], 1
je 0x10060d0
cmp byte [0x100a0b9], 3
jb 0x10060d0
push edi
push 0x24
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
mov dword [esi + 0x80], 5
test byte [0x100a0bc], 1
je 0x1006106
cmp byte [0x100a0b9], 5
jb 0x1006106
push dword [esi + 0x80]
push edi
push 0x25
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
mov eax, dword [esi + 0x80]
cmp eax, 5
jbe 0x1006134
test byte [0x100a0bc], 1
je 0x1006444
cmp byte [0x100a0b9], 3
jb 0x1006444
push eax
push edi
push 0x26
jmp 0x1005f03
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x84]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1002264
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1006160
cmp dword [ebp - 8], 4
je 0x1006190
test byte [0x100a0bc], 1
je 0x1006186
cmp byte [0x100a0b9], 3
jb 0x1006186
push edi
push 0x27
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
mov dword [esi + 0x84], 3
test byte [0x100a0bc], 1
je 0x10061bc
cmp byte [0x100a0b9], 5
jb 0x10061bc
push dword [esi + 0x84]
push edi
push 0x28
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
mov eax, dword [esi + 0x84]
cmp eax, 0x258
jbe 0x10061ec
test byte [0x100a0bc], 1
je 0x1006444
cmp byte [0x100a0b9], 3
jb 0x1006444
push eax
push edi
push 0x29
jmp 0x1005f03
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x88]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1002248
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1006218
cmp dword [ebp - 8], 4
je 0x1006245
test byte [0x100a0bc], 1
je 0x100623e
cmp byte [0x100a0b9], 3
jb 0x100623e
push edi
push 0x2a
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
and dword [esi + 0x88], 0
test byte [0x100a0bc], 1
je 0x1006271
cmp byte [0x100a0b9], 5
jb 0x1006271
push dword [esi + 0x88]
push edi
push 0x2b
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x1002230
push dword [ebp - 0xc]
call fcn.010051ab
test eax, eax
mov dword [esi + 0x94], eax
jne 0x10062ce
test byte [0x100a0bc], 4
je 0x10062bb
cmp byte [0x100a0b9], 2
jb 0x10062bb
push 0x1002230
push edi
push 0x2c
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027d5
and dword [esi + 0x98], 0
mov dword [esi + 0x94], 0x100221c
jmp 0x10062d8
mov dword [esi + 0x98], 1
test byte [0x100a0bc], 1
je 0x1006304
cmp byte [0x100a0b9], 5
jb 0x1006304
push dword [esi + 0x94]
push edi
push 0x2d
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027d5
lea ecx, [ebp - 4]
push ecx
lea eax, [esi + 0x8c]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x1002208
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x1006330
cmp dword [ebp - 8], 4
je 0x100635d
test byte [0x100a0bc], 1
je 0x1006356
cmp byte [0x100a0b9], 3
jb 0x1006356
push edi
push 0x2e
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
and dword [esi + 0x8c], 0
test byte [0x100a0bc], 1
je 0x1006389
cmp byte [0x100a0b9], 5
jb 0x1006389
push dword [esi + 0x8c]
push edi
push 0x2f
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
lea eax, [ebp - 4]
push eax
add esi, 0x90
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x10021f0
push dword [ebp - 0xc]
mov dword [ebp - 4], 4
call ebx
test eax, eax
jne 0x10063b5
cmp dword [ebp - 8], 4
je 0x10063e1
test byte [0x100a0bc], 1
je 0x10063db
cmp byte [0x100a0b9], 3
jb 0x10063db
push edi
push 0x30
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
mov dword [esi], 3
cmp dword [esi], 0xff
jbe 0x1006415
test byte [0x100a0bc], 1
je 0x100640f
cmp byte [0x100a0b9], 3
jb 0x100640f
push edi
push 0x31
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010027af
mov dword [esi], 3
test byte [0x100a0bc], 1
je 0x100643d
cmp byte [0x100a0b9], 5
jb 0x100643d
push dword [esi]
push edi
push 0x32
push dword [0x100a0b4]
push dword [0x100a0b0]
call fcn.010050cb
mov dword [ebp - 0x10], 1
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret