Function at 0x10042840
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x100a80a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x90], eax
mov ebx, ecx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x8c], eax
mov esi, edx
lea eax, [ebp - 0x94]
mov dword [0x100aaf20], 7
push eax
push 0x10004068
push 0x80000002
mov dword [ebp - 0x94], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10042916
lea eax, [ebp - 0x88]
mov dword [ebp - 0x88], 4
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x9c]
push eax
push 0
push 0x1000a960
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1004290a
cmp dword [ebp - 0x9c], 4
jne 0x1004290a
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x1004290a
mov dword [0x100aaf20], eax
cmp eax, 7
jle 0x100428fb
mov dword [0x100aaf20], 7
jmp 0x1004290a
cmp eax, 6
jge 0x1004290a
mov dword [0x100aaf20], 6
push dword [ebp - 0x94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x100aaf20]
mov dword [esi], 0x10040f70
mov dword [esi + 4], 0x100411c0
mov dword [esi + 8], 0
lea ecx, [eax - 1]
mov dword [esi + 0xc], 0x10041250
mov dword [esi + 0x54], 0x10041840
mov dword [esi + 0x5c], 0x10041e00
mov dword [esi + 0x58], 0x10041d30
mov dword [esi + 0x60], 0x10042130
cmp ecx, 6
ja case.default.0x1004295e
jmp dword [ecx*4 + 0x10042e88]
mov dword [esi + 0x4c], 0x100415d0
mov dword [esi + 0x50], 0x100416f0
mov dword [esi + 0x44], 0x100413a0
mov dword [esi + 0x48], 0x10043060
mov dword [esi + 0x40], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x2c], 0x10041340
mov dword [esi + 0x10], 0
mov ecx, 0xe
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0x100413d0
mov dword [esi + 0x1c], 0x10041490
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0x10041580
mov esi, 0x100ab280
mov dword [0x100ab218], 0xc0
mov dword [0x100ab228], 0x551
mov dword [0x100ab2c8], 0x7e5
mov dword [0x100ab2cc], 0x1b
mov dword [0x100ab280], 0x38
mov dword [0x100ab284], 0x72
mov dword [0x100ab288], 0x3f29f1
mov dword [0x100ab28c], 0xff
mov dword [0x100ab290], 0x1fff
mov dword [0x100ab294], 0x7ff
mov dword [0x100ab298], 0xff
mov dword [0x100ab29c], 0xc528a
mov dword [0x100ab2a0], 0x1cdf
mov dword [0x100ab2a4], 0x703073f
mov dword [0x100ab2a8], 0xcf
mov dword [0x100ab2ac], 0x1f
mov dword [0x100ab2b0], 0
mov dword [0x100ab2b4], 0
push edi
mov edi, 0x100ab248
rep movsd dword es:[edi], dword [esi]
mov dword [0x100ab250], 0x1721f1
mov dword [0x100ab2b8], 0x700
mov dword [0x100ab2bc], 0x500
sub eax, 4
je 0x10042aca
sub eax, 1
jne 0x10042ad9
mov eax, 0x10551
jmp 0x10042acf
mov eax, dword [0x100ab228]
or eax, 0x8000
mov dword [0x100ab228], eax
mov ecx, dword [ebp - 0x8c]
call fcn.10042180
cmp dword [0x100aaf20], 7
mov ecx, dword [ebp - 0x90]
fld dword [0x1000b6ec]
mov dword [ecx], eax
fstp dword [0x100ab038]
fld dword [0x1000b718]
fst dword [0x100ab03c]
fstp dword [0x100ab040]
fld dword [0x1000b6e0]
fst dword [0x100ab044]
fstp dword [0x100ab048]
fldz
fstp dword [0x100ab04c]
fld dword [0x1000b6d4]
fstp dword [0x100ab078]
fld dword [0x1000b6f0]
fstp dword [0x100ab098]
mov dword [0x100aafe4], 0x6108550
mov dword [0x100aafe8], 0x3ef6
mov dword [0x100aafec], 0x772199
mov dword [0x100aaff0], 0xff
mov dword [0x100aaff4], 0x1fff
mov dword [0x100aaff8], 0x7ff
mov dword [0x100aaffc], 0xff
mov dword [0x100ab000], 0x84208
mov dword [0x100ab004], 0x7ecc5
mov dword [0x100ab008], 0x7030700
mov dword [0x100ab00c], 0x3030300
mov dword [0x100ab010], 0x3030300
mov dword [0x100ab014], 0x3f
mov dword [0x100ab018], 0x3f
mov dword [0x100ab01c], 0x1f
mov dword [0x100ab020], 0x1000
mov dword [0x100ab024], 0x1000
mov dword [0x100ab028], 0x1000
mov dword [0x100ab02c], 0x8000
mov dword [0x100ab030], 0
mov dword [0x100ab034], 0x10
mov dword [0x100ab050], 0xff
mov dword [0x100ab054], 0x100008
mov dword [0x100ab058], 0x3ffffff
mov dword [0x100ab05c], 8
mov dword [0x100ab060], 8
mov dword [0x100ab064], 0
mov dword [0x100ab068], 0
mov dword [0x100ab06c], 0
mov dword [0x100ab070], 0
mov dword [0x100ab074], 0
mov dword [0x100ab07c], 0x1fffff
mov dword [0x100ab080], 0xffffff
mov dword [0x100ab084], 1
mov dword [0x100ab088], 0x100
mov dword [0x100ab08c], 0xfffe0000
mov dword [0x100ab090], 0
mov dword [0x100ab094], 0xffff0104
mov dword [0x100aafd0], 0
mov dword [0x100aafd4], 0x30080000
mov dword [0x100aafd8], 0x20
jne 0x10042d43
mov dword [0x100aafe4], 0x7f18550
mov dword [0x100ab064], 0x7b
mov dword [0x100ab068], 0xffffffff
mov dword [0x100ab06c], 6
mov dword [0x100ab070], 4
mov dword [0x100ab074], 0xff
mov dword [0x100ab084], 0x10
mov dword [0x100ab08c], 0xfffe0101
mov dword [0x100ab090], 0x60
mov dword [0x100aafe8], 0x3ff6
lea eax, [ebp - 0x88]
mov dword [ebp - 0x90], 4
push eax
push 0x1000a96c
push 0x80000002
mov dword [ebp - 0x88], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10042dc0
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x98]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 0x1000a934
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x88]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10042dc0
cmp dword [ebp - 0x8c], 4
jne 0x10042dc0
mov eax, dword [ebp - 0x98]
mov dword [0x100ab094], eax
lea eax, [ebp - 0x88]
mov dword [ebp - 0x90], 0x80
push eax
push 0x1000a96c
push 0x80000002
mov dword [ebp - 0x88], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10042e4c
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 0x1000a948
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x88]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10042e4c
cmp dword [ebp - 0x8c], 1
jne 0x10042e4c
push 0x100ab098
lea eax, [ebp - 0x84]
push 0x1000a95c
push eax
call dword [sym.imp.msvcrt.dll_sscanf_s]
add esp, 0xc
mov edi, ebx
mov ecx, 0x35
mov esi, 0x100aafc8
xor eax, eax
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a1500
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, 0x80004005
pop esi
xor ecx, ebp
pop ebx
call fcn.100a1500
mov esp, ebp
pop ebp
ret 8