Function at 0x10057680
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x100f51d4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp word [0x100fa3b0], 0
push esi
mov esi, dword [ebp + 8]
jne 0x100578f5
push ebx
push edi
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.10097030
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x104
push eax
push dword [0x100f8d04]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
xor edi, edi
lea ecx, [ecx]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
mov eax, dword [edi + 0x100e76a0]
add esp, 0xc
test eax, eax
je 0x100577b1
xor ecx, ecx
cmp cx, word [eax]
je 0x100577b1
mov dword [ebp - 0x418], ecx
lea ecx, [ebp - 0x418]
push ecx
push 0x20019
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100577b1
lea eax, [ebp - 0x41c]
mov dword [ebp - 0x420], 1
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x41c], 0x208
push eax
lea eax, [ebp - 0x420]
push eax
push 0
push str.Path
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp ax, word [ebp - 0x20c]
je 0x1005778f
lea eax, [ebp - 0x20c]
push eax
call ebx
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x100577a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100577a0
sub ecx, edx
sar ecx, 1
jmp 0x100577b3
xor ecx, ecx
cmp word [ebp - 0x20c], 0
je 0x100577d8
push ecx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.100a6f32
add esp, 0xc
test eax, eax
je 0x100577e6
add edi, 4
cmp edi, 0x18
jb 0x100576e0
jmp 0x1005782c
mov ecx, 0x100fa3b0
lea edi, [ebp - 0x20c]
mov edx, 0x104
sub edi, ecx
jmp 0x10057800
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10057820
movzx eax, word [edi + ecx]
test ax, ax
je 0x10057820
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10057800
jmp 0x10057824
test edx, edx
jne 0x10057827
sub ecx, 2
xor eax, eax
mov word [ecx], ax
cmp word [0x100fa3b0], 0
jne 0x1005789c
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.10097030
add esp, 0xc
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov ecx, 0x100fa3b0
lea edi, [ebp - 0x414]
mov edx, 0x104
sub edi, ecx
jmp 0x10057870
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10057890
movzx eax, word [edi + ecx]
test ax, ax
je 0x10057890
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10057870
jmp 0x10057894
test edx, edx
jne 0x10057897
sub ecx, 2
xor eax, eax
mov word [ecx], ax
mov ecx, 0x100fa3b0
pop edi
pop ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100578a6
sub ecx, edx
sar ecx, 1
je 0x100578da
cmp word [ecx*2 + 0x100fa3ae], 0x5c
jne 0x100578da
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x10057941
xor eax, eax
mov word [ecx + 0x100fa3b0], ax
cmp word [0x100fa3b0], 0
jne 0x100578f5
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071699
mov esp, ebp
pop ebp
ret
mov edx, 0x100fa3b0
mov ecx, 0x104
sub edx, esi
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x10057921
movzx eax, word [edx + esi]
test ax, ax
je 0x10057921
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x10057901
jmp 0x10057925
test ecx, ecx
jne 0x10057928
sub esi, 2
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
mov word [esi], ax
setne al
xor ecx, ebp
pop esi
call fcn.10071699
mov esp, ebp
pop ebp
ret
call fcn.1007180a
int3