Function at 0x100ba55
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xaa8
mov eax, dword [0x1017048]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], eax
push edi
mov dword [ebp - 0xa90], esi
mov eax, esi
jne 0x100ba81
mov eax, 0x1001ac0
push eax
push 0x1004bb8
call fcn.0100f591
push esi
push 0x1004b48
lea eax, [ebp - 0x25c]
push 0x104
push eax
mov dword [ebp - 0xa8c], ebx
call fcn.0100a0db
add esp, 0x18
lea ecx, [ebp - 0xa8c]
call fcn.01008658
push eax
mov edi, 0x20019
push edi
push ebx
lea eax, [ebp - 0x25c]
push eax
mov esi, 0x80000002
push esi
call fcn.01008692
add esp, 0x14
test eax, eax
jne 0x100bb36
lea eax, [ebp - 0xa9c]
push eax
lea eax, [ebp - 0x874]
push eax
lea eax, [ebp - 0xaa8]
push eax
push ebx
push 0x1004b2c
push dword [ebp - 0xa8c]
mov dword [ebp - 0xa9c], 0x206
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100bb36
push dword [ebp + 0xc]
lea eax, [ebp - 0x874]
push eax
mov dword [ebp - 0xa9c], 0x206
mov word [ebp - 0x66e], bx
call fcn.0100a93f
pop ecx
pop ecx
mov bl, al
jmp 0x100bd1b
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xa90]
call fcn.01008ca3
lea eax, [ebp - 0x54]
push eax
push 0x1004aa0
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.0100a0db
add esp, 0x18
lea ecx, [ebp - 0xa8c]
call fcn.01008658
push eax
push edi
push ebx
lea eax, [ebp - 0x25c]
push eax
push esi
call fcn.01008692
add esp, 0x14
test eax, eax
jne 0x100bc5f
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0xaa4]
push eax
push ebx
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0xa88]
push eax
mov dword [ebp - 0xa90], ebx
push ebx
jmp 0x100bbfe
push dword [ebp + 0xc]
inc dword [ebp - 0xa90]
lea eax, [ebp - 0x66c]
push eax
call fcn.0100a93f
test al, al
pop ecx
pop ecx
je 0x100bd1b
lea eax, [ebp - 0xa98]
push eax
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0xaa4]
push eax
push ebx
lea eax, [ebp - 0xa94]
push eax
lea eax, [ebp - 0xa88]
push eax
push dword [ebp - 0xa90]
push dword [ebp - 0xa8c]
mov dword [ebp - 0xa94], 0x10a
mov dword [ebp - 0xa98], 0x208
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x100bbb5
lea ecx, [ebp - 0xa8c]
call fcn.01008658
push eax
push edi
push ebx
push 0x1004a18
push esi
call fcn.01008692
add esp, 0x14
test eax, eax
jne 0x100bc5f
push dword [ebp + 0xc]
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0xa8c]
call fcn.01008fcd
add esp, 0xc
test eax, eax
je 0x100bd1b
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0xa90]
push eax
call fcn.0100a7a1
pop ecx
push eax
push 0x1004958
lea eax, [ebp - 0x25c]
push 0x104
push eax
call fcn.0100a0db
add esp, 0x14
cmp dword [ebp - 0xa90], ebx
jne 0x100bd1b
lea ecx, [ebp - 0xa8c]
call fcn.01008658
push eax
push edi
push ebx
lea eax, [ebp - 0x25c]
push eax
push esi
call fcn.01008692
add esp, 0x14
test eax, eax
jne 0x100bd19
lea eax, [ebp - 0xa90]
push eax
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0xaa0]
push eax
push ebx
push 0x1004b2c
push dword [ebp - 0xa8c]
mov esi, 0x206
mov dword [ebp - 0xa90], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100bd1b
cmp dword [ebp - 0xaa0], 1
jne 0x100bd1b
push dword [ebp + 0xc]
lea eax, [ebp - 0x464]
push eax
mov dword [ebp - 0xa90], esi
mov word [ebp - 0x25e], bx
call fcn.0100a93f
test al, al
pop ecx
pop ecx
je 0x100bd1b
mov bl, 1
lea ecx, [ebp - 0xa8c]
call fcn.01008676
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
pop ebx
call fcn.0100f0dc
leave
ret