Function at 0x1028ca5
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x444
mov eax, 0x104296d
call fcn.01001615
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x430], ebx
push ebx
lea edx, [ebp - 0x430]
push edx
push ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0101f205
mov esi, eax
cmp esi, ebx
jl 0x1028f70
mov dword [ebp - 0x444], ebx
mov eax, dword [ebp - 0x430]
mov ecx, dword [eax]
lea edx, [ebp - 0x444]
push edx
push eax
mov byte [ebp - 4], 1
call dword [ecx + 0x34]
mov esi, eax
cmp esi, ebx
jl 0x1028f5d
lea eax, [ebp - 0x424]
push eax
push 0x1028fa0
call fcn.01028575
mov esi, eax
cmp esi, ebx
jl 0x1028f53
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
push dword [ebp - 0x424]
mov dword [ebp - 0x42c], 0x104
mov dword [ebp - 0x440], ebx
call edi
cmp eax, ebx
mov dword [ebp - 0x428], eax
jne 0x1028f2a
inc dword [ebp - 0x440]
lea eax, [ebp - 0x434]
push eax
push 0xf003f
push ebx
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
mov dword [ebp - 0x42c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.0100b113
mov esi, eax
cmp esi, ebx
jl 0x1028eea
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x450]
push eax
push 0x10038e8
push ebx
push dword [ebp - 0x434]
mov dword [ebp - 0x450], 1
mov dword [ebp - 0x44c], 0x208
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
call fcn.0100b113
mov esi, eax
cmp esi, ebx
jl 0x1028eda
lea eax, [ebp - 0x218]
push eax
call fcn.01028bb5
test eax, eax
jne 0x1028eda
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x43c]
call fcn.01003bb9
mov esi, dword [ebp - 0x43c]
neg esi
sbb esi, esi
and esi, 0x7ff8fff2
add esi, 0x8007000e
js 0x1028eca
mov dword [ebp - 0x448], ebx
mov eax, dword [ebp - 0x444]
mov ecx, dword [eax]
lea edx, [ebp - 0x448]
push edx
push dword [ebp - 0x43c]
mov byte [ebp - 4], 3
push eax
call dword [ecx + 0x28]
mov esi, eax
cmp esi, 0x80040d02
jne 0x1028e5d
xor esi, esi
jmp 0x1028eb6
cmp esi, ebx
jl 0x1028eb6
mov dword [ebp - 0x438], ebx
mov eax, dword [ebp - 0x448]
mov ecx, dword [eax]
lea edx, [ebp - 0x438]
push edx
push 0x1028f90
push eax
mov byte [ebp - 4], 4
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x1028ea2
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x434]
push dword [ebp - 0x438]
call fcn.01027257
mov esi, eax
mov eax, dword [ebp - 0x438]
cmp eax, ebx
mov byte [ebp - 4], 3
je 0x1028eb6
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x448]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x1028eca
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x43c]
mov byte [ebp - 4], 1
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
push dword [ebp - 0x434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
jge 0x1028ef4
cmp esi, 0x80070002
jne 0x1028f22
xor esi, esi
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x440]
push dword [ebp - 0x424]
call edi
cmp eax, ebx
mov dword [ebp - 0x428], eax
je 0x1028d5f
cmp dword [ebp - 0x428], ebx
je 0x1028f47
cmp dword [ebp - 0x428], 0x103
jne 0x1028f3a
xor esi, esi
jmp 0x1028f47
push dword [ebp - 0x428]
call fcn.0100b113
mov esi, eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x80070002
jne 0x1028f5d
xor esi, esi
mov eax, dword [ebp - 0x444]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x1028f70
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x430]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x1028f84
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.01001652
ret 8