Function at 0x10015420
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1009e0d0]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x60]
push eax
xor esi, esi
push 0x100018c0
push 0x80000001
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x64], 0x50
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x60], esi
call edi
cmp eax, esi
jne 0x100154cd
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x58]
push ecx
push 0x100018b4
push edx
call edi
cmp eax, esi
jne 0x1001548c
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x5c]
push eax
push 0x100018ac
push ecx
call edi
jmp 0x100154a4
cmp eax, 2
jne 0x100154a4
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x5c]
push edx
push 0x100018ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, esi
jne 0x100154cd
lea ecx, [ebp - 0x64]
push ecx
mov ecx, dword [ebp - 0x5c]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x74]
push eax
push esi
push 0x10001a14
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x100154cd
mov ebx, dword [ebp - 0x54]
jmp 0x100154d0
or ebx, 0xffffffff
mov eax, dword [ebp - 0x68]
cmp eax, esi
je 0x100154de
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x5c]
cmp eax, esi
je 0x100154ec
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x58]
cmp eax, esi
je 0x100154fa
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x60]
cmp eax, esi
je 0x10015508
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 0x60]
push eax
push 0x100018c0
push 0x80000001
mov dword [edx + 0x1ad4], ebx
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x68], 0x50
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x60], esi
call edi
cmp eax, esi
jne 0x100155a0
mov edx, dword [ebp - 0x60]
lea ecx, [ebp - 0x5c]
push ecx
push 0x100018b4
push edx
call edi
cmp eax, esi
jne 0x1001555f
mov ecx, dword [ebp - 0x5c]
lea eax, [ebp - 0x58]
push eax
push 0x100018ac
push ecx
call edi
jmp 0x10015577
cmp eax, 2
jne 0x10015577
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
push edx
push 0x100018ac
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, esi
jne 0x100155a0
lea ecx, [ebp - 0x68]
push ecx
mov ecx, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x70]
push eax
push esi
push 0x10001a00
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x100155a0
mov ebx, dword [ebp - 0x54]
jmp 0x100155a3
or ebx, 0xffffffff
mov eax, dword [ebp - 0x64]
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x100155b3
push eax
call edi
mov eax, dword [ebp - 0x58]
cmp eax, esi
je 0x100155bd
push eax
call edi
mov eax, dword [ebp - 0x5c]
cmp eax, esi
je 0x100155c7
push eax
call edi
mov eax, dword [ebp - 0x60]
cmp eax, esi
je 0x100155d1
push eax
call edi
mov edi, dword [ebp - 0x6c]
mov ecx, edi
mov dword [edi + 0x1ad8], ebx
call fcn.10012bb0
fld qword [edi + 0x1b78]
cmp dword [edi + 8], 6
jl 0x10015664
fcom qword [0x10001ab0]
fnstsw ax
test ah, 0x41
jne 0x10015671
fld qword [0x10001d58]
fsubr st(1)
fmul qword [0x10001d50]
call fcn.1009bae0
cmp eax, esi
jl 0x10015664
cmp eax, 7
jg 0x10015664
fstp st(0)
fld qword [0x10001d48]
fstp qword [ebp - 0x44]
fld qword [0x10001d40]
fstp qword [ebp - 0x3c]
fld qword [0x10001d38]
fstp qword [ebp - 0x34]
fld qword [0x10001d30]
fstp qword [ebp - 0x2c]
fld qword [0x10001d28]
fstp qword [ebp - 0x24]
fld qword [0x10001d20]
fstp qword [ebp - 0x1c]
fld qword [0x10001d18]
fstp qword [ebp - 0x14]
fld qword [0x10001d10]
fstp qword [ebp - 0xc]
fld qword [ebp + eax*8 - 0x44]
fcom qword [0x10001ab0]
fnstsw ax
test ah, 0x41
je 0x10015679
fstp st(0)
fld qword [0x100017a8]
fld qword [0x10001d08]
fdiv st(1)
call fcn.1009bae0
fstp st(0)
mov ecx, dword [ebp - 4]
mov dword [edi + 0x1ae8], eax
pop edi
pop esi
pop ebx
call fcn.10007179
mov esp, ebp
pop ebp
ret