Function at 0x100a8fc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
lea eax, [ebp - 0x210]
push eax
mov esi, 0x20019
push esi
push ebx
push 0x1002270
push 0x80000002
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
call edi
test eax, eax
jne 0x100aba4
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 0x20
push 0x10022c8
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x20c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, ebx
jle 0x100a99d
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x208], eax
jl 0x100ab58
lea eax, [ebp - 0x214]
push eax
push esi
push ebx
push 0x10022dc
push dword [ebp - 0x210]
call edi
test eax, eax
jne 0x100ab1d
lea edi, [ebp - 0x204]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100a9d4
sub eax, edx
sar eax, 1
mov dword [ebp - 0x224], eax
je 0x100ab0f
mov ebx, 0x1001aa4
jmp 0x100a9fa
mov esi, 0x20019
mov ecx, dword [ebp - 0x220]
push 8
pop eax
cmp ax, word [ecx]
jbe 0x100ab0d
cmp dword [ebp - 0x20c], 0
jbe 0x100ab0d
cmp dword [0x1021270], 0
je 0x100ab0d
lea eax, [ebp - 0x218]
push eax
push esi
push 0
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100aa88
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x220]
push edi
call fcn.0100a701
mov esi, eax
test esi, esi
jge 0x100aa7a
mov eax, dword [section..data]
cmp eax, section..data
je 0x100aa7a
test byte [eax + 0x1c], 4
je 0x100aa7a
push esi
push ebx
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100aac0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100aa9c
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100aac0
test byte [eax + 0x1c], 4
je 0x100aac0
push esi
push edi
push ebx
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a53a
test esi, esi
jl 0x100aad7
cmp dword [ebp - 0x21c], 0
jne 0x100aad7
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x224]
add eax, eax
push 0xfffffffffffffffe
pop ecx
sub ecx, eax
add dword [ebp - 0x20c], ecx
lea edi, [edi + eax + 2]
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100aaf3
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x224], eax
jne 0x100a9f5
xor ebx, ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100ab82
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100ab31
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x208], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ab82
test byte [eax + 0x1c], 4
je 0x100ab82
push dword [ebp - 0x208]
push 0x1001aa4
push 0x15
jmp 0x100ab77
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ab82
test byte [eax + 0x1c], 4
je 0x100ab82
push dword [ebp - 0x208]
push 0x1001aa4
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x208], ebx
jge 0x100aba4
cmp dword [ebp - 0x21c], ebx
je 0x100aba4
mov dword [ebp - 0x208], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a181
leave
ret