Function at 0x10028b5f
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10166f68
mov eax, dword fs:[0]
push eax
sub esp, 0x2ac
mov eax, dword [0x1020f334]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov dword [ebp - 0x278], esi
mov ebx, ecx
mov dword [ebp - 0x27c], ebx
xor edi, edi
mov dword [ebp - 0x25c], 1
lea ecx, [ebp - 0x260]
mov dword [ebx], edi
mov dword [ebx + 4], edi
mov dword [ebx + 8], edi
mov dword [ebp - 0x250], edi
mov dword [ebp - 0x24c], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - fcn.100145ec], 0x1019a51c
mov dword [ebp - 0x258], edi
mov byte [ebp - 0x254], 1
call fcn.100145f7
push ecx
push eax
xor edx, edx
mov ecx, esi
call fcn.1002c218
test eax, eax
jne 0x10028e0d
mov esi, edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x244], 0x100
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x210]
push eax
push esi
push dword [ebp - 0x258]
call edi
cmp eax, 0xea
jne 0x10028d11
mov eax, dword [ebp - 0x244]
mov edx, 0x3a7
mov dword [ebp - 0x268], eax
mov ecx, 0x2001814
xor eax, eax
mov dword [ebp - 0x270], 0x101971d0
mov word [ebp - 0x264], ax
lea eax, [ebp - 0x270]
push eax
push str.Long_named_key_encountered.
push 0xf
mov dword [ebp - 0x26c], str.KeyLength
call fcn.1000eade
mov ecx, dword [ebp - 0x244]
and dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 7
lea eax, [ecx + 1]
mov dword [ebp - 0x274], eax
xor eax, eax
push eax
push ecx
lea ecx, [ebp - 0x228]
mov word [ebp - 0x228], ax
call fcn.1000ece8
cmp dword [ebp - 0x214], 8
lea eax, [ebp - 0x228]
cmovae eax, dword [ebp - 0x228]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x274]
push ecx
push eax
push esi
push dword [ebp - 0x258]
call edi
test eax, eax
jne 0x10028e4b
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x250]
call fcn.1000aabe
lea ecx, [ebp - 0x228]
jmp 0x10028d61
test eax, eax
jne 0x10028d77
and dword [ebp - 0x230], eax
lea ecx, [ebp - 0x240]
push dword [ebp - 0x244]
mov word [ebp - 0x240], ax
lea eax, [ebp - 0x210]
push eax
mov dword [ebp - 0x22c], 7
call fcn.100093d3
cmp dword [ebp - 0x230], 0
je 0x10028d6c
lea eax, [ebp - 0x240]
mov ecx, ebx
push eax
call fcn.1000aabe
lea ecx, [ebp - 0x240]
call fcn.1000860f
inc esi
jmp 0x10028c00
lea ecx, [ebp - 0x240]
call fcn.1000860f
mov esi, dword [ebp - 0x250]
cmp esi, dword [ebp - 0x24c]
je 0x10028e0d
mov ebx, dword [ebp - 0x278]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10028d99
mov eax, dword [esi]
push eax
mov edx, ebx
lea ecx, [ebp - 0x2b8]
call fcn.10028b06
xor eax, eax
lea edi, [ebp - 0x2a8]
cmp byte [ebp - 0x288], al
cmove edi, eax
mov ecx, edi
call fcn.1002c505
test eax, eax
jne 0x10028dd9
test edi, edi
jne 0x10028dce
mov eax, 0xa0
jmp 0x10028dd5
mov ecx, edi
call fcn.1002c408
test eax, eax
je 0x10028df1
push str.Failed_to_remove_long_named_key.
push 0xa
mov edx, 0x3a7
mov ecx, 0x2001817
call fcn.1003211b
pop ecx
pop ecx
lea ecx, [ebp - 0x2b8]
call fcn.100098b4
add esi, 0x18
cmp esi, dword [ebp - 0x24c]
jne 0x10028d8f
mov ebx, dword [ebp - 0x27c]
lea ecx, [ebp - 0x260]
mov dword [ebp - fcn.100145ec], 0x1019a51c
call fcn.1001460d
lea ecx, [ebp - 0x250]
call fcn.100095ad
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100042bb
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x268], eax
mov edx, 0x3a7
xor eax, eax
mov dword [ebp - 0x270], 0x101971d0
mov word [ebp - 0x264], ax
mov ecx, 0x2001815
lea eax, [ebp - 0x270]
mov dword [ebp - 0x26c], 0x1019a704
push eax
push str.Failed_to_get_the_key_name.
push 0xa
call fcn.1000eade
push 0
push 0x2001816
call fcn.10007fcb
int3