Function at 0x1022a10
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x290
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov esi, ecx
xor ecx, ecx
cmp dword [0x103a524], edi
lea edx, [ebp - 0x290]
sete cl
mov dword [ebp - 0x284], eax
push edx
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x290], 0x105
mov dword [ebp - 0x280], edi
mov dword [ebp - 0x28c], edi
mov dword [ebp - 0x268], edi
mov dword [ebp - 0x27c], ecx
call sub.instapi.dll_GetSQLRootRegPath
test eax, eax
je 0x1022be6
mov eax, dword [esi + 0x78]
test eax, eax
lea ecx, [esi + 0x7c]
mov dword [esi + 0x78], edi
push ebx
mov ebx, dword [ecx]
mov word [ebp - 8], di
mov dword [ecx], edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x274], ecx
je 0x1022aa1
push eax
call edi
test ebx, ebx
je 0x1022aa8
push ebx
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea edi, [esi + 0x78]
push edi
push 0x20019
push 0
lea edx, [ebp - 0x210]
push edx
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x288], edi
call ebx
cmp eax, 2
mov ecx, dword [0x103a524]
jne 0x1022c22
test ecx, ecx
je 0x1022c2a
mov dword [ebp - 0x268], 1
test ecx, ecx
je 0x1022b30
mov ecx, dword [ebp - 0x274]
push ecx
push 0x20119
push 0
lea edx, [ebp - 0x210]
push edx
push reloc.WS2_32.dll_bind
call ebx
mov ebx, eax
cmp ebx, 2
jne 0x1022c66
cmp dword [ebp - 0x268], 0
jne 0x1022c6e
mov dword [ebp - 0x27c], 1
mov ecx, dword [esi + 0x80]
push ecx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp dword [ebp - 0x268], 0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jne 0x1022b62
mov eax, dword [esi + 0x80]
mov ecx, dword [edi]
push 1
push eax
push 4
push 0
push ecx
call ebx
test eax, eax
jne 0x1022bbd
cmp dword [ebp - 0x27c], 0
jne 0x1022cd8
mov esi, dword [esi + 0x80]
mov edx, dword [ebp - 0x274]
mov eax, dword [edx]
push 1
push esi
push 4
push 0
push eax
call ebx
test eax, eax
je 0x1022cd8
test byte [0x103a4fc], 2
je 0x1022bbd
mov ecx, dword [0x103b324]
test ecx, ecx
je 0x1022bbd
mov edx, dword [0x103b324]
push eax
mov eax, dword [0x103b12c]
push edx
push 0x223000
push eax
call fcn.01024ec0
add esp, 0x10
push 0xc04e0006
call fcn.0101f4c0
push 0
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [ebp - 0x284]
push ecx
push 4
push 0xc04e0001
mov dword [ebp - 0x284], eax
call fcn.010240e0
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4
test eax, eax
je 0x1022aee
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x210]
push eax
push 0x20a
push 0xc04e0001
call fcn.010240e0
push 0
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4
test ebx, ebx
je 0x1022b30
test byte [0x103a4fc], 2
je 0x1022c9c
mov eax, dword [0x103b320]
test eax, eax
je 0x1022c9c
mov ecx, dword [0x103b320]
mov edx, dword [0x103b128]
push ebx
push ecx
push 0x21a400
push edx
call fcn.01024ec0
add esp, 0x10
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x210]
push eax
push 0x20a
push 0xc04e0001
call fcn.010240e0
push 0
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x268], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 7
jne 0x1022d5a
mov eax, dword [edi]
lea ecx, [ebp - 0x280]
push ecx
push 0
lea edx, [ebp - 0x270]
push edx
push 0
push 0x101abe0
push eax
mov dword [ebp - 0x270], 0
call esi
test eax, eax
je 0x1022d1d
cmp eax, 0xea
jne 0x1022d34
cmp dword [ebp - 0x270], ebx
jne 0x1022da2
mov ecx, dword [ebp - 0x280]
add ecx, 4
mov dword [ebp - 0x280], ecx
cmp eax, 2
jne 0x1022d52
cmp dword [0x103a524], 0
je 0x1022bc7
mov dword [ebp - 0x268], 1
jmp 0x1022d5a
test eax, eax
jne 0x1022bc7
cmp dword [ebp - 0x27c], 0
jne 0x1022dda
mov eax, dword [ebp - 0x274]
mov eax, dword [eax]
lea ecx, [ebp - 0x28c]
push ecx
push 0
lea edx, [ebp - 0x278]
push edx
push 0
push 0x101abe0
push eax
mov dword [ebp - 0x278], 0
call esi
test eax, eax
je 0x1022d9a
cmp eax, 0xea
jne 0x1022dc1
cmp dword [ebp - 0x278], ebx
je 0x1022db2
push 0x70c
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1022bc7
mov ecx, dword [ebp - 0x28c]
add ecx, 4
mov dword [ebp - 0x28c], ecx
cmp eax, 2
jne 0x1022dd2
mov dword [ebp - 0x27c], 1
jmp 0x1022dda
test eax, eax
jne 0x1022bc7
mov ecx, dword [ebp - 0x280]
mov eax, dword [ebp - 0x28c]
lea eax, [eax + ecx + 4]
mov dword [ebp - 0x270], eax
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
add esp, 4
test edi, edi
mov dword [ebp - 0x278], edi
jne 0x1022e49
push eax
push eax
push 0xc04e0004
call fcn.010240e0
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x268], 0
jne 0x1022f0b
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x288]
mov ecx, dword [ecx]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, 2
cmp eax, esi
mov dword [ebp - 0x26c], eax
jb 0x1022f52
add eax, 0xfffffffe
cmp eax, esi
mov dword [ebp - 0x26c], eax
jb 0x1022f52
sub eax, esi
lea edx, [ebp - 0x26c]
push edx
push edi
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0x288]
push eax
push 0
push 0x101abe0
push ecx
mov dword [ebp - 0x288], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1022ec8
cmp eax, 0xea
jne 0x1022f01
cmp dword [ebp - 0x288], 7
jne 0x1022fb5
test eax, eax
jne 0x1022ee5
mov ecx, dword [ebp - 0x26c]
shr ecx, 1
mov word [edi + ecx*2], ax
add dword [ebp - 0x26c], esi
test eax, eax
jne 0x1022efb
mov edx, dword [ebp - 0x26c]
shr edx, 1
mov word [edi + edx*2], ax
add dword [ebp - 0x26c], esi
test eax, eax
mov esi, eax
jne 0x1023002
cmp dword [ebp - 0x27c], 0
jne 0x1023034
mov ecx, dword [ebp - 0x280]
cmp ecx, 6
ja 0x1022f27
xor ecx, ecx
jmp 0x1022f2a
add ecx, 0xfffffffa
mov eax, dword [ebp - 0x270]
mov edx, dword [ebp - 0x274]
mov edx, dword [edx]
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
sub eax, ecx
lea esi, [ecx + edi]
test esi, esi
mov dword [ebp - 0x268], eax
je 0x1022f7a
cmp eax, 2
jae 0x1022f63
push 0xea
call ebx
mov esi, 0xea
jmp 0x1023002
sub eax, 2
cmp eax, 2
mov dword [ebp - 0x268], eax
jb 0x1022f52
sub eax, 2
mov dword [ebp - 0x268], eax
lea eax, [ebp - 0x268]
push eax
push esi
lea ecx, [ebp - 0x274]
push ecx
push 0
push 0x101abe0
push edx
mov dword [ebp - 0x274], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1022fac
cmp eax, 0xea
jne 0x1022ffc
cmp dword [ebp - 0x274], 7
je 0x1022fc3
push 0x70c
call ebx
mov esi, 0x70c
jmp 0x1023002
test esi, esi
je 0x1022fd7
test eax, eax
jne 0x1022fd7
mov edx, dword [ebp - 0x268]
shr edx, 1
mov word [esi + edx*2], ax
mov ecx, 2
add dword [ebp - 0x268], ecx
test esi, esi
je 0x1022ff6
test eax, eax
jne 0x1022ff6
mov edx, dword [ebp - 0x268]
shr edx, 1
mov word [esi + edx*2], ax
add dword [ebp - 0x268], ecx
test eax, eax
mov esi, eax
je 0x1023034
push 0x101abe0
push 0x26
push 0xc04e0001
call fcn.010240e0
push esi
call ebx
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x264]
push eax
push 0
push 0x101ac08
call sub.instapi.dll_GetSvcInstanceIDFromName
test eax, eax
je 0x1023152
cmp word [edi], 0
mov esi, edi
je 0x102309d
lea ecx, [ebp - 0x264]
push ecx
push 0
push esi
call sub.instapi.dll_GetSvcInstanceIDFromName
test eax, eax
je 0x102307e
lea edx, [ebp - 0x264]
push edx
call sub.instapi.dll_IsDefaultInstanceID
test eax, eax
jne 0x1023152
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1023083
sub eax, edx
sar eax, 1
cmp word [esi + eax*2 + 2], cx
lea esi, [esi + eax*2 + 2]
jne 0x1023057
mov eax, dword [ebp - 0x270]
add eax, 0x1a
xor ecx, ecx
shr eax, 1
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR80.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10230ff
push eax
push eax
push 0xc04e0004
call fcn.010240e0
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
push ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 8
pop ebx
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0x270], 4
mov ecx, 6
mov esi, 0x101ac08
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
jbe 0x1023132
mov eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x278]
push eax
push ecx
lea edx, [ebx + 0x18]
push edx
call sub.MSVCR80.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x284]
push 0
mov dword [eax], ebx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
mov ecx, dword [ebp - 0x278]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 8
jmp 0x1023164
mov edx, dword [ebp - 0x284]
push 0
mov dword [edx], edi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.01029f27
mov esp, ebp
pop ebp
ret 4