Function at 0x10002c70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8e8
mov dword [ebp - 0x8e8], ecx
mov dword [ebp - 0x8dc], 0
push 0x1001bae4
call fcn.100011b0
add esp, 4
push eax
mov eax, dword [ebp - 0x8e8]
push eax
call fcn.10001d70
add esp, 8
push 0x1001bb00
call fcn.100011b0
add esp, 4
push eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call fcn.10001d70
add esp, 8
lea edx, [ebp - 0x80c]
push edx
push 0x20019
push 0
push 0x1001bb30
call fcn.100011b0
add esp, 4
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002e68
mov dword [ebp - 0x8e4], 0x400
mov dword [ebp - 0x8e0], 0x400
lea eax, [ebp - 0x8e0]
push eax
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0x808]
push ecx
mov edx, dword [ebp - 0x8dc]
push edx
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10002e59
lea ecx, [ebp - 0x408]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x808]
push eax
push 0x1001bb80
call fcn.100011b0
add esp, 4
push eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call fcn.10001d70
add esp, 0x14
lea edx, [ebp - 0x408]
push edx
push 0x1001bb94
call fcn.100011b0
add esp, 4
push eax
push 0xc8
lea eax, [ebp - 0x8d8]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
mov dword [ebp - 0x8e4], 0x400
lea ecx, [ebp - 0x8e4]
push ecx
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x8d8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10002dfb
mov ecx, dword [ebp - 4]
push ecx
push 0x1001bbc4
call fcn.100011b0
add esp, 4
push eax
mov edx, dword [ebp - 0x8e8]
push edx
call fcn.10001d70
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push 0x1001bbf8
call fcn.100011b0
add esp, 4
push eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call fcn.10001d70
add esp, 0xc
lea edx, [ebp - 0x808]
push edx
mov ecx, dword [ebp - 0x8e8]
call fcn.10001e80
mov dword [ebp - 0x8e4], 0x400
mov dword [ebp - 0x8e0], 0x400
mov eax, dword [ebp - 0x8dc]
add eax, 1
mov dword [ebp - 0x8dc], eax
jmp 0x10002d0b
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10002e89
mov edx, dword [ebp - 4]
push edx
push 0x1001bc20
call fcn.100011b0
add esp, 4
push eax
mov eax, dword [ebp - 0x8e8]
push eax
call fcn.10001d70
add esp, 0xc
push 0x1001bc4c
call fcn.100011b0
add esp, 4
push eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call fcn.10001d70
add esp, 8
lea edx, [ebp - 0x80c]
push edx
push 0x20019
push 0
push 0x1001bc80
call fcn.100011b0
add esp, 4
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000304b
mov dword [ebp - 0x8e4], 0x400
mov dword [ebp - 0x8e0], 0x400
lea eax, [ebp - 0x8e0]
push eax
lea ecx, [ebp - 0x408]
push ecx
lea edx, [ebp - 8]
push edx
push 0
lea eax, [ebp - 0x8e4]
push eax
lea ecx, [ebp - 0x808]
push ecx
mov edx, dword [ebp - 0x8dc]
push edx
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000303c
lea ecx, [ebp - 0x408]
push ecx
mov edx, dword [ebp - 8]
push edx
lea eax, [ebp - 0x808]
push eax
push 0x1001bcd0
call fcn.100011b0
add esp, 4
push eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call fcn.10001d70
add esp, 0x14
lea edx, [ebp - 0x408]
push edx
push 0x1001bce4
call fcn.100011b0
add esp, 4
push eax
push 0xc8
lea eax, [ebp - 0x8d8]
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
mov dword [ebp - 0x8e4], 0x400
lea ecx, [ebp - 0x8e4]
push ecx
lea edx, [ebp - 0x808]
push edx
lea eax, [ebp - 0x8d8]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10002fde
mov ecx, dword [ebp - 4]
push ecx
push 0x1001bd14
call fcn.100011b0
add esp, 4
push eax
mov edx, dword [ebp - 0x8e8]
push edx
call fcn.10001d70
add esp, 0xc
lea eax, [ebp - 0x808]
push eax
push 0x1001bd48
call fcn.100011b0
add esp, 4
push eax
mov ecx, dword [ebp - 0x8e8]
push ecx
call fcn.10001d70
add esp, 0xc
lea edx, [ebp - 0x808]
push edx
mov ecx, dword [ebp - 0x8e8]
call fcn.10001e80
mov dword [ebp - 0x8e4], 0x400
mov dword [ebp - 0x8e0], 0x400
mov eax, dword [ebp - 0x8dc]
add eax, 1
mov dword [ebp - 0x8dc], eax
jmp 0x10002eee
mov ecx, dword [ebp - 0x80c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1000306c
mov edx, dword [ebp - 4]
push edx
push 0x1001bd70
call fcn.100011b0
add esp, 4
push eax
mov eax, dword [ebp - 0x8e8]
push eax
call fcn.10001d70
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret