Function at 0xf8270
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x10
push 0
push 0
dec ecx
jne 0xf8279
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0xf8763
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00013d18
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffff
mov eax, dword [ebp + 0x10]
call fcn.000143f0
mov eax, esi
call fcn.000143f0
mov eax, dword [ebp + 8]
call fcn.000143f0
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.0001bf50
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
call fcn.00013fa8
test eax, eax
jg 0xf8314
lea edx, [ebp - 0x30]
mov eax, ebx
call fcn.00027478
mov ecx, dword [ebp - 0x30]
lea eax, [ebp - 0x2c]
mov edx, 0xf877c
call fcn.00013ff4
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.000f58bc
jmp 0xf86f9
lea eax, [ebp - 0x18]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push dword [ebp - 0x14]
push 0xf8794
push 0xf87a0
lea eax, [ebp - 0x34]
mov edx, 3
call fcn.00014068
mov eax, dword [ebp - 0x34]
call fcn.0001416c
push eax
push 0x80000003
call sub.advapi32.dll_RegOpenKeyExA_1
mov ebx, eax
test ebx, ebx
jne 0xf8694
lea eax, [ebp - 0x28]
mov edx, 0x800
call fcn.000271f0
mov dword [ebp - 0x24], 0x800
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0xf87b8
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
test ebx, ebx
jne 0xf83ba
cmp dword [ebp - 0x20], 1
jne 0xf83ba
cmp dword [ebp - 0x24], 1
jbe 0xf83ba
cmp dword [ebp - 0x24], 0x104
ja 0xf83ba
mov eax, esi
mov edx, dword [ebp - 0x28]
call fcn.00014548
jmp 0xf8412
push 0xf87d8
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x3c]
call fcn.00027444
push dword [ebp - 0x3c]
push 0xf87f0
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x40]
call fcn.00027444
push dword [ebp - 0x40]
push 0xf87f0
lea edx, [ebp - 0x44]
mov eax, ebx
call fcn.00027478
push dword [ebp - 0x44]
lea eax, [ebp - 0x38]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 4]
call fcn.000f58bc
mov eax, dword [esi]
call fcn.00014630
test eax, eax
jle 0xf8685
lea eax, [ebp - 0x10]
mov edx, 0x14
call fcn.000271f0
mov dword [ebp - 0x24], 0x14
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0xf87f4
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov ebx, eax
test ebx, ebx
jne 0xf84b6
cmp dword [ebp - 0x20], 1
jne 0xf84b6
cmp dword [ebp - 0x24], 1
jbe 0xf84b6
cmp dword [ebp - 0x24], 0x14
ja 0xf84b6
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00013ee0
xor eax, eax
push ebp
push 0xf84a1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.00015578
mov edx, dword [ebp - 8]
mov dword [edx], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0xf850e
push 0xf8808
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x4c]
call fcn.00027444
push dword [ebp - 0x4c]
push 0xf87f0
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x50]
call fcn.00027444
push dword [ebp - 0x50]
push 0xf87f0
lea edx, [ebp - 0x54]
mov eax, ebx
call fcn.00027478
push dword [ebp - 0x54]
lea eax, [ebp - 0x48]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 4]
call fcn.000f58bc
lea eax, [ebp - 0x10]
mov edx, 0x14
call fcn.00027218
mov edx, 0x800
mov eax, dword [ebp - 0x28]
call fcn.00018100
mov dword [ebp - 0x24], 0x104
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0xf8818
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
test ebx, ebx
jne 0xf8578
cmp dword [ebp - 0x20], 1
jne 0xf8578
cmp dword [ebp - 0x24], 1
jbe 0xf8578
cmp dword [ebp - 0x24], 0x104
ja 0xf8578
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x28]
call fcn.00014548
jmp 0xf85d0
push 0xf882c
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x5c]
call fcn.00027444
push dword [ebp - 0x5c]
push 0xf87f0
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x60]
call fcn.00027444
push dword [ebp - 0x60]
push 0xf87f0
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.00027478
push dword [ebp - 0x64]
lea eax, [ebp - 0x58]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0x58]
mov edx, dword [ebp - 4]
call fcn.000f58bc
mov edx, 0x800
mov eax, dword [ebp - 0x28]
call fcn.00018100
mov dword [ebp - 0x24], 0x104
xor eax, eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
push 0
push 0xf883c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW
mov ebx, eax
test ebx, ebx
jne 0xf862d
cmp dword [ebp - 0x20], 1
jne 0xf862d
cmp dword [ebp - 0x24], 1
jbe 0xf862d
cmp dword [ebp - 0x24], 0x104
ja 0xf862d
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x28]
call fcn.00014548
jmp 0xf8685
push 0xf8854
mov eax, dword [ebp - 0x24]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x6c]
call fcn.00027444
push dword [ebp - 0x6c]
push 0xf87f0
mov eax, dword [ebp - 0x20]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x70]
call fcn.00027444
push dword [ebp - 0x70]
push 0xf87f0
lea edx, [ebp - 0x74]
mov eax, ebx
call fcn.00027478
push dword [ebp - 0x74]
lea eax, [ebp - 0x68]
mov edx, 6
call fcn.00014068
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 4]
call fcn.000f58bc
lea eax, [ebp - 0x28]
mov edx, 0x800
call fcn.00027218
jmp 0xf86f9
push 0xf8854
push dword [ebp - 0x14]
push 0xf87f0
lea eax, [ebp - 0x80]
mov edx, 3
call fcn.00014068
mov edx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
call fcn.000145ac
push dword [ebp - 0x7c]
push edi
lea edx, [ebp - 0x88]
mov eax, ebx
call fcn.00027478
mov edx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
call fcn.000145ac
push dword [ebp - 0x84]
lea eax, [ebp - 0x78]
mov edx, 3
call fcn.00014700
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp - 4]
call fcn.000f5a4c
cmp dword [ebp - 0x18], 0
je 0xf8708
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x18], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0xf876a
lea eax, [ebp - 0x88]
call fcn.00013d18
lea eax, [ebp - 0x84]
call fcn.000143f0
lea eax, [ebp - 0x80]
call fcn.00013d18
lea eax, [ebp - 0x7c]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0x74]
mov edx, 0x13
call fcn.00013d3c
lea eax, [ebp - 0x14]
call fcn.00013d18
lea eax, [ebp - 0xc]
call fcn.00013d18
ret