Function at 0x10028c7
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov esi, eax
mov dword [ebp - 0x14], esi
cmp esi, ebx
je 0x1002939
push ebx
push 0x104
mov edi, 0x10063e0
push edi
push ebx
push esi
push ebx
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push edi
push esi
push 0x1001568
push 1
call fcn.010040f7
add esp, 0x10
jmp 0x1002c8c
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.msvcrt.dll_malloc]
inc dword [ebp - 0x20]
shl eax, 2
push eax
call esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
shl eax, 2
push eax
call esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
shl eax, 2
push eax
call esi
mov edx, eax
mov eax, dword [ebp - 8]
shl eax, 2
add esp, 0xc
mov dword [ebp - 0x1c], edx
mov ecx, edx
cmp eax, ebx
je 0x100297d
mov byte [ecx], bl
inc ecx
dec eax
jne 0x1002977
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
shl eax, 2
cmp eax, ebx
je 0x1002990
mov byte [ecx], bl
inc ecx
dec eax
jne 0x100298a
mov edi, dword [ebp - 8]
mov dword [ebp - 0xc], ebx
cmp edi, ebx
jbe 0x1002b40
mov eax, dword [ebp - 0x10]
sub eax, edx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x18]
sub eax, edx
mov ebx, edx
mov dword [ebp - 0x30], eax
jmp 0x10029b8
mov esi, dword [sym.imp.msvcrt.dll_malloc]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
add eax, ebx
mov dword [eax], ecx
push dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
call esi
mov dword [ebx], eax
mov eax, dword [ebp - 0x34]
push dword [ebp - 0x20]
lea edi, [eax + ebx]
call esi
mov esi, dword [ebp - 0x14]
pop ecx
pop ecx
mov dword [edi], eax
mov eax, dword [ebp - 0x20]
push esi
mov dword [ebp - 0x28], eax
push dword [ebx]
lea eax, [ebp - 0x2c]
push eax
push 0
lea eax, [ebp - 0x28]
push eax
push dword [edi]
push dword [ebp - 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], eax
jne 0x1002b79
cmp dword [ebp - 0x2c], 1
jne 0x1002bb4
push dword [ebx]
push dword [edi]
push 0x100153c
push eax
call fcn.010040f7
push dword [ebx]
push 0x1001518
push 0
call fcn.010040f7
mov eax, dword [esi]
mov ecx, dword [ebx]
add esp, 0x1c
push eax
push ecx
dec eax
push eax
push ecx
call fcn.0100269a
test al, al
jne 0x1002a4e
and dword [esi], 0
jmp 0x1002a5f
mov eax, dword [ebx]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1002a53
sub eax, edx
inc eax
mov dword [esi], eax
mov eax, dword [ebp - 0xc]
jmp 0x1002aa1
mov edx, dword [ebp - 0x10]
mov edx, dword [edx + eax*4]
mov ecx, dword [edi]
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
mov dl, byte [edx]
cmp dl, byte [ecx]
jne 0x1002a98
test dl, dl
je 0x1002a94
mov edx, dword [ebp - 0x14]
mov dl, byte [edx + 1]
mov byte [ebp - 1], dl
cmp dl, byte [ecx + 1]
jne 0x1002a98
add dword [ebp - 0x14], 2
inc ecx
inc ecx
test dl, dl
jne 0x1002a6f
xor ecx, ecx
jmp 0x1002a9d
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
jle 0x1002aa7
dec eax
cmp eax, 0xffffffff
jne 0x1002a64
mov ecx, dword [ebx]
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x38], ecx
mov ecx, dword [edi]
mov dword [ebp - 0x40], ecx
mov ecx, dword [esi]
mov dword [ebp - 0x48], ecx
mov ecx, dword [ebp - 0xc]
sub ecx, eax
mov esi, eax
lea ecx, [ecx*4 - 4]
lea edi, [eax*4 + 8]
mov eax, dword [ebp - 0x1c]
shl esi, 2
lea edx, [esi + edx + 4]
push ecx
push edx
add eax, edi
push eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x3c], edx
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 0x10]
push dword [ebp - 0x14]
lea ecx, [esi + eax + 4]
push ecx
add eax, edi
push eax
mov dword [ebp - 0x44], ecx
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 0x18]
push dword [ebp - 0x14]
lea esi, [esi + eax + 4]
add edi, eax
push esi
push edi
call dword [sym.imp.msvcrt.dll_memmove]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
mov dword [ecx], eax
mov eax, dword [ebp - 0x48]
add esp, 0x24
inc dword [ebp - 0xc]
mov dword [esi], eax
mov edi, dword [ebp - 8]
add ebx, 4
cmp dword [ebp - 0xc], edi
jb 0x10029b2
xor ebx, ebx
xor eax, eax
xor ecx, ecx
cmp edi, ebx
jbe 0x1002b53
mov edx, dword [ebp - 0x18]
add eax, dword [edx + ecx*4]
inc ecx
cmp ecx, edi
jb 0x1002b48
mov esi, dword [ebp + 0x10]
inc eax
cmp eax, dword [esi]
jbe 0x1002bd5
push eax
push eax
push 0x10014d0
push ebx
mov dword [esi], eax
mov dword [ebp - 0x14], 0xea
call fcn.010040f7
add esp, 0x10
jmp 0x1002c2f
push eax
push 0x104
mov edi, 0x10063e0
push edi
push eax
push dword [ebp - 0x14]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
inc eax
push eax
push edi
push dword [ebp - 0x14]
push 0x1001480
push 1
call fcn.010040f7
add esp, 0x18
xor ebx, ebx
jmp 0x1002c2f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
push dword [eax + ecx*4]
mov dword [ebp - 0x14], 0x65d
push 0x100145c
push 1
call fcn.010040f7
add esp, 0xc
jmp 0x1002bb0
mov dword [esi], ebx
mov dword [ebp - 0xc], ebx
cmp edi, ebx
jbe 0x1002c21
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
sub ebx, edi
cmp dword [edi], 0
je 0x1002c11
push dword [ebx + edi]
push 0x1001430
push 0
call fcn.010040f7
push dword [edi]
mov eax, dword [esi]
push dword [ebx + edi]
add eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [edi]
add esp, 0x18
add dword [esi], eax
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
add edi, 4
cmp eax, dword [ebp - 8]
jb 0x1002be6
xor ebx, ebx
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + eax], 0
inc dword [esi]
mov dword [ebp - 0x14], ebx
mov esi, dword [sym.imp.msvcrt.dll_free]
cmp dword [ebp - 0x18], ebx
je 0x1002c40
push dword [ebp - 0x18]
call esi
pop ecx
cmp dword [ebp - 0x1c], ebx
je 0x1002c66
xor edi, edi
cmp dword [ebp - 8], ebx
jbe 0x1002c60
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + edi*4]
cmp eax, ebx
je 0x1002c5a
push eax
call esi
pop ecx
inc edi
cmp edi, dword [ebp - 8]
jb 0x1002c4c
push dword [ebp - 0x1c]
call esi
pop ecx
cmp dword [ebp - 0x10], ebx
je 0x1002c8c
xor edi, edi
cmp dword [ebp - 8], ebx
jbe 0x1002c86
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + edi*4]
cmp eax, ebx
je 0x1002c80
push eax
call esi
pop ecx
inc edi
cmp edi, dword [ebp - 8]
jb 0x1002c72
push dword [ebp - 0x10]
call esi
pop ecx
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret 0xc