Function at 0x1002ec3
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
lea eax, [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExW]
push edi
push eax
xor edi, edi
push 0x20019
push edi
push 0x1009194
push dword [0x10211f0]
call ebx
lea ecx, [ebp - 0x28]
cmp eax, edi
mov dword [ebp - 8], ecx
jne 0x1002fae
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0xc], 9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp esi, edi
jne 0x1002fae
xor edx, edx
jmp 0x1002f73
cmp al, 0x61
jl 0x1018a6b
cmp al, 0x66
jg 0x1018a6b
movsx eax, al
sub eax, 0x57
jmp 0x1002f85
movsx ecx, cl
sub ecx, 0x30
cmp eax, edi
jl 0x1018b5e
cmp ecx, edi
jl 0x1018b5e
shl al, 4
add al, cl
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
inc edx
inc edx
mov byte [ecx], al
cmp edx, 8
jae 0x1002fae
mov al, byte [ebp + edx - 0x18]
cmp al, 0x30
jl 0x1002f31
cmp al, 0x39
jg 0x1002f31
movsx eax, al
sub eax, 0x30
mov cl, byte [ebp + edx - 0x17]
cmp cl, 0x30
jl 0x1002f93
cmp cl, 0x39
jle 0x1002f49
cmp cl, 0x61
jl 0x1018a86
cmp cl, 0x66
jg 0x1018a86
movsx ecx, cl
nop
sub ecx, 0x57
jmp 0x1002f4f
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1009188
push dword [0x10211f0]
call ebx
cmp eax, edi
jne 0x1003082
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0xc], 9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp esi, edi
jne 0x1003082
xor edx, edx
jmp 0x1003037
movsx eax, al
sub eax, 0x30
jmp 0x1003059
movsx ecx, cl
sub ecx, 0x30
cmp eax, edi
jl 0x1018b5e
cmp ecx, edi
jl 0x1018b5e
shl al, 4
add al, cl
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
inc edx
inc edx
mov byte [ecx], al
cmp edx, 8
jae 0x1003082
mov al, byte [ebp + edx - 0x18]
cmp al, 0x30
jl 0x1003043
cmp al, 0x39
jle 0x1003005
cmp al, 0x61
jl 0x1018aa3
cmp al, 0x66
jg 0x1018aa3
movsx eax, al
sub eax, 0x57
mov cl, byte [ebp + edx - 0x17]
cmp cl, 0x30
jl 0x1003067
cmp cl, 0x39
jle 0x100300d
cmp cl, 0x61
jl 0x1018abe
cmp cl, 0x66
jg 0x1018abe
movsx ecx, cl
nop
sub ecx, 0x57
jmp 0x1003013
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1009180
push dword [0x10211f0]
call ebx
cmp eax, edi
jne 0x1003142
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0xc], 9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp esi, edi
jne 0x1003142
xor edx, edx
jmp 0x10030ff
movsx ecx, cl
sub ecx, 0x30
cmp eax, edi
jl 0x1018b5e
cmp ecx, edi
jl 0x1018b5e
shl al, 4
add al, cl
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
inc edx
inc edx
mov byte [ecx], al
cmp edx, 8
jae 0x1003142
mov al, byte [ebp + edx - 0x18]
cmp al, 0x30
jl 0x1018adb
cmp al, 0x39
jg 0x1018adb
movsx eax, al
sub eax, 0x30
mov cl, byte [ebp + edx - 0x17]
cmp cl, 0x30
jl 0x1003127
cmp cl, 0x39
jle 0x10030d5
cmp cl, 0x61
jl 0x1018b09
cmp cl, 0x66
jg 0x1018b09
movsx ecx, cl
nop
sub ecx, 0x57
jmp 0x10030db
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
push 0x1009174
push dword [0x10211f0]
call ebx
cmp eax, edi
jne 0x100320f
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0xc], 9
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryInfoKeyA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
cmp esi, edi
jne 0x100320f
mov esi, dword [ebp - 8]
xor edx, edx
jmp 0x10031c5
movsx eax, al
sub eax, 0x30
jmp 0x10031e7
movsx ecx, cl
sub ecx, 0x30
cmp eax, edi
jl 0x1018b5e
cmp ecx, edi
jl 0x1018b5e
shl al, 4
add al, cl
mov byte [esi], al
inc esi
inc edx
inc edx
cmp edx, 8
jae 0x100320f
mov al, byte [ebp + edx - 0x18]
cmp al, 0x30
jl 0x10031d1
cmp al, 0x39
jle 0x1003198
cmp al, 0x61
jl 0x1018b26
cmp al, 0x66
jg 0x1018b26
movsx eax, al
sub eax, 0x57
mov cl, byte [ebp + edx - 0x17]
cmp cl, 0x30
jl 0x10031f5
cmp cl, 0x39
jle 0x10031a0
cmp cl, 0x61
jl 0x1018b41
cmp cl, 0x66
jg 0x1018b41
movsx ecx, cl
sub ecx, 0x57
jmp 0x10031a6
xor eax, eax
movzx ecx, byte [eax + 0x1021210]
mov dl, byte [ebp + eax - 0x28]
mov esi, dword [ebp + 8]
inc eax
cmp eax, 0x10
mov byte [ecx + esi], dl
jb 0x1003211
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
cmp al, 0x41
jl 0x1018a7e
cmp al, 0x46
jg 0x1018a7e
movsx eax, al
sub eax, 0x37
jmp 0x1002f85
or eax, 0xffffffff
jmp 0x1002f85
cmp cl, 0x41
jl 0x1018a9b
cmp cl, 0x46
jg 0x1018a9b
movsx ecx, cl
sub ecx, 0x37
jmp 0x1002f4f
or ecx, 0xffffffff
jmp 0x1002f4f
cmp al, 0x41
jl 0x1018ab6
cmp al, 0x46
jg 0x1018ab6
movsx eax, al
sub eax, 0x37
jmp 0x1003059
or eax, 0xffffffff
jmp 0x1003059
cmp cl, 0x41
jl 0x1018ad3
cmp cl, 0x46
jg 0x1018ad3
movsx ecx, cl
sub ecx, 0x37
jmp 0x1003013
or ecx, 0xffffffff
jmp 0x1003013
cmp al, 0x61
jl 0x1018aee
cmp al, 0x66
jg 0x1018aee
movsx eax, al
sub eax, 0x57
jmp 0x1003119
cmp al, 0x41
jl 0x1018b01
cmp al, 0x46
jg 0x1018b01
movsx eax, al
sub eax, 0x37
jmp 0x1003119
or eax, 0xffffffff
jmp 0x1003119
cmp cl, 0x41
jl 0x1018b1e
cmp cl, 0x46
jg 0x1018b1e
movsx ecx, cl
sub ecx, 0x37
jmp 0x10030db
or ecx, 0xffffffff
jmp 0x10030db
cmp al, 0x41
jl 0x1018b39
cmp al, 0x46
jg 0x1018b39
movsx eax, al
sub eax, 0x37
jmp 0x10031e7
or eax, 0xffffffff
jmp 0x10031e7
cmp cl, 0x41
jl 0x1018b56
cmp cl, 0x46
jg 0x1018b56
movsx ecx, cl
sub ecx, 0x37
jmp 0x10031a6
or ecx, 0xffffffff
jmp 0x10031a6
xor eax, eax
jmp 0x100322b