Function at 0x1004bdc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x10e4
call fcn.01007aa0
mov eax, dword [0x100a074]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1070]
mov dword [ebp - 0x10e0], eax
lea eax, [ebp - 0x1074]
mov dword [ebp - 0x10d8], eax
lea eax, [ebp - 0x1094]
mov dword [ebp - 0x10d0], eax
lea eax, [ebp - 0x1080]
mov dword [ebp - 0x10c8], eax
lea eax, [ebp - 0x1084]
mov dword [ebp - 0x10c0], eax
lea eax, [ebp - 0x1078]
mov dword [ebp - 0x10b8], eax
lea eax, [ebp - 0x108c]
push ebx
mov dword [ebp - 0x10b0], eax
lea eax, [ebp - 0x1098]
push esi
xor esi, esi
mov dword [ebp - 0x10a8], eax
lea eax, [ebp - 0x107c]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x104c], esi
mov dword [ebp - 0x103c], esi
mov dword [ebp - 0x1040], esi
mov dword [ebp - 0x1060], esi
mov dword [ebp - 0x1090], esi
mov dword [ebp - 0x1068], esi
mov dword [ebp - 0x106c], esi
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x105c], closesocket
mov dword [ebp - 0x1054], esi
mov dword [ebp - 0x1048], esi
mov dword [ebp - 0x1044], esi
mov dword [ebp - 0x1064], esi
mov dword [ebp - 0x1088], esi
mov dword [ebp - 0x1058], esi
mov dword [ebp - 0x1070], esi
mov dword [ebp - 0x1074], esi
mov dword [ebp - 0x1094], esi
mov dword [ebp - 0x1080], esi
mov dword [ebp - 0x1084], esi
mov dword [ebp - 0x1078], esi
mov dword [ebp - 0x108c], esi
mov dword [ebp - 0x1098], esi
mov dword [ebp - 0x107c], esi
mov dword [ebp - 0x10e4], 0x1f43
mov dword [ebp - 0x10dc], 0x1f44
mov dword [ebp - 0x10d4], 0x1f45
mov dword [ebp - 0x10cc], 0x1f46
mov dword [ebp - 0x10c4], 0x1f47
mov dword [ebp - 0x10bc], 0x1f48
mov dword [ebp - 0x10b4], 0x1f49
mov dword [ebp - 0x10ac], 0x1f4a
mov dword [ebp - 0x10a4], 0x1f4b
mov dword [ebp - 0x10a0], eax
xor ebx, ebx
push dword [ebp + ebx*8 - 0x10e0]
push dword [ebp + ebx*8 - 0x10e4]
push 0x800
call fcn.01007ffb
add esp, 0xc
test eax, eax
je 0x1004deb
inc ebx
cmp ebx, 9
jb 0x1004d57
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x1034]
push 0x1001b40
push eax
call ebx
pop ecx
pop ecx
mov dword [ebp - 0x1038], eax
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1064]
push eax
push 0x1001b2c
push edi
call fcn.01002bf3
cmp al, 1
jne 0x1004e43
push dword [ebp - 0x1058]
push edi
call fcn.01002c42
cmp dword [ebp - 0x1064], esi
jne 0x1004e13
push 0x641
call fcn.01007f71
mov dword [ebp - 0x104c], 1
mov edi, 0x80070057
jmp 0x10051c9
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
test eax, eax
jg 0x1004dfe
call edi
jmp 0x100528b
call edi
mov edi, eax
and edi, 0xffff
or edi, 0x80070000
jmp 0x10051c9
mov eax, dword [ebp - 0x1038]
lea eax, [ebp + eax*2 - 0x1034]
push 0x1001b28
push eax
call ebx
mov ecx, dword [ebp - 0x1038]
push dword [ebp - 0x1064]
add ecx, eax
lea eax, [ebp + ecx*2 - 0x1034]
push eax
call ebx
add esp, 0x10
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1088]
push eax
push 0x10016d4
push edi
call fcn.01002bf3
cmp al, 1
jne 0x1004ea5
push dword [ebp - 0x1058]
push edi
call fcn.01002c42
lea eax, [ebp - 0x1054]
push eax
push closesocket
push dword [ebp - 0x1088]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp eax, esi
je 0x1004e9d
jle 0x100528b
and eax, 0xffff
or eax, 0x80070000
jmp 0x100528b
mov ebx, dword [ebp - 0x1054]
jmp 0x1004eab
mov ebx, dword [ebp - 0x105c]
push edi
call fcn.01002c85
mov edi, eax
cmp edi, esi
jl 0x10051c9
lea eax, [ebp - 0x1050]
push eax
push 1
push esi
lea eax, [ebp - 0x1034]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1004e88
push esi
push esi
lea eax, [ebp - 0x1040]
push eax
lea eax, [ebp - 0x103c]
push eax
lea eax, [ebp - 0x1060]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp - 0x1050]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
jne 0x1004e88
cmp dword [ebp - 0x1060], esi
jne 0x1004f16
mov edi, 0x80070103
jmp 0x10051c9
add dword [ebp - 0x103c], 2
mov eax, dword [ebp - 0x103c]
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
add eax, eax
push eax
push 0x40
call edi
cmp eax, esi
mov dword [ebp - 0x1048], eax
jne 0x1004f44
mov edi, 0x8007000e
jmp 0x10051c9
push dword [ebp - 0x1040]
push 0x40
call edi
cmp eax, esi
mov dword [ebp - 0x1044], eax
