Function at 0x1099256
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x605c
call fcn.01077a20
mov eax, dword [0x10de03c]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
push edi
mov dword [ebp - 0x6020], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
push eax
mov dword [ebp - 0x6028], edi
mov dword [ebp - 0x6038], eax
mov dword [ebp - 0x6040], esi
mov dword [ebp - 0x602c], esi
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6034], esi
mov dword [ebp - 0x6024], esi
mov dword [ebp - 0x6010], esi
mov dword [ebp - 0x6014], esi
call fcn.010a73da
test byte [edi + 0x60], 0x80
mov ebx, eax
mov dword [ebp - 0x6048], ebx
je 0x10992e6
push ebx
call fcn.010a7464
push eax
push esi
push edi
call fcn.010a76f7
push eax
mov dword [ebp - 0x6040], eax
call fcn.010a7464
jmp 0x10992e8
mov eax, ebx
cmp ebx, esi
je 0x1099b14
cmp eax, esi
je 0x1099b14
push eax
push 0x10113d8
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x2000000
jne 0x1099993
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x1011530
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x1099993
lea eax, [ebp - 0x6030]
push eax
lea eax, [ebp - 0x6034]
push eax
push esi
push esi
push 0x1011520
push dword [ebp - 0x600c]
mov dword [ebp - 0x6030], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x600c]
mov dword [ebp - 0x6018], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6018], esi
jne 0x1099993
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
je 0x1099413
push 0x1011748
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1011708
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099413
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114d0
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1011708
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x10
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x1099491
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
mov eax, dword [ebp - 0x6028]
test byte [eax + 0x4a], 8
pop ecx
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6010], esi
je 0x1099530
push 0x1011748
lea eax, [ebp - 0x2004]
push 0x10116d0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x1099530
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
jne 0x1099530
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10114d0
lea eax, [ebp - 0x2004]
push 0x10116d0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
cmp dword [ebp - 0x6018], esi
jne 0x10995b0
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push dword [ebp - 0x6020]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
jne 0x10995b0
lea eax, [ebp - 0x6024]
push eax
lea eax, [ebp - 0x602c]
push eax
push dword [ebp - 0x600c]
lea edx, [ebp - 0x6010]
lea ecx, [ebp - 0x6008]
call fcn.01098a0f
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6008]
call dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp - 0x6018], esi
pop ecx
jne 0x1099993
mov eax, dword [ebp - 0x602c]
jmp 0x1099985
mov eax, dword [ebp - 0x6010]
cmp word [eax], si
je 0x1099993
push 0x10116a8
call dword [sym.imp.msvcrt.dll_wcslen]
push eax
push 0x10116a8
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0x10
test eax, eax
jne 0x1099639
push 0x10116a8
call dword [sym.imp.msvcrt.dll_wcslen]
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2]
push eax
push dword [ebp - 0x6034]
lea eax, [ebp - 0x2004]
push 0x1011708
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x14
jmp 0x1099654
push dword [ebp - 0x6010]
lea eax, [ebp - 0x2004]
push 0x1011684
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
push dword [ebp - 0x6010]
lea eax, [ebp - 0x6004]
push 0x1011670
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push 0x1011660
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0x14
test eax, eax
je 0x109996e
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
cmp word [ecx + eax*2 - 2], 0x2a
lea eax, [ebp - 0x2004]
jne 0x1099955
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
mov word [ebp + eax*2 - 0x2008], si
lea eax, [ebp - 0x6004]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
pop ecx
mov word [ebp + eax*2 - 0x6008], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6030]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x2004]
push eax
push 0x80000002
call edi
test eax, eax
jne 0x109996e
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6044]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x6004]
push eax
push 0x80000002
call edi
cmp eax, esi
jne 0x1099918
mov dword [ebp - 0x6008], esi
