Function at 0x10022d98
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xa8
mov eax, 0x10050ea4
call fcn.1004f8f5
mov edi, ecx
mov dword [ebp - 0xa4], edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [0x1005b1e8]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0xac], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x1005b1e8]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0xa8], eax
and dword [ebp - 0xa0], 0
mov byte [ebp - 4], 4
cmp dword [ebp + 0xc], ebx
je 0x10022e87
mov eax, dword [0x1005b1e8]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0x98], eax
push 0x10007370
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 6
push 0x1000b818
push eax
call fcn.10028a40
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [ebp - 0x98]
push 0x80070057
push 0x1000b988
push esi
push edi
push eax
push 0x100071b0
push ebx
call fcn.1001b4b3
add esp, 0x1c
lea ecx, [esi - 0x10]
call fcn.1002a468
jmp 0x10023100
mov ecx, edi
call fcn.1001bdc3
mov ebx, eax
test ebx, ebx
jns 0x10022ef2
mov ecx, dword [0x1005b1e8]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 8
push 0x10008aac
lea eax, [ebp - 0x98]
push eax
call fcn.10028a40
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, dword [ebp - 0x98]
push ebx
push 0x1000b988
push esi
push edi
push eax
push 0x100071b0
push 1
jmp 0x10022e72
mov ecx, dword [ebp - 0x98]
lea eax, [ebp - 0xa8]
push eax
xor esi, esi
lea eax, [ebp - 0xac]
inc esi
push eax
mov edx, esi
call fcn.1002f94b
mov ebx, eax
test ebx, ebx
jns 0x10022f56
mov ecx, dword [0x1005b1e8]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0x98], eax
push 1
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0xa
push 0x1000aa68
push eax
call fcn.10028a40
add esp, 0xc
jmp 0x10022ecc
mov ecx, dword [edi + 0x70]
lea eax, [ebp - 0x99]
push eax
lea edx, [ebp - 0xa0]
mov byte [ebp - 0x99], 0
call fcn.1002db0f
mov ebx, eax
test ebx, ebx
jns 0x10022fa7
mov ecx, dword [0x1005b1e8]
mov esi, dword [ecx + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0x98], eax
mov byte [ebp - 4], 0xc
push 0x1000b9f8
jmp 0x10022ebe
cmp byte [ebp - 0x99], 0
lea eax, [ebp - 0x98]
mov ecx, dword [edi + 0x48]
mov dword [ebp - 0x98], esi
push eax
jne 0x10022fc7
push 0x1000ba50
jmp 0x10022fcc
push 0x1000bab8
call fcn.1002aff1
push 0x82
xor ebx, ebx
lea eax, [ebp - 0x94]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0xb0], 0x41
lea eax, [ebp - 0xb0]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x94]
push eax
push ebx
jmp 0x10023062
mov ecx, dword [edi + 0x48]
lea eax, [ebp - 0x98]
push eax
xor ebx, ebx
lea eax, [ebp - 0x94]
inc ebx
push eax
mov dword [ebp - 0x98], ebx
call fcn.1002aff1
mov ecx, dword [edi + 0x48]
lea eax, [ebp - 0x98]
push eax
push 0x10006cdc
mov dword [ebp - 0x98], ebx
call fcn.1002aff1
mov eax, esi
mov dword [ebp - 0xb4], 0x41
inc esi
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0xb4]
push ecx
lea ecx, [ebp - 0x94]
push ecx
push eax
push dword [ebp - 0xa0]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test ebx, ebx
je 0x10023007
cmp ebx, 0x103
je 0x100230e2
movzx edi, bx
test ebx, ebx
jg 0x10023085
jmp 0x1002308c
mov eax, edi
or eax, 0x80070000
test eax, eax
jns 0x100230dc
mov eax, dword [0x1005b1e8]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x10060380]
mov ecx, 0x1005b1e8
call esi
add eax, 0x10
mov dword [ebp - 0x98], eax
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 0xe
push 0x1000bb18
push eax
call fcn.10028a40
pop ecx
pop ecx
test ebx, ebx
jle 0x10022ecc
or edi, 0x80070000
mov ebx, edi
jmp 0x10022ecc
mov edi, dword [ebp - 0xa4]
mov ecx, dword [edi + 0x48]
lea eax, [ebp - 0xa4]
push eax
push 0x10006cdc
mov dword [ebp - 0xa4], 1
call fcn.1002aff1
push dword [ebp - 0xa0]
call fcn.10028ec6
mov ecx, dword [ebp - 0xa8]
lea ecx, [ecx - 0x10]
call fcn.1002a468
mov ecx, dword [ebp - 0xac]
lea ecx, [ecx - 0x10]
call fcn.1002a468
xor eax, eax
call fcn.1004f892
ret 8