je 0x1004f3a
mov ebx, dword [ebp - 0x103c]
add ebx, 3
push 0xfffffffffffffff5
mov dword [ebp - 0x109c], ebx
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0x105c], edi
je 0x1004deb
push 0x100125c
push edi
call fcn.01003052
push dword [ebp - 0x1094]
lea eax, [ebx + 0x14]
push eax
push dword [ebp - 0x1074]
push ebx
push dword [ebp - 0x1070]
push esi
push edi
call fcn.01004ac0
mov ecx, dword [ebp - 0x1040]
shr ecx, 1
lea eax, [ebx + 0x14]
add ecx, eax
mov dword [ebp - 0x1038], esi
je 0x1004fe4
push 0x10015ac
push edi
call fcn.01003052
mov ecx, dword [ebp - 0x1040]
inc dword [ebp - 0x1038]
shr ecx, 1
lea eax, [ebx + 0x14]
add ecx, eax
cmp dword [ebp - 0x1038], ecx
jb 0x1004fbe
push 0x1001b20
push edi
call fcn.01003052
cmp dword [ebp - 0x1060], esi
mov dword [ebp - 0x1038], esi
jbe 0x10051bc
mov eax, dword [ebp - 0x103c]
mov ecx, dword [ebp - 0x1040]
mov edi, dword [ebp - 0x1048]
mov dword [ebp - 0x106c], ecx
mov dword [ebp - 0x1068], eax
mov ecx, eax
xor eax, eax
rep stosw word es:[edi], ax
mov ecx, dword [ebp - 0x1040]
mov edi, dword [ebp - 0x1044]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov edi, dword [ebp - 0x1044]
lea eax, [ebp - 0x106c]
push eax
push edi
lea eax, [ebp - 0x1090]
push eax
push esi
lea eax, [ebp - 0x1068]
push eax
push dword [ebp - 0x1048]
push dword [ebp - 0x1038]
push dword [ebp - 0x1050]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1005285
mov eax, dword [ebp - 0x1068]
cmp eax, dword [ebp - 0x103c]
ja 0x1005292
mov eax, dword [ebp - 0x106c]
cmp eax, dword [ebp - 0x1040]
ja 0x1005292
mov eax, dword [ebp - 0x1090]
dec eax
je 0x100517d
dec eax
je 0x1005175
dec eax
dec eax
je 0x1005159
sub eax, 3
je 0x10050d3
mov eax, dword [ebp - 0x1098]
mov ecx, dword [ebp - 0x107c]
jmp 0x1005185
xor eax, eax
mov word [ebp - 0x834], si
mov ecx, 0x1ff
lea edi, [ebp - 0x832]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, dword [ebp - 0x1044]
mov word [ebp - 0xc], si
mov word [ebp - 0xa], si
mov word [ebp - 8], si
xor ebx, ebx
jmp 0x1005140
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + ebx*2 - 0x834]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add ebx, eax
lea eax, [ebp + ebx*2 - 0x834]
push edi
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push edi
add ebx, eax
mov word [ebp - 0xc], 0x2c
mov word [ebp - 0xa], 0x20
call dword [sym.imp.msvcrt.dll_wcslen]
add esp, 0x14
lea edi, [edi + eax*2 + 2]
cmp word [edi], si
jne 0x1005101
mov eax, dword [ebp - 0x1078]
mov ebx, dword [ebp - 0x109c]
lea ecx, [ebp - 0x834]
jmp 0x1005185
push 0xa
lea eax, [ebp - 0x34]
push eax
push dword [edi]
call dword [sym.imp.msvcrt.dll__ltow]
mov eax, dword [ebp - 0x1080]
add esp, 0xc
lea ecx, [ebp - 0x34]
jmp 0x1005185
mov eax, dword [ebp - 0x108c]
jmp 0x1005183
mov eax, dword [ebp - 0x1084]
mov ecx, edi
push ecx
lea ecx, [ebx + 0x14]
push ecx
push eax
push ebx
push dword [ebp - 0x1048]
push esi
push dword [ebp - 0x105c]
call fcn.01004ac0
inc dword [ebp - 0x1038]
mov eax, dword [ebp - 0x1038]
cmp eax, dword [ebp - 0x1060]
jb 0x1005001
mov edi, dword [ebp - 0x105c]
push 0x100125c
push edi
call fcn.01003052
xor edi, edi
xor ebx, ebx
mov eax, dword [ebp + ebx*8 - 0x10e0]
mov eax, dword [eax]
cmp eax, esi
je 0x10051df
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc ebx
cmp ebx, 9
jb 0x10051cb
cmp dword [ebp - 0x1050], esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10051fb
push dword [ebp - 0x1050]
call ebx
cmp dword [ebp - 0x1054], esi
je 0x100520b
push dword [ebp - 0x1054]
call ebx
cmp dword [ebp - 0x1048], esi
je 0x100521f
push dword [ebp - 0x1048]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x1044], esi
je 0x1005233
push dword [ebp - 0x1044]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, esi
jge 0x1005274
cmp dword [ebp - 0x104c], esi
jne 0x1005274
lea eax, [ebp - 0x104c]
push eax
push edi
call fcn.01008787
test eax, eax
jl 0x1005274
push dword [ebp - 0x104c]
push 0x10015f4
push 0x579
call fcn.01007efc
add esp, 0xc
push dword [ebp - 0x104c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.010074a2
leave
ret 4
jg 0x1004e8e
mov edi, eax
jmp 0x10051c9
mov edi, 0x8000ffff
jmp 0x10051c9