Function at 0x1002bdf
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1a8
mov eax, dword [0x100913c]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x198]
push ecx
lea ecx, [ebp - 0x1a0]
push ecx
lea ecx, [ebp - 0x19c]
push ecx
xor ebx, ebx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push 0x100146c
push eax
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x198], 4
call esi
cmp eax, ebx
jne 0x1002ebe
cmp dword [ebp - 0x19c], 4
jne 0x1002e93
xor eax, eax
cmp dword [ebp - 0x1a0], ebx
mov dword [ebp - 0x198], 0x190
setne al
mov dword [edi + 0x318], eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x19c]
push eax
push ebx
push 0x1001454
push dword [ebp - 0x1a4]
call esi
cmp eax, 2
jne 0x1002c91
xor eax, eax
mov dword [ebp - 0x198], ebx
cmp eax, ebx
jne 0x1002ebe
cmp dword [ebp - 0x198], ebx
je 0x1002cf4
cmp dword [ebp - 0x19c], 1
jne 0x1002e93
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x40
mov dword [ebp - 0x198], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, ebx
mov dword [edi + 0x314], eax
jne 0x1002ce4
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002ebe
lea ecx, [ebp - 0x194]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp dword [edi + 0x318], ebx
je 0x1002dc9
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x19c]
push eax
push ebx
push 0x100141c
push dword [ebp - 0x1a4]
mov dword [ebp - 0x198], 4
call esi
cmp eax, 2
jne 0x1002d3d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x610]
jmp 0x1002d5d
cmp eax, ebx
jne 0x1002ebe
cmp dword [ebp - 0x19c], 4
jne 0x1002e93
xor eax, eax
cmp dword [ebp - 0x1a0], ebx
setne al
cmp dword [edi + 0x318], ebx
mov dword [edi + 0x31c], eax
je 0x1002dc9
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x19c]
push eax
push ebx
push 0x1001410
push dword [ebp - 0x1a4]
mov dword [ebp - 0x198], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x1002dc9
cmp eax, ebx
jne 0x1002ebe
cmp dword [ebp - 0x19c], 1
jne 0x1002e93
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [edi + 0x320], eax
push ebx
call dword [sym.imp.msvcrt.dll_time]
cmp dword [edi + 0x318], ebx
pop ecx
mov dword [ebp - 0x1a8], eax
je 0x1002ebc
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x19c]
push eax
push ebx
push 0x10013ec
push dword [ebp - 0x1a4]
mov dword [ebp - 0x198], 4
call esi
cmp eax, 2
je 0x1002e4c
cmp eax, ebx
jne 0x1002ebe
cmp dword [ebp - 0x19c], 4
jne 0x1002e93
mov eax, dword [ebp - 0x1a8]
cdq
mov ecx, eax
mov eax, dword [ebp - 0x1a0]
mov ebx, edx
cdq
sub ecx, eax
sbb ebx, edx
push ebx
push ecx
lea eax, [edi + 0x328]
push eax
call fcn.01002bae
xor ebx, ebx
cmp dword [edi + 0x318], ebx
je 0x1002ebc
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x19c]
push eax
push ebx
push 0x10013c4
push dword [ebp - 0x1a4]
mov dword [ebp - 0x198], 4
call esi
cmp eax, 2
je 0x1002ebc
cmp eax, ebx
jne 0x1002ebe
cmp dword [ebp - 0x19c], 4
je 0x1002e98
push 0xd
pop eax
jmp 0x1002ebe
mov eax, dword [ebp - 0x1a8]
cdq
mov ecx, eax
mov eax, dword [ebp - 0x1a0]
mov esi, edx
cdq
sub ecx, eax
sbb esi, edx
push esi
push ecx
add edi, 0x330
push edi
call fcn.01002bae
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100646d
leave
ret 0xc