Function at 0x10002980
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x10027074]
xor eax, esp
mov dword [esp + 0x41c], eax
push ebp
mov ebp, dword [esp + 0x428]
push esi
mov esi, ecx
test esi, esi
je 0x10002ba6
test edi, edi
je 0x10002ba6
test ebx, ebx
je 0x10002ba6
test ebp, ebp
je 0x10002ba6
push 0x10022f88
push esi
call fcn.1000a5cc
add esp, 8
test eax, eax
je 0x10002ba6
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.10012ec0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x222]
push eax
mov word [esp + 0x224], dx
call fcn.10012ec0
add esp, 0xc
push esi
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.1000b6b3
add esp, 0xc
lea edx, [esp + 0x10]
push 0x5c
push edx
call fcn.1000a393
mov esi, eax
add esp, 8
test esi, esi
jne 0x10002a41
push str._MdLabel.dll__QueryRegExist_szRootKey_Is_Null...
jmp 0x10002bab
lea eax, [esi + 2]
push eax
lea ecx, [esp + 0x21c]
push 0x104
push ecx
call fcn.1000b6b3
add esp, 0xc
lea eax, [esp + 0x10]
push eax
xor edx, edx
push str.HKEY_CURRENT_USER
mov word [esi], dx
call fcn.1000a5cc
add esp, 8
test eax, eax
jne 0x10002aed
lea ecx, [esp + 0xc]
push ecx
push 0x20019
call dword [sym.imp.ADVAPI32.dll_RegOpenCurrentUser]
test eax, eax
je 0x10002aa4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._MdLabel.dll__RegOpenCurrentUser_Failed:__d...
push 0x40
call fcn.10001d40
add esp, 0xc
jmp 0x10002bb5
mov ecx, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push 0x20019
push 0
lea eax, [esp + 0x224]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10002b45
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._MdLabel.dll__RegOpenKeyEx_HKEY_CURRENT_USER_Failed:__d...
push 0x40
call fcn.10001d40
add esp, 0xc
jmp 0x10002bb5
lea eax, [esp + 0x10]
push eax
push str.HKEY_LOCAL_MACHINE
call fcn.1000a5cc
add esp, 8
test eax, eax
jne 0x10002b45
lea ecx, [esp + 8]
push ecx
push 0x20019
push eax
lea edx, [esp + 0x224]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10002b45
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x21c]
push eax
push str._MdLabel.dll__RegOpenKeyEx_HKEY_LOCAL_MACHINE__s_Failed:__d...
push 0x40
call fcn.10001d40
add esp, 0x10
jmp 0x10002bb5
mov ecx, dword [esp + 8]
push ebp
push ebx
push 0
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10002b7f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
push str._MdLabel.dll__RegQueryValueEx_:_s_Failed:__d...
push 0x40
call fcn.10001d40
mov edx, dword [esp + 0x18]
add esp, 0x10
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10002bb5
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ebp
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.1000a328
add esp, 0x420
ret
push str._MdLabel.dll__QueryRegValue_Param_Is_Null...
push 0x40
call fcn.10001d40
add esp, 8
mov ecx, dword [esp + 0x424]
pop esi
pop ebp
xor ecx, esp
xor eax, eax
call fcn.1000a328
add esp, 0x420
ret