Function at 0x101881d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xf8
mov eax, 0x104bb67
call fcn.0102eb5e
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], esi
cmp edi, esi
je 0x1018b08
cmp ebx, esi
je 0x1018b08
push 0x105875e
push 0xc
call fcn.0102ecae
pop ecx
pop ecx
mov ecx, eax
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 4], esi
cmp ecx, esi
je 0x1018883
call fcn.0100eca4
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0xc4], eax
jmp 0x101888b
mov dword [ebp - 0xc4], esi
mov eax, esi
mov dword [ebp - 0xc8], eax
mov dword [ebp - 4], 1
cmp eax, esi
jne 0x10188a3
push 8
jmp 0x1018b0a
lea eax, [ebp - 0xdc]
push eax
push 0x20019
push esi
push edi
push ebx
mov dword [ebp - 0xdc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10188eb
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xc4]
push 1
mov dword [ebp - 0xcc], esi
mov dword [edi], esi
call fcn.01015d88
mov eax, edi
jmp 0x1018b18
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0xd0], esi
lea eax, [ebp - 0xe8]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc4]
push eax
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xd0]
mov dword [ebp - 0xc4], 0x56
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
cmp edi, esi
jne 0x1018a70
push 0x1a8
mov byte [ebp - 4], 2
call fcn.0102da8a
pop ecx
mov dword [ebp - 0xcc], eax
mov byte [ebp - 4], 3
cmp eax, esi
je 0x101898c
lea eax, [ebp - 0xc0]
push eax
lea ecx, [ebp - 0x104]
call fcn.01010e7e
mov ecx, dword [ebp - 0xcc]
or dword [ebp - 0xd4], 2
lea eax, [ebp - 0x104]
push eax
mov byte [ebp - 4], 4
call fcn.01018034
mov edi, eax
jmp 0x101898e
xor edi, edi
xor ebx, ebx
inc ebx
test byte [ebp - 0xd4], 2
mov dword [ebp - 4], 7
je 0x10189b5
and dword [ebp - 0xd4], 0xfffffffd
push esi
push ebx
lea ecx, [ebp - 0x104]
call fcn.0100e576
push esi
lea eax, [ebp - 0xe0]
push eax
call fcn.01012df6
lea eax, [ebp - 0xe0]
push eax
push 0x20019
push esi
lea eax, [ebp - 0xc0]
push eax
push dword [ebp - 0xdc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x1018a11
lea eax, [ebp - 0xc4]
push eax
push esi
push esi
push esi
push 0x1003b28
push dword [ebp - 0xe0]
mov dword [ebp - 0xc4], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x1018a11
mov dword [edi + 0x100], ebx
push ecx
mov ecx, dword [ebp - 0xc8]
mov eax, esp
mov dword [ebp - 0xcc], esp
mov dword [ebp - 0xcc], esi
mov dword [eax], edi
call fcn.01017ca0
cmp eax, esi
jge 0x1018a3f
cmp dword [ebp + 0x14], esi
je 0x1018a3f
push 0x32
pop edi
mov byte [ebp - 4], 1
jmp 0x1018a78
mov dword [ebp - 4], ebx
jmp 0x1018afd
cmp edi, 0x103
je 0x1018aa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1018a89
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 0xc8]
call fcn.01014783
push esi
lea ecx, [ebp - 0xc8]
call fcn.01016028
jmp 0x1018acb
mov eax, dword [ebp - 0xc8]
cmp dword [eax + 8], esi
jne 0x1018acb
mov ecx, eax
call fcn.01014783
push esi
lea ecx, [ebp - 0xc8]
call fcn.01016028
push 0x490
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
lea eax, [ebp - 0xdc]
push eax
call fcn.01012df6
push esi
lea eax, [ebp - 0xe0]
push eax
call fcn.01012df6
mov eax, dword [ebp - 0xd8]
mov ecx, dword [ebp - 0xc8]
mov dword [eax], ecx
jmp 0x1018b18
inc dword [ebp - 0xd0]
jmp 0x10188fe
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0xd8]
mov dword [eax], esi
call fcn.0102ebc9
ret 0x10