Function at 0x1020759
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor ebx, ebx
xor esi, esi
push edi
inc esi
xor edi, edi
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esi
jne 0x1020789
mov eax, 0x80004003
jmp 0x1020a25
cmp dword [ebp + 8], ebx
je 0x10207e5
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcslen]
lea esi, [eax + eax + 1]
push esi
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
cmp edi, ebx
pop ecx
pop ecx
mov dword [ebp - 4], 0x80004005
je 0x102087f
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push edi
call fcn.01018b35
test eax, eax
je 0x10207d1
push edi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
call fcn.01017eb2
cmp edi, ebx
je 0x102087f
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x102087f
lea eax, [ebp - 8]
push eax
push esi
push ebx
push 0x1001750
push 0x80000002
call fcn.0101c02d
test eax, eax
jne 0x1020830
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x1004004
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1020823
cmp dword [ebp - 0x10], esi
jne 0x1020823
mov edi, esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
jne 0x1020888
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x277e
push dword [0x1048bd0]
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x1020888
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, ebx
jne 0x102085c
push 0x57
pop eax
cmp eax, ebx
jg 0x1020869
call esi
cmp eax, ebx
jne 0x102087c
push 0x57
pop eax
jmp 0x102087c
call esi
cmp eax, ebx
jne 0x1020872
push 0x57
pop eax
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jl 0x1020a10
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.msvcrt.dll_strstr]
push 0x1003ffc
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10208c3
push 0x1003ff4
push edi
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10208c3
push 0x2f
push edi
call fcn.010252c8
push 0x1003774
push dword [ebp + 0x10]
push edi
call fcn.01011aeb
mov edi, 0x1003ff0
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
pop ecx
pop ecx
jne 0x10208e0
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10208e6
sub eax, ecx
mov ecx, dword [ebp + 0x10]
sub ecx, eax
push ecx
mov dword [ebp - 0xc], ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
test ebx, ebx
pop ecx
je 0x1020a22
mov eax, dword [ebp - 0xc]
and dword [ebp - 0x14], 0
push eax
push ebx
push 0x277f
push dword [0x1048bd0]
mov dword [ebp + 8], eax
call dword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
mov esi, 0x1003fec
je 0x102095c
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
mov eax, ebx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x102094b
sub eax, edi
or ecx, 0xffffffff
sub ecx, eax
add dword [ebp + 8], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
push eax
push 1
push 0
push 0x1003798
push 0x80000002
call fcn.0101c02d
test eax, eax
mov edi, 0x1003fe0
jne 0x10209df
lea eax, [ebp - 0xc]
push eax
push ebx
lea eax, [ebp - 0x10]
push eax
push 0
push 0x1003fd4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10209d0
cmp dword [ebp - 0x10], 1
jne 0x10209d0
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
mov dword [ebp - 0x14], 1
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0
jne 0x1020a07
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
push 0x10018e0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.01011aeb
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1020a22
push dword [ebp - 4]
push 0x1003f90
push 2
call fcn.0102ae85
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0xc