Function at 0x1002f150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062488
mov eax, dword fs:[0]
push eax
push ebx
sub esp, 0x2a8
mov eax, dword [0x10079040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov dword [ebp - 0x274], ecx
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
movlpd qword [ebp - 0x230], xmm0
push 0x40
mov dword [ebp - 0x278], eax
mov dword [ebp - 0x258], 0x104
mov dword [ebp - 0x254], 0x104
mov dword [ebp - 0x230], 0
mov dword [ebp - 0x22c], 0
call fcn.100334a0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x230], eax
xor esi, esi
mov dword [ebp - 4], 0
test edi, edi
je 0x1002f3c5
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x254]
mov dword [ebp - 0x258], 0x104
push eax
lea eax, [ebp - 0x228]
mov byte [ebp - 0x120], 0
push eax
push 0
push 0
lea eax, [ebp - 0x258]
mov dword [ebp - 0x254], 0x104
push eax
lea eax, [ebp - 0x120]
mov byte [ebp - 0x228], 0
push eax
push esi
push dword [ebp - 0x274]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1002f3bc
mov dword [ebp - 0x260], eax
xorps xmm0, xmm0
mov dword [ebp - 0x25c], eax
lea eax, [ebp - 0x120]
movups xmmword [ebp - 0x270], xmm0
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002f286
sub eax, edx
lea ecx, [ebp - 0x270]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.10006da0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x228]
xorps xmm0, xmm0
mov dword [ebp - 0x238], 0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x234], 0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f2d0
sub ecx, edx
lea eax, [ebp - 0x228]
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.10006da0
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x2b4]
call fcn.10013570
lea eax, [ebp - 0x248]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x29c]
call fcn.10013570
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x284]
push eax
lea ecx, [ebp - 0x230]
call fcn.100312b0
lea ecx, [ebp - 0x2b4]
call fcn.1002d440
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x234]
cmp ecx, 0xf
jbe 0x1002f37e
mov edx, dword [ebp - 0x248]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f374
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002f5e3
push ecx
push edx
call fcn.100337ea
add esp, 8
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x25c]
cmp ecx, 0xf
jbe 0x1002f3bc
mov edx, dword [ebp - 0x270]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f3b2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002f5e3
push ecx
push edx
call fcn.100337ea
add esp, 8
inc esi
cmp esi, edi
jb 0x1002f210
mov esi, dword [ebp - 0x278]
xorps xmm0, xmm0
mov ecx, esi
mov dword [ebp - 0x260], 0
movups xmmword [ebp - 0x270], xmm0
mov dword [ebp - 0x25c], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1002f3f0
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x270]
call fcn.10006da0
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x250]
call fcn.10013570
mov byte [ebp - 4], 6
lea eax, [ebp - 0x238]
push 0x40
mov dword [ebp - 0x238], 0
mov dword [ebp - 0x234], 0
mov dword [ebp - 0x27c], eax
mov dword [ebp - 0x278], eax
call fcn.100334a0
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [ebp - 0x238], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x230]
push dword [eax + 4]
call fcn.10031700
mov ecx, dword [ebp - 0x238]
mov dword [ecx + 4], eax
mov esi, dword [ebp - 0x238]
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x234], eax
mov edx, dword [esi + 4]
cmp byte [edx + 0xd], 0
jne 0x1002f4e0
mov ecx, dword [edx]
cmp byte [ecx + 0xd], 0
jne 0x1002f4bc
nop dword [eax]
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x1002f4b0
mov dword [esi], edx
mov edx, dword [ebp - 0x238]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
jne 0x1002f4db
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
je 0x1002f4d0
mov dword [edx + 8], ecx
jmp 0x1002f4eb
mov dword [esi], esi
mov eax, dword [ebp - 0x238]
mov dword [eax + 8], eax
lea eax, [ebp - 0x250]
mov byte [ebp - 4], 8
push eax
lea eax, [ebp - 0x284]
push eax
call fcn.10031440
mov eax, dword [ebp - 0x238]
push dword [eax + 4]
lea eax, [ebp - 0x238]
push eax
mov ecx, eax
call fcn.10030f00
push 0x40
push dword [ebp - 0x238]
call fcn.100337ea
mov ecx, dword [ebp - 0x23c]
add esp, 8
cmp ecx, 0xf
jbe 0x1002f563
mov edx, dword [ebp - 0x250]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f559
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002f5de
push ecx
push edx
call fcn.100337ea
add esp, 8
mov ecx, dword [ebp - 0x25c]
cmp ecx, 0xf
jbe 0x1002f599
mov edx, dword [ebp - 0x270]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1002f58f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1002f5e3
push ecx
push edx
call fcn.100337ea
add esp, 8
mov eax, dword [ebp - 0x230]
push dword [eax + 4]
lea eax, [ebp - 0x230]
push eax
mov ecx, eax
call fcn.10030f00
push 0x40
push dword [ebp - 0x230]
call fcn.100337ea
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10033290
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.1004280a
call fcn.1004280a
int3