Function at 0x10029cd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x19c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
xor edi, edi
push edi
push 0x100143c
push dword [ebp + 0x10]
mov dword [ebp - 4], ebx
call esi
cmp eax, edi
jne 0x1002c19
cmp dword [ebp - 8], ebx
jne 0x1002bf4
mov ebx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp - 0xc], edi
mov dword [ebp - 4], 0x190
setne al
mov dword [ebx + 0x318], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x1001424
push dword [ebp + 0x10]
call esi
cmp eax, 2
jne 0x1002a4b
xor eax, eax
mov dword [ebp - 4], edi
cmp eax, edi
jne 0x1002c19
cmp dword [ebp - 4], edi
je 0x1002aa5
cmp dword [ebp - 8], 1
jne 0x1002bf4
lea eax, [ebp - 0x19c]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x40
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebx + 0x314], eax
jne 0x1002a95
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1002c19
lea ecx, [ebp - 0x19c]
push ecx
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
cmp dword [ebx + 0x318], edi
je 0x1002b56
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x10013ec
push dword [ebp + 0x10]
mov dword [ebp - 4], 4
call esi
cmp eax, 2
jne 0x1002adf
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x610]
jmp 0x1002af9
cmp eax, edi
jne 0x1002c19
cmp dword [ebp - 8], 4
jne 0x1002bf4
xor eax, eax
cmp dword [ebp - 0xc], edi
setne al
cmp dword [ebx + 0x318], edi
mov dword [ebx + 0x31c], eax
je 0x1002b56
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x10013e0
push dword [ebp + 0x10]
mov dword [ebp - 4], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x1002b56
cmp eax, edi
jne 0x1002c19
cmp dword [ebp - 8], 1
jne 0x1002bf4
lea eax, [ebp - 0x19c]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [ebx + 0x320], eax
push edi
call dword [sym.imp.msvcrt.dll_time]
cmp dword [ebx + 0x318], edi
pop ecx
mov dword [ebp + 8], eax
je 0x1002c17
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x10013bc
push dword [ebp + 0x10]
mov dword [ebp - 4], 4
call esi
cmp eax, 2
je 0x1002bbf
cmp eax, edi
jne 0x1002c19
cmp dword [ebp - 8], 4
jne 0x1002bf4
mov eax, dword [ebp + 8]
cdq
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov ebx, edx
cdq
sub ecx, eax
sbb ebx, edx
push ebx
mov ebx, dword [ebp + 0xc]
push ecx
lea eax, [ebx + 0x328]
push eax
call fcn.010029a4
cmp dword [ebx + 0x318], edi
je 0x1002c17
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push edi
push 0x1001394
push dword [ebp + 0x10]
mov dword [ebp - 4], 4
call esi
cmp eax, 2
je 0x1002c17
cmp eax, edi
jne 0x1002c19
cmp dword [ebp - 8], 4
je 0x1002bf9
push 0xd
pop eax
jmp 0x1002c19
mov eax, dword [ebp + 8]
cdq
mov ecx, eax
mov eax, dword [ebp - 0xc]
mov esi, edx
cdq
sub ecx, eax
sbb esi, edx
push esi
push ecx
add ebx, 0x330
push ebx
call fcn.010029a4
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc