Function at 0x100a0fe
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], ebx
je 0x100a18a
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test byte [ebp + 0x10], 1
je 0x100a15b
cmp eax, 2
je 0x100a146
cmp eax, 3
jne 0x100a15b
cmp eax, ebx
jle 0x100a154
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x100a30f
cmp eax, ebx
je 0x100a190
jle 0x100a16b
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0xc]
mov edi, eax
push 0x10059c8
push 1
push edi
push 0x4000000
call fcn.01007e2b
add esp, 0x14
jmp 0x100a30f
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x100a246
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.01009c31
mov edi, eax
cmp edi, ebx
jge 0x100a1b8
push 0x100a434
push 1
push edi
jmp 0x100a207
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100a219
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 1
je 0x100a28f
cmp dword [ebp - 0xc], 2
je 0x100a28f
push 0x100a40c
mov eax, 0x8007000d
push 1
mov edi, eax
push eax
push 0x4000000
call fcn.01007e2b
add esp, 0x10
jmp 0x100a30e
cmp eax, 0xea
je 0x100a1e4
test byte [ebp + 0x10], 1
je 0x100a22b
cmp eax, 2
je 0x100a267
cmp eax, ebx
jle 0x100a239
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x100a3b8
jmp 0x100a2e4
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test byte [ebp + 0x10], 1
je 0x100a271
cmp eax, 2
jne 0x100a271
mov edi, 0x80070002
jmp 0x100a30e
cmp eax, ebx
je 0x100a1e4
jle 0x100a285
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x100a368
jmp 0x100a2e4
cmp dword [ebp - 0x14], ebx
jne 0x100a2f8
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
inc eax
push eax
push esi
mov dword [ebp - 0x10], eax
call fcn.01004cfb
mov edi, eax
cmp edi, ebx
jge 0x100a2b5
push dword [ebp + 0x14]
push 0x100a32c
jmp 0x100a2e6
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x100a2f8
jle 0x100a2dc
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x10059f8
mov edi, eax
push 1
push edi
push 0x4000000
call fcn.01007e2b
add esp, 0x14
jmp 0x100a30e
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov word [eax + edx*2 - 4], cx
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
mov word [eax + edx*2 - 2], cx
pop esi
cmp dword [ebp + 0xc], ebx
je 0x100a322
cmp dword [ebp - 4], ebx
je 0x100a322
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0x14