Function at 0x101ce84
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x65c
mov eax, 0x103014c
call fcn.0102ada8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x660], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp + 0x10]
mov edi, 0x80004005
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x638], edi
mov dword [ebp - 0x654], ebx
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x64c], ebx
push 0x20019
push 0x10027d0
push 0x80000002
lea ecx, [ebp - 0x654]
mov dword [ebp - 4], ebx
call fcn.0101c571
mov esi, eax
cmp esi, ebx
je 0x101cf2d
push 0x1002750
push 5
push 2
push 0x1035128
call fcn.0102c6ab
add esp, 0x10
cmp esi, ebx
jle 0x101cf16
and esi, 0xffff
or esi, 0x80070000
mov edi, esi
lea ecx, [ebp - 0x654]
call fcn.0101c4fe
mov eax, edi
call fcn.0102ae3a
ret 0xc
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x630]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x654]
mov dword [ebp - 0x630], ebx
mov dword [ebp - 0x664], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, ebx
je 0x101cf69
push 0x10026c0
jmp 0x101cef5
cmp dword [ebp - 0x630], ebx
jne 0x101cf89
push 0x1002640
push 5
push 2
push 0x1035128
call fcn.0102c6ab
add esp, 0x10
jmp 0x101cf18
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x420], ax
lea eax, [ebp - 0x41e]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x634], ebx
cmp dword [ebp - 0x630], ebx
jbe 0x101d1a3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x104
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x634]
push dword [ebp - 0x654]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, ebx
jne 0x101d155
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x63c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101d155
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 0x640], ebx
push 0x20019
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x654]
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], 1
call fcn.0101c571
cmp eax, ebx
jne 0x101d147
xor eax, eax
push esi
mov word [ebp - 0x628], ax
lea eax, [ebp - 0x626]
push ebx
push eax
mov dword [ebp - 0x62c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push 0x100262c
push dword [ebp - 0x648]
mov dword [ebp - 0x668], 0x208
call edi
cmp eax, ebx
jne 0x101d147
cmp dword [ebp - 0x62c], 1
jne 0x101d147
lea eax, [ebp - 0x628]
push eax
push dword [ebp - 0x658]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x101d131
push esi
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x62c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x62c]
push eax
push ebx
push 0x1002620
push dword [ebp - 0x648]
mov dword [ebp - 0x65c], 0x208
call edi
cmp eax, ebx
jne 0x101d147
cmp dword [ebp - 0x62c], 1
jne 0x101d147
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x660]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x101d16f
push 0x10025c8
jmp 0x101d136
push 0x1002570
push 5
push 2
push 0x1035128
call fcn.0102c6ab
add esp, 0x10
lea ecx, [ebp - 0x648]
mov byte [ebp - 4], bl
call fcn.0101c4fe
inc dword [ebp - 0x634]
mov eax, dword [ebp - 0x634]
cmp eax, dword [ebp - 0x630]
jb 0x101cfc0
jmp 0x101d1a3
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x63c]
mov dword [ebp - 0x638], ebx
push 0x10024e0
push 5
push 2
push 0x1035128
call fcn.0102c6ab
add esp, 0x18
lea ecx, [ebp - 0x648]
call fcn.0101c4fe
mov edi, dword [ebp - 0x638]
jmp 0x101cf18