Function at 0x1000a4a3
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x2a4
mov eax, 0x1006c67b
call fcn.100521f6
mov eax, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x278], eax
cmp eax, ebx
je 0x1000a79b
call fcn.1001936e
mov esi, eax
call fcn.1001938f
mov edi, eax
cmp esi, ebx
je 0x1000a79b
cmp edi, ebx
je 0x1000a79b
push str.7.7.24562.400
lea esi, [ebp - 0x294]
call fcn.100040e3
push edi
lea esi, [ebp - 0x2b0]
mov dword [ebp - 4], ebx
call fcn.100040e3
lea eax, [ebp - 0x294]
push eax
mov eax, esi
push eax
mov byte [ebp - 4], 1
call fcn.10028da4
pop ecx
pop ecx
push ebx
test eax, eax
push 1
setl byte [ebp - 0x25d]
call fcn.1000457f
or dword [ebp - 4], 0xffffffff
push ebx
push 1
lea esi, [ebp - 0x294]
call fcn.1000457f
cmp byte [ebp - 0x25d], bl
jne 0x1000a79b
mov dword [ebp - 0x25c], ebx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 2
cmp dword [eax + 0x60], ebx
mov eax, str.SoftwareTencentQQBrowserExtensions
jne 0x1000a565
mov eax, str.SoftwareTencentQQBrowserextensions8
lea ecx, [ebp - 0x25c]
push ecx
push 0x20019
push ebx
push eax
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000a73d
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x264]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x25c]
mov dword [ebp - 0x264], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1000a73d
cmp dword [ebp - 0x264], ebx
je 0x1000a73d
push 0x208
mov word [ebp - 0x220], ax
lea eax, [ebp - 0x21e]
push ebx
push eax
call fcn.10051a60
add esp, 0xc
mov dword [ebp - 0x268], ebx
cmp dword [ebp - 0x264], ebx
jbe 0x1000a73d
push 0x105
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x268]
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, ebx
jne 0x1000a71e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x60], ebx
mov eax, str.SoftwareTencentQQBrowserExtensions
jne 0x1000a623
mov eax, str.SoftwareTencentQQBrowserextensions8
push eax
lea esi, [ebp - 0x23c]
call fcn.100040e3
push 0x10076e30
mov eax, esi
push eax
mov byte [ebp - 4], 3
call fcn.10004241
lea eax, [ebp - 0x220]
push eax
mov eax, esi
push eax
call fcn.10004241
cmp dword [ebp - 0x224], 8
mov eax, dword [ebp - 0x238]
jae 0x1000a664
lea eax, [ebp - 0x238]
push 0x20019
push eax
push reloc.gdiplus.dll_Ordinal_1
lea eax, [ebp - 0x274]
mov dword [ebp - method.Util::RegKey.virtual_0], vtable.Util::RegKey.0
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
call fcn.1002733f
xor eax, eax
mov dword [ebp - 0x240], 7
mov dword [ebp - 0x244], ebx
mov word [ebp - 0x254], ax
lea eax, [ebp - 0x274]
push eax
lea edi, [ebp - 0x258]
mov ecx, str.CurrentVersion
mov byte [ebp - 4], 5
call fcn.1002740a
test al, al
je 0x1000a6e7
cmp dword [ebp - 0x244], ebx
je 0x1000a6e7
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1000a756
push ebx
push 1
lea esi, [ebp - 0x258]
call fcn.1000457f
lea esi, [ebp - 0x274]
mov dword [ebp - method.Util::RegKey.virtual_0], vtable.Util::RegKey.0
call fcn.10027392
push ebx
push 1
lea esi, [ebp - 0x23c]
mov byte [ebp - 4], 2
call fcn.1000457f
jmp 0x1000a725
cmp eax, 0x103
je 0x1000a73d
inc dword [ebp - 0x268]
mov eax, dword [ebp - 0x268]
cmp eax, dword [ebp - 0x264]
jb 0x1000a5eb
cmp dword [ebp - 0x25c], ebx
je 0x1000a751
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1000a79d
push ebx
push 1
lea esi, [ebp - 0x258]
call fcn.1000457f
lea esi, [ebp - 0x274]
mov dword [ebp - method.Util::RegKey.virtual_0], vtable.Util::RegKey.0
call fcn.10027392
push ebx
push 1
lea esi, [ebp - 0x23c]
call fcn.1000457f
cmp dword [ebp - 0x25c], ebx
je 0x1000a79b
push dword [ebp - 0x25c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
call fcn.10052279
ret 8