Function at 0x1015811
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x103db7c
call fcn.0103c428
sub esp, 0x434
mov eax, dword [0x10490cc]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x420], esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x420]
push eax
push 1
push esi
push 0x1002e54
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1015a64
mov dword [ebp - 0x41c], 0x400
mov dword [ebp - 0x418], esi
mov ecx, 0xff
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x10028a0
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push esi
push 0x1002e44
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1015903
mov eax, dword [ebp - 0x41c]
shr eax, 1
mov word [ebp + eax*2 - 0x418], si
push 0x1002e40
lea eax, [ebp - 0x418]
push eax
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x10158e8
mov dword [ebx], 1
jmp 0x1015903
push 0x1002e3c
lea eax, [ebp - 0x418]
push eax
call edi
pop ecx
pop ecx
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
mov dword [ebx], eax
mov dword [ebp - 0x424], esi
lea eax, [ebp - 0x41c]
push eax
push esi
push esi
push esi
push 0x1002e18
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10159fd
mov eax, dword [ebp - 0x41c]
lea eax, [eax + eax + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
mov dword [ebp - 0x440], edi
mov dword [ebp - 0x424], edi
cmp edi, esi
je 0x10159fd
lea eax, [ebp - 0x41c]
push eax
push edi
push esi
push esi
push 0x1002e18
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10159ea
mov eax, dword [ebp - 0x41c]
shr eax, 1
mov word [edi + eax*2], si
mov eax, dword [ebx + 4]
cmp eax, esi
je 0x1015995
mov dword [ebp - 0x42c], eax
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebx + 4], esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x434], eax
mov dword [ebx + 4], eax
push edi
cmp eax, esi
jne 0x10159e3
mov dword [ebp - 0x43c], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x428], 0xbbef
mov dword [esp], 0x1041aec
lea eax, [ebp - 0x428]
push eax
call sub.msvcrt.dll__CxxThrowException
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x430], edi
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0x424], esi
mov dword [ebp - 0x41c], 0x400
mov word [ebp - 0x418], si
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push esi
push esi
push 0x1002df4
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1015a58
mov eax, dword [ebp - 0x41c]
shr eax, 1
mov word [ebp + eax*2 - 0x418], si
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
cdq
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0103bfcf
pop edi
pop esi
pop ebx
leave
ret