Function at 0x1002a3a7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x108]
push ebx
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x1002a5d2
cmp dword [eax + 4], edi
je 0x1002a5d2
test byte [eax + 0x1c], 0x20
je 0x1002a5d2
mov esi, dword [ebp + 0xc]
cmp esi, edi
je 0x1002a52c
cmp dword [ebp + 0x10], edi
je 0x1002a52c
push 0x24
push esi
push str.HKEY_CLASSES_ROOT
xor ebx, ebx
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a415
push str.HKEY_CLASSES_ROOT_
mov ebx, closesocket
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0xa
push esi
push str.HKCR
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a43c
push str.HKCR_
mov ebx, closesocket
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x24
push esi
push str.HKEY_CURRENT_USER
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a463
push str.HKEY_CURRENT_USER_
mov ebx, reloc.WS2_32.dll_accept
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0xa
push esi
push str.HKCU
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a48a
push str.HKCU_
mov ebx, reloc.WS2_32.dll_accept
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x26
push esi
push str.HKEY_LOCAL_MACHINE
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a4b1
push str.HKEY_LOCAL_MACHINE_
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0xa
push esi
push str.HKLM
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a4d8
push str.HKLM_
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x16
push esi
push str.HKEY_USERS
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a4ff
push str.HKEY_USERS_
mov ebx, reloc.WS2_32.dll_closesocket
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
push 0x28
push esi
push str.HKEY_CURRENT_CONFIG
call fcn.10132596
add esp, 0xc
test eax, eax
jne 0x1002a526
push str.HKEY_CURRENT_CONFIG_
mov ebx, reloc.WS2_32.dll_getpeername
call fcn.101319ca
pop ecx
lea edi, [esi + eax*2]
xor esi, esi
cmp ebx, esi
jne 0x1002a53b
push 0xe00b1001
mov eax, 0x1018aa68
jmp 0x1002a5dc
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 4], esi
jne 0x1002a55e
push 0xe00b1016
mov eax, 0x1018a8fc
jmp 0x1002a5dc
push esi
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
call esi
cmp dword [ebp - 8], 3
jne 0x1002a5c5
lea eax, [ebp + 0xc]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
add dword [ebp + 0xc], 4
push dword [ebp + 0xc]
call fcn.101317de
pop ecx
mov edi, eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push edi
push eax
call dword [ecx + 0x1c]
push edi
call fcn.101317e9
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1002a5eb
push 0xe00b101b
mov eax, 0x1018a898
push 0x1018af0c
push 0x1018af8c
call fcn.10004ead
pop edi
pop esi
pop ebx
leave
ret 0x10