mov dword [ebp - 0x6014], esi
mov dword [ebp - 0x6024], esi
cmp dword [ebp - 0x6014], esi
je 0x1099753
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
lea eax, [ebp - 0x605c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x6054]
push eax
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6024]
mov dword [ebp - 0x6054], 0x1000
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10998f2
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6044]
call edi
cmp eax, esi
je 0x10997bc
mov dword [ebp - 0x6014], esi
cmp eax, esi
mov dword [ebp - 0x6008], esi
jne 0x1099835
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push 4
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099926
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6008]
push eax
push esi
push ebx
push esi
push 0x100205c
push esi
lea eax, [ebp - 0x4004]
push eax
push dword [ebp - 0x6030]
call edi
cmp eax, esi
mov dword [ebp - 0x6018], eax
je 0x1099926
mov dword [ebp - 0x6008], esi
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x604c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x1011654
push dword [ebp - 0x6014]
mov dword [ebp - 0x6018], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10998c0
lea eax, [ebp - 0x6018]
push eax
lea eax, [ebp - 0x603c]
push eax
lea eax, [ebp - 0x6050]
push eax
push esi
push 0x1011654
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10998c0
mov eax, dword [ebp - 0x604c]
cmp eax, dword [ebp - 0x603c]
jae 0x10998c0
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.01098971
mov dword [ebp - 0x6018], esi
cmp dword [ebp - 0x6008], esi
je 0x10998e0
push dword [ebp - 0x6008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6008], esi
inc dword [ebp - 0x6024]
cmp dword [ebp - 0x6018], esi
je 0x1099739
cmp dword [ebp - 0x6014], esi
je 0x109990c
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6014], esi
push dword [ebp - 0x6044]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6030]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x109996e
cmp dword [ebp - 0x601c], 1
jne 0x1099835
push dword [ebp - 0x6038]
push dword [ebp - 0x6008]
push dword [ebp - 0x6014]
push dword [ebp - 0x6028]
call fcn.01098971
jmp 0x10998c6
push dword [ebp - 0x6038]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.010990d8
push dword [ebp - 0x6010]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 0x6010]
lea eax, [ecx + eax*2 + 2]
cmp eax, esi
mov dword [ebp - 0x6010], eax
jne 0x10995d4
cmp word [0x10ecaf8], si
je 0x1099a32
push 0x5c
push 0x10ecaf8
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x10999b8
mov eax, 0x10ecaf8
add eax, 2
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
jne 0x10999cf
mov eax, 0x10ecaf8
add eax, 2
push eax
push dword [ebp - 0x6034]
mov dword [ebp - 0x603c], eax
lea eax, [ebp - 0x2004]
push 0x1011610
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
push dword [ebp - 0x603c]
lea eax, [ebp - 0x6004]
push 0x10115d0
push eax
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0x1c
push dword [ebp - 0x6038]
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x6004]
push eax
push dword [ebp - 0x6028]
call fcn.010990d8
mov word [0x10ecaf8], si
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x6014]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10115c0
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099ae0
lea eax, [ebp - 0x601c]
push eax
lea eax, [ebp - 0x600c]
push eax
push esi
push ebx
push 4
push esi
push esi
push 0x10113d8
push dword [ebp - 0x6020]
call edi
test eax, eax
jne 0x1099ad4
cmp dword [0x10e2588], esi
je 0x1099ac8
push esi
push esi
push dword [ebp - 0x600c]
push dword [ebp - 0x6014]
call sub.SYSSETUP.dll_AsrRestorePlugPlayRegistryData
test eax, eax
jne 0x1099ac8
push esi
push esi
push esi
call fcn.01050ed2
push 0xe27
xor edi, edi
inc edi
push edi
push edi
push esi
call fcn.01050ed2
push 8
push esi
call fcn.01050ed2
add esp, 0x24
mov dword [0x10e0f40], edi
push dword [ebp - 0x600c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6014]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x602c]
mov esi, dword [sym.imp.msvcrt.dll_free]
call esi
pop ecx
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push 0x10113d8
push dword [ebp - 0x6020]
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push dword [ebp - 0x6048]
jmp 0x1099b1b
mov esi, dword [sym.imp.msvcrt.dll_free]
push ebx
call esi
push dword [ebp - 0x6040]
call esi
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01075bbb
leave
ret 8