Function at 0x100095a9
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov edi, eax
mov eax, dword [ebp + 0x10]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100095ba
mov edx, dword [ebp + 0x14]
sub eax, ecx
xor ecx, ecx
cmp ecx, eax
sbb ebx, ebx
mov ecx, 0x20000
lea eax, [ebp - 0x34]
neg ebx
call fcn.10006ce4
mov esi, 0x10000
mov edx, eax
call fcn.10006d4a
mov dword [ebp - 8], eax
call fcn.10006d4a
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x20]
push eax
or edi, 0x20019
push edi
xor esi, esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
je 0x1000961f
push eax
push 0x3f
call fcn.10001988
pop ecx
pop ecx
jmp 0x10009797
mov dword [ebp - 0xc], esi
mov edi, 0x4000
push edi
push esi
push dword [ebp - 8]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], 0x10000
call fcn.1001bf50
add esp, 0xc
push dword [ebp - 0x18]
push esi
push dword [ebp - 0x10]
call fcn.1001bf50
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, 0xea
je 0x100096e4
cmp eax, esi
jne 0x10009749
cmp ebx, esi
je 0x100096ac
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp - 8]
mov cl, byte [eax]
cmp cl, byte [esi]
jne 0x100096a3
test cl, cl
je 0x1000969f
mov cl, byte [eax + 1]
cmp cl, byte [esi + 1]
jne 0x100096a3
inc eax
inc eax
inc esi
inc esi
test cl, cl
jne 0x10009685
xor eax, eax
jmp 0x100096a8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100096e4
push dword [ebp - 8]
mov esi, dword [ebp + 0x18]
push str.__24s
call fcn.10001671
mov eax, dword [ebp - 0x24]
pop ecx
pop ecx
test eax, eax
jbe 0x100096d9
cmp eax, 2
jbe 0x1000973f
cmp eax, 3
je 0x10009700
cmp eax, 4
je 0x100096ee
cmp eax, 7
je 0x1000973f
push 0x1002c6fc
call fcn.10001671
pop ecx
inc dword [ebp - 0xc]
xor esi, esi
jmp 0x10009627
mov eax, dword [ebp - 0x10]
push dword [eax]
push 0x1002c7a4
call fcn.10001671
pop ecx
jmp 0x100096e3
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x18], 0
jbe 0x100096d9
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
movsx eax, byte [ecx + eax]
and eax, 0xff
push eax
cmp eax, 0xf
ja 0x10009726
push 0x1002c7a8
jmp 0x1000972b
push 0x1002c7ac
call fcn.10001671
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
pop ecx
pop ecx
cmp eax, dword [ebp - 0x18]
jb 0x1000970a
jmp 0x100096d9
push dword [ebp - 0x10]
push 0x1002c550
jmp 0x100096f8
mov dword [ebp - 0xc], esi
cmp ebx, esi
jne 0x1000978e
push edi
push 0
push dword [ebp - 8]
mov dword [ebp - 0x1c], edi
call fcn.1001bf50
add esp, 0xc
push dword [ebp - 0x1c]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x1000978e
push dword [ebp - 8]
mov esi, dword [ebp + 0x18]
push str._s_n
call fcn.10001671
inc dword [ebp - 0xc]
pop ecx
pop ecx
jmp 0x10009750
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret