Function at 0x100c787
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x34
mov eax, 0x103979a
call fcn.01037317
mov dword [ebp - 0x34], ecx
xor edi, edi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x14], edi
call fcn.01014810
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], edi
cmp dword [ebp + 0x10], edi
je 0x100cab4
cmp dword [ebp + 0x14], edi
je 0x100cab4
lea eax, [ebp - 0x14]
push eax
push 1
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
je 0x100c815
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c808
test byte [eax + 0x1c], 1
je 0x100c808
push esi
push 0x1001e78
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
push esi
call fcn.0100968c
mov esi, eax
jmp 0x100ca82
push dword [ebp + 0x10]
push 0x1002664
push dword [ebp + 0x14]
call fcn.010157db
mov esi, eax
add esp, 0xc
cmp esi, edi
jge 0x100c860
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ca82
test byte [eax + 0x1c], 1
je 0x100ca82
push esi
push 0x1001e78
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x100ca82
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_RegQueryInfoKeyW]
mov esi, eax
cmp esi, edi
je 0x100c8aa
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c808
test byte [eax + 0x1c], 1
je 0x100c808
push esi
push 0x1001e78
push 0x19
jmp 0x100c7fd
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
mov byte [ebp - 4], 1
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov esi, eax
pop ecx
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], edi
jmp 0x100c8e1
cmp esi, edi
jne 0x100c913
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c909
test byte [eax + 0x1c], 1
je 0x100c909
push 0x1001e78
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
mov esi, 0x8007000e
jmp 0x100ca82
push dword [ebp - 0x1c]
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp + 8], eax
cmp eax, edi
jne 0x100c951
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c947
test byte [eax + 0x1c], 1
je 0x100c947
push 0x1001e78
push 0x1b
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
mov esi, 0x8007000e
jmp 0x100ca6b
cmp dword [ebp - 0x24], edi
mov dword [ebp + 0xc], edi
mov ebx, section..data
mov edi, 0x1001e78
jbe 0x100ca06
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x30]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_RegEnumValueW]
test eax, eax
je 0x100c9bb
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x100c9f7
test byte [ecx + 0x1c], 1
je 0x100c9f7
push eax
push edi
push 0x1c
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01008600
jmp 0x100c9f7
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x20]
push dword [ebp + 8]
push esi
push dword [ebp - 0x2c]
call fcn.0100bf7b
test eax, eax
jge 0x100c9eb
mov ecx, dword [section..data]
cmp ecx, ebx
je 0x100c9f7
test byte [ecx + 0x1c], 1
je 0x100c9f7
push eax
push edi
push 0x1d
jmp 0x100c9ae
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x40]
push eax
call fcn.010157c3
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x24]
jb 0x100c967
push dword [ebp + 0x10]
lea eax, [ebp - 0x40]
push 0x1002650
push eax
call fcn.010157db
mov esi, eax
add esp, 0xc
test esi, esi
jge 0x100ca40
mov eax, dword [section..data]
cmp eax, ebx
je 0x100ca69
test byte [eax + 0x1c], 1
je 0x100ca69
push esi
push edi
push 0x1e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01008600
jmp 0x100ca69
mov ecx, dword [ebp + 0x14]
lea eax, [ebp - 0x40]
push eax
call fcn.010157c3
mov esi, eax
test esi, esi
jge 0x100ca67
mov eax, dword [section..data]
cmp eax, ebx
je 0x100ca69
test byte [eax + 0x1c], 1
je 0x100ca69
push esi
push edi
push 0x1f
jmp 0x100ca33
xor esi, esi
xor edi, edi
push dword [ebp - 0x28]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp + 8], edi
je 0x100ca82
push dword [ebp + 8]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x14], edi
je 0x100ca93
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
mov dword [ebp - 0x14], edi
cmp esi, edi
jge 0x100caa4
mov ecx, dword [ebp + 0x14]
push 0x100181c
call fcn.01014c4a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.01014822
mov eax, esi
jmp 0x100cae9
mov eax, dword [section..data]
cmp eax, section..data
je 0x100cad8
test byte [eax + 0x1c], 1
je 0x100cad8
push 0x1001e78
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010078b5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.01014822
mov eax, 0x80070057
call fcn.010373cb
ret 0x10