Function at 0x10026be0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
mov eax, dword [0x1004f0d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x520], 0
cmp dword [ebp + 0xc], 0
je 0x10026c18
cmp dword [ebp + 0x10], 0
je 0x10026c18
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 0xc]
mov byte [edx + ecx], 0
cmp dword [ebp + 8], 0
je 0x10026f10
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
je 0x10026f10
cmp dword [ebp + 0xc], 0
je 0x10026f10
cmp dword [ebp + 0x10], 0
je 0x10026f10
lea ecx, [ebp - 0x524]
push ecx
push 1
push 0
push str.SYSTEMMountedDevices
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x51c], eax
cmp dword [ebp - 0x51c], 0
jne 0x10026f10
mov dword [ebp - 0x510], 0x400
push str.DosDevices_
lea edx, [ebp - 0x104]
push edx
call sub.MSVCR120.dll_strcpy
add esp, 8
push 0xff
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x104]
push ecx
call dword [sym.imp.MSVCR120.dll_strncat]
add esp, 0xc
mov edx, 1
imul eax, edx, 0xff
mov dword [ebp - 0x528], eax
cmp dword [ebp - 0x528], 0x100
jae 0x10026cd1
jmp 0x10026cd6
call fcn.1003b978
mov ecx, dword [ebp - 0x528]
mov byte [ebp + ecx - 0x104], 0
lea edx, [ebp - 0x510]
push edx
lea eax, [ebp - 0x504]
push eax
lea ecx, [ebp - 0x52c]
push ecx
push 0
lea edx, [ebp - 0x104]
push edx
mov eax, dword [ebp - 0x524]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x51c], eax
mov ecx, dword [ebp - 0x524]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x51c], 0
jne 0x10026f10
cmp dword [ebp - 0x52c], 3
jne 0x10026f10
lea edx, [ebp - 0x504]
mov dword [ebp - 0x50c], edx
mov eax, dword [ebp - 0x510]
shr eax, 1
mov dword [ebp - 0x510], eax
mov ecx, 2
imul edx, ecx, 0
mov eax, dword [ebp - 0x50c]
movzx ecx, word [eax + edx]
cmp ecx, 0x5c
jne 0x10026db1
mov edx, 2
shl edx, 0
mov eax, dword [ebp - 0x50c]
movzx ecx, word [eax + edx]
cmp ecx, 0x3f
jne 0x10026db1
mov edx, 2
shl edx, 1
mov eax, dword [ebp - 0x50c]
movzx ecx, word [eax + edx]
cmp ecx, 0x3f
jne 0x10026db1
mov edx, 2
imul eax, edx, 3
mov ecx, dword [ebp - 0x50c]
movzx edx, word [ecx + eax]
cmp edx, 0x5c
je 0x10026e1c
mov eax, 2
imul ecx, eax, 0
mov edx, dword [ebp - 0x50c]
movzx eax, word [edx + ecx]
cmp eax, 0x5f
jne 0x10026f10
mov ecx, 2
shl ecx, 0
mov edx, dword [ebp - 0x50c]
movzx eax, word [edx + ecx]
cmp eax, 0x3f
jne 0x10026f10
mov ecx, 2
shl ecx, 1
mov edx, dword [ebp - 0x50c]
movzx eax, word [edx + ecx]
cmp eax, 0x3f
jne 0x10026f10
mov ecx, 2
imul edx, ecx, 3
mov eax, dword [ebp - 0x50c]
movzx ecx, word [eax + edx]
cmp ecx, 0x5f
jne 0x10026f10
mov dword [ebp - 0x520], 1
mov edx, dword [ebp - 0x50c]
add edx, 8
mov dword [ebp - 0x50c], edx
mov eax, dword [ebp - 0x510]
sub eax, 4
mov dword [ebp - 0x510], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x518], ecx
mov dword [ebp - 0x514], 0
jmp 0x10026e68
mov edx, dword [ebp - 0x514]
add edx, 1
mov dword [ebp - 0x514], edx
mov eax, dword [ebp - 0x514]
cmp eax, dword [ebp - 0x510]
jae 0x10026f07
mov ecx, dword [ebp - 0x514]
mov edx, dword [ebp - 0x50c]
mov al, byte [edx + ecx*2]
mov byte [ebp - 0x505], al
movsx ecx, byte [ebp - 0x505]
cmp ecx, 0x7b
je 0x10026ebd
movsx edx, byte [ebp - 0x505]
cmp edx, 0x23
jne 0x10026ebf
mov eax, dword [ebp - 0x514]
mov ecx, dword [ebp - 0x50c]
movzx edx, word [ecx + eax*2 + 2]
cmp edx, 0x7b
jne 0x10026ebf
jmp 0x10026f07
movsx eax, byte [ebp - 0x505]
cmp eax, 0x23
jne 0x10026ed2
mov byte [ebp - 0x505], 0x5c
mov ecx, dword [ebp - 0x518]
sub ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub edx, 1
cmp ecx, edx
jae 0x10026f02
mov eax, dword [ebp - 0x518]
mov cl, byte [ebp - 0x505]
mov byte [eax], cl
mov edx, dword [ebp - 0x518]
add edx, 1
mov dword [ebp - 0x518], edx
jmp 0x10026e59
mov eax, dword [ebp - 0x518]
mov byte [eax], 0
mov eax, dword [ebp - 0x520]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003b334
mov esp, ebp
pop ebp
ret