Function at 0x105c92f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x270
mov eax, dword [0x1072c48]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
push dword [0x1072c9c]
mov edi, 0x95
push 0x100b2bc
xor esi, esi
xor ebx, ebx
lea eax, [ebp - 0x25c]
push edi
inc ebx
push eax
mov dword [ebp - 0x264], esi
mov dword [ebp - 0x260], esi
mov dword [ebp - 0x268], ebx
mov dword [ebp - 0x270], esi
call fcn.0103590d
add esp, 0x14
test eax, eax
jge 0x105c993
xor eax, eax
jmp 0x105cba7
lea eax, [ebp - 0x270]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x25c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x105cb9a
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push esi
push 0x100b2a4
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, dword [sym.imp.msvcrt.dll_wcschr]
test eax, eax
jne 0x105ca54
cmp dword [ebp - 0x268], ebx
jne 0x105ca54
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01035811
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x105ca27
xor ecx, ecx
mov word [eax], cx
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.01065444
test eax, eax
je 0x105ca43
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x105ca54
inc ebx
inc ebx
jmp 0x105ca03
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0x100b294
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105caea
cmp dword [ebp - 0x268], 1
jne 0x105caea
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01035811
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x105cabd
xor ecx, ecx
mov word [eax], cx
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.01065ac0
test eax, eax
je 0x105cad9
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x105caea
inc ebx
inc ebx
jmp 0x105ca99
lea eax, [ebp - 0x26c]
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
push eax
push 0
push 0x100b280
push dword [ebp - 0x270]
mov dword [ebp - 0x26c], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x105cb80
cmp dword [ebp - 0x268], 1
jne 0x105cb80
lea ebx, [ebp - 0x25c]
push ebx
push edi
lea eax, [ebp - 0x130]
push eax
call fcn.01035811
lea eax, [ebp - 0x130]
push 0x20
push eax
call esi
pop ecx
pop ecx
test eax, eax
je 0x105cb53
xor ecx, ecx
mov word [eax], cx
inc dword [ebp - 0x260]
lea eax, [ebp - 0x130]
push eax
call fcn.01065aa5
test eax, eax
je 0x105cb6f
inc dword [ebp - 0x264]
push 0x20
push ebx
call esi
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x105cb80
inc ebx
inc ebx
jmp 0x105cb2f
push dword [ebp - 0x270]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x264]
cmp eax, dword [ebp - 0x260]
jne 0x105cb9f
push 2
pop eax
jmp 0x105cba7
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047464
leave
ret 4