Function at 0x1002dc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push edi
lea eax, [ebp - 8]
push eax
push 0x20019
xor edi, edi
push edi
push 0x1001468
push 0x80000001
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
jne 0x100301f
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 4
pop ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push 0x1001440
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
cmp eax, edi
jne 0x1002feb
cmp dword [ebp - 0x14], edi
je 0x1002fd0
mov eax, dword [section..data]
mov edi, section..data
cmp eax, edi
je 0x1002e50
test byte [eax + 0x1c], 8
je 0x1002e50
push 0x1001250
push 0x2e
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010016d5
lea eax, [ebp - 4]
push eax
push 0x1006004
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1001420
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
mov eax, dword [section..data]
cmp eax, edi
je 0x1002e93
test byte [eax + 0x1c], 8
je 0x1002e93
push dword [0x1006004]
push 0x1001250
push 0x2f
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001915
lea eax, [ebp - 4]
push eax
push 0x100614c
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10013f4
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
mov eax, dword [section..data]
cmp eax, edi
je 0x1002ee4
test byte [eax + 0x1c], 8
je 0x1002ee4
cmp dword [0x100614c], 0
mov ecx, 0x10013e8
jne 0x1002ed1
mov ecx, 0x10013dc
push ecx
push 0x1001250
push 0x30
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100176e
lea eax, [ebp - 4]
push eax
push 0x100616c
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10013c8
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
mov eax, dword [section..data]
cmp eax, edi
je 0x1002f35
test byte [eax + 0x1c], 8
je 0x1002f35
cmp dword [0x100616c], 0
mov ecx, 0x10013e8
jne 0x1002f22
mov ecx, 0x10013dc
push ecx
push 0x1001250
push 0x31
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100176e
cmp dword [0x100616c], 0
je 0x1002f97
lea eax, [ebp - 4]
push eax
push 0x100604c
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10013a8
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call esi
test eax, eax
jne 0x1002f97
mov eax, 0x5a0
cmp dword [0x100604c], eax
jbe 0x1002f70
mov dword [0x100604c], eax
mov eax, dword [section..data]
cmp eax, edi
je 0x1002f97
test byte [eax + 0x1c], 8
je 0x1002f97
push dword [0x100604c]
push 0x1001250
push 0x32
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01001915
push dword [ebp - 8]
call fcn.01001e1e
mov dword [ebp - 0x10], eax
test eax, eax
je 0x1002fad
call fcn.01002d98
jmp 0x1003012
mov eax, dword [section..data]
cmp eax, edi
je 0x1003012
test byte [eax + 0x1c], 2
je 0x1003012
push 0x1001250
push 0x33
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010016d5
jmp 0x1003012
mov eax, dword [section..data]
cmp eax, section..data
je 0x1003012
test byte [eax + 0x1c], 8
je 0x1003012
push 0x1001250
push 0x34
jmp 0x1002fc3
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1003012
test byte [ecx + 0x1c], 2
je 0x1003012
push eax
push 0x1001250
push 0x35
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001915
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
jmp 0x1003046
mov ecx, dword [section..data]
cmp ecx, section..data
je 0x1003046
test byte [ecx + 0x1c], 2
je 0x1003046
push eax
push 0x1001250
push 0x36
push dword [ecx + 0x14]
push dword [ecx + 0x10]
call fcn.01001915
mov eax, dword [ebp - 0x10]
pop edi
leave
ret