Function at 0x100dbb0
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x1029018]
push esi
xor esi, esi
cmp eax, esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], esi
je 0x100dbf8
test byte [eax + 0x1c], 0x20
je 0x100dbf8
cmp byte [eax + 0x19], 3
jb 0x100dbf8
push 0x1002328
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01006234
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push esi
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
cmp edi, esi
jne 0x100dd5a
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
add eax, eax
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
jne 0x100dc37
push 8
pop edi
jmp 0x100dd64
mov eax, dword [ebp - 4]
push esi
push esi
push esi
push esi
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc dword [ebp - 8]
mov edi, eax
cmp edi, esi
jne 0x100dd53
mov eax, dword [0x1029018]
cmp eax, esi
je 0x100dc8a
test byte [eax + 0x1c], 0x20
je 0x100dc8a
cmp byte [eax + 0x19], 3
jb 0x100dc8a
push ebx
push dword [ebp - 8]
push 0x1002328
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100b3c0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp edi, esi
jne 0x100dd53
mov ecx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
push ebx
push dword [ebp + 8]
call fcn.0100d6fd
mov edi, eax
cmp edi, esi
jne 0x100dce8
mov ecx, dword [ebp - 0xc]
mov eax, dword [ecx]
push esi
push esi
push esi
call dword [eax + 0x10]
mov edi, eax
mov eax, dword [ebp - 0xc]
add eax, 0x88
push eax
call fcn.01015681
mov ecx, dword [ebp - 0xc]
call fcn.01005a65
cmp edi, esi
je 0x100dd08
cmp byte [0x1028b01], 1
je 0x100dd05
push edi
lea eax, [ebp - 0x2c]
push eax
push 1
push 0x800038c6
mov dword [ebp - 0x2c], ebx
call fcn.01015d3c
mov dword [ebp - 0x10], edi
mov eax, dword [0x1029018]
cmp eax, esi
je 0x100dd45
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor edx, edx
dec ecx
inc edx
and ecx, 0x1f
shl edx, cl
or edx, 0x20
test dword [eax + 0x1c], edx
je 0x100dd45
cmp byte [eax + 0x19], 3
jb 0x100dd45
push edi
push ebx
push 0x1002328
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010091b7
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100dc37
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp edi, 0x103
jne 0x100dd64
xor edi, edi
mov eax, dword [0x1029018]
cmp eax, esi
pop ebx
je 0x100dda4
mov ecx, edi
neg ecx
sbb ecx, ecx
and ecx, 0xc
xor edx, edx
dec ecx
inc edx
and ecx, 0x1f
shl edx, cl
or edx, 0x20
test dword [eax + 0x1c], edx
je 0x100dda4
cmp byte [eax + 0x19], 3
jb 0x100dda4
push dword [ebp - 0x10]
push edi
push 0x1002328
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100b411
cmp edi, esi
jne 0x100ddb0
cmp dword [ebp - 0x10], esi
je 0x100ddb0
mov edi, dword [ebp - 0x10]
mov eax, edi
pop edi
pop esi
leave
ret 8