Function at 0x1028655
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x668
mov eax, 0x104286d
call fcn.01001615
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x634], ebx
push ebx
lea edx, [ebp - 0x634]
push edx
push ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0101f2a9
mov esi, eax
cmp esi, ebx
jl 0x1028b49
lea eax, [ebp - 0x63c]
push eax
push 0x1028ba4
call fcn.01028575
mov esi, eax
cmp esi, ebx
jl 0x1028b3f
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x218]
push eax
push ebx
push dword [ebp - 0x63c]
mov dword [ebp - 0x650], ebx
mov dword [ebp - 0x65c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x66c], eax
jne 0x1028b20
inc dword [ebp - 0x650]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x62c]
mov dword [ebp - 0x65c], 0x104
call fcn.01003bb9
mov esi, dword [ebp - 0x62c]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
js 0x1028abe
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x664]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x63c]
call edi
push eax
call fcn.0100b113
mov esi, eax
cmp esi, ebx
jl 0x1028abe
lea eax, [ebp - 0x644]
push eax
push 0x1028b90
push dword [ebp - 0x664]
call fcn.0100b331
mov esi, eax
cmp esi, ebx
jl 0x1028aae
mov dword [ebp - 0x630], ebx
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x634]
mov edx, dword [ecx]
neg eax
sbb eax, eax
movzx eax, ax
lea esi, [ebp - 0x630]
push esi
push eax
push dword [ebp - 0x62c]
mov byte [ebp - 4], 2
push ecx
call dword [edx + 0x24]
mov esi, eax
cmp esi, 0x80040d02
je 0x10287be
and eax, 0xffff
cmp eax, 0xb7
jne 0x10287d9
mov eax, dword [ebp - 0x634]
mov ecx, dword [eax]
lea edx, [ebp - 0x630]
push edx
push dword [ebp - 0x62c]
push eax
call dword [ecx + 0x30]
mov esi, eax
cmp esi, ebx
jl 0x1028a9a
mov dword [ebp - 0x658], ebx
mov eax, dword [ebp - 0x630]
mov ecx, dword [eax]
lea edx, [ebp - 0x658]
push edx
push eax
mov byte [ebp - 4], 3
call dword [ecx + 0x34]
mov esi, eax
cmp esi, ebx
jl 0x1028a86
lea eax, [ebp - 0x648]
push eax
push 0xf003f
push ebx
push 0x1028b84
push dword [ebp - 0x664]
call edi
push eax
call fcn.0100b113
mov esi, eax
cmp esi, ebx
jl 0x1028a86
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push dword [ebp - 0x648]
mov dword [ebp - 0x64c], 0x104
mov dword [ebp - 0x654], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, ebx
jne 0x1028a66
inc dword [ebp - 0x654]
lea eax, [ebp - 0x640]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x648]
mov dword [ebp - 0x64c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.0100b113
mov esi, eax
cmp esi, ebx
jl 0x1028a2a
lea eax, [ebp - 0x674]
push eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x670]
push eax
push 0x1028b78
push ebx
push dword [ebp - 0x640]
mov dword [ebp - 0x670], 1
mov dword [ebp - 0x674], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
call fcn.0100b113
mov esi, eax
cmp esi, ebx
jl 0x1028a1a
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x660]
call fcn.01003bb9
mov esi, dword [ebp - 0x660]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
js 0x1028a0a
lea eax, [ebp - 0x644]
push eax
push 0x1028b90
push dword [ebp - 0x640]
call fcn.0100b331
mov esi, eax
cmp esi, ebx
jl 0x1028a0a
mov dword [ebp - 0x668], ebx
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x658]
mov edx, dword [ecx]
neg eax
sbb eax, eax
movzx eax, ax
lea esi, [ebp - 0x668]
push esi
push eax
push dword [ebp - 0x660]
mov byte [ebp - 4], 5
push ecx
call dword [edx + 0x24]
mov esi, eax
cmp esi, 0x80040d02
jne 0x1028984
xor esi, esi
jmp 0x10289f6
cmp esi, ebx
jl 0x10289f6
mov dword [ebp - 0x638], ebx
mov eax, dword [ebp - 0x668]
mov ecx, dword [eax]
lea edx, [ebp - 0x638]
push edx
push 0x1028b68
push eax
mov byte [ebp - 4], 6
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x10289e2
mov eax, dword [ebp - 0x644]
mov ecx, dword [ebp - 0x638]
mov edx, dword [ecx]
neg eax
sbb eax, eax
movzx eax, ax
push eax
push ecx
call dword [edx + 0x24]
mov esi, eax
cmp esi, ebx
jl 0x10289e2
push dword [ebp - 0x640]
push dword [ebp - 0x638]
call fcn.0102753e
mov esi, eax
mov eax, dword [ebp - 0x638]
cmp eax, ebx
mov byte [ebp - 4], 5
je 0x10289f6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x668]
cmp eax, ebx
mov byte [ebp - 4], 4
je 0x1028a0a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x660]
mov byte [ebp - 4], 3
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x640]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jge 0x1028a34
cmp esi, 0x80070002
jne 0x1028a62
xor esi, esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x64c]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x654]
push dword [ebp - 0x648]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, ebx
je 0x102886b
cmp edi, ebx
je 0x1028a7a
cmp edi, 0x103
jne 0x1028a72
xor esi, esi
jmp 0x1028a7a
push edi
call fcn.0100b113
mov esi, eax
push dword [ebp - 0x648]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x658]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x1028a9a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x630]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x1028aae
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x664]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jge 0x1028ac8
cmp esi, 0x80070002
jne 0x1028b0a
xor esi, esi
push dword [ebp - 0x62c]
mov byte [ebp - 4], bl
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x65c]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x650]
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, ebx
mov dword [ebp - 0x66c], eax
jne 0x1028b16
jmp 0x10286e6
push dword [ebp - 0x62c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x66c]
cmp eax, ebx
je 0x1028b33
cmp eax, 0x103
jne 0x1028b2b
xor esi, esi
jmp 0x1028b33
push eax
call fcn.0100b113
mov esi, eax
push dword [ebp - 0x63c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x80070002
jne 0x1028b49
xor esi, esi
mov eax, dword [ebp - 0x634]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x1028b5d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.01001652
ret 8