Function at 0x102df14
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x640
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
cmp eax, edi
mov dword [ebp - 0x640], eax
mov dword [ebp - 0x62c], edi
mov dword [ebp - 0x634], edi
mov dword [ebp - 0x63c], edi
jne 0x102df55
mov eax, 0x80004005
jmp 0x102e1ef
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
mov dword [ebp - 0x630], edi
mov esi, 0x105
cmp dword [ebp - 0x630], edi
lea eax, [ebp - 0x418]
je 0x102df7d
push 0x10060ac
jmp 0x102df82
push 0x1006060
push 0x103
push eax
call fcn.01028a67
lea eax, [ebp - 0x62c]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x418]
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x102e1d4
push esi
lea eax, [ebp - 0x210]
push eax
push edi
push dword [ebp - 0x62c]
mov dword [ebp - 0x624], esi
mov dword [ebp - 0x638], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x102e1c8
inc dword [ebp - 0x638]
lea eax, [ebp - 0x210]
push eax
push 0x1006050
lea eax, [ebp - 0x418]
push 0x103
mov edi, 0x20a
push eax
mov dword [ebp - 0x624], edi
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x634]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x62c]
call ebx
test eax, eax
jne 0x102e19e
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0x100602c
push dword [ebp - 0x634]
mov dword [ebp - 0x628], 1
mov dword [ebp - 0x624], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x102e076
cmp dword [ebp - 0x628], 1
je 0x102e0df
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0x1006008
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test edi, edi
jne 0x102e13b
cmp dword [ebp - 0x628], 1
jne 0x102e208
lea eax, [ebp - 0x210]
push eax
call fcn.01032458
cmp dword [ebp - 0x630], edi
lea eax, [ebp - 0x210]
jne 0x102e1fe
push 0x1005fe8
push esi
push eax
call fcn.01028adc
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x628]
push eax
push 0
push 0x1005fc8
push dword [ebp - 0x634]
mov dword [ebp - 0x624], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102e11e
cmp dword [ebp - 0x628], 1
je 0x102e13b
push 0x103
push 0x1005fbc
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x620]
push eax
call fcn.01030b32
push dword [ebp - 0x634]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x102e19e
lea eax, [ebp - 0x210]
push eax
call fcn.01033ed9
test eax, eax
je 0x102e19e
push esi
lea eax, [ebp - 0x210]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [ebp - 0x210]
push eax
call fcn.01032458
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x640]
call fcn.0102dbbf
mov ecx, 0xd2af9
cmp eax, ecx
jne 0x102e19e
mov dword [ebp - 0x63c], ecx
push esi
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x638]
mov dword [ebp - 0x624], esi
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
je 0x102dfd9
xor edi, edi
push dword [ebp - 0x62c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x630]
cmp dword [ebp - 0x630], 2
jl 0x102df68
mov eax, dword [ebp - 0x63c]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01031a01
leave
ret 4
push 0x1005fac
jmp 0x102e0d8
push 0x1f
pop edi
jmp 0x102e13b