Function at 0x1002f8d0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x10096a70
mov eax, dword fs:[0]
push eax
sub esp, 0x238
mov eax, dword [0x100b0380]
xor eax, esp
mov dword [esp + 0x234], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x100b0380]
xor eax, esp
push eax
lea eax, [esp + 0x24c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x294]
mov edi, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
mov ebp, 1
mov dword [esp + 0x254], ebp
mov eax, dword [esp + 0x270]
xor ebx, ebx
lea esi, [eax - 1]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
cmp eax, esi
ja 0x1002f945
call fcn.10079987
cmp dword [esp + 0x274], 0x10
mov eax, dword [esp + 0x260]
jae 0x1002f95d
lea eax, [esp + 0x260]
cmp byte [eax + esi], 0x5c
je 0x1002f96f
lea esi, [esp + 0x25c]
call fcn.10035950
cmp dword [esp + 0x274], 0x10
mov eax, dword [esp + 0x260]
jae 0x1002f987
lea eax, [esp + 0x260]
lea edx, [esp + 0x18]
push edx
push 0x20019
push ebx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1002fabe
mov ecx, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x38]
push eax
push ebx
push ebx
push ebx
push ecx
mov dword [esp + 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x1002fab3
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x1002fab3
xor esi, esi
mov dword [esp + 0x30], ebp
cmp eax, ebx
jbe 0x1002fab3
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov edi, 0x104
lea ecx, [ecx]
cmp dword [esp + 0x20], ebx
jne 0x1002fab3
push 0x103
lea edx, [esp + 0x3d]
push ebx
push edx
mov byte [esp + 0x44], bl
call fcn.1007dcf0
mov edx, dword [esp + 0x24]
add esp, 0xc
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x4c]
push ecx
push esi
push edx
mov dword [esp + 0x54], edi
call ebp
test eax, eax
jne 0x1002faa8
cmp dword [esp + 0x290], 0x10
mov eax, dword [esp + 0x27c]
jae 0x1002fa47
lea eax, [esp + 0x27c]
mov ecx, dword [esp + 0x28c]
push ecx
push eax
lea edx, [esp + 0x40]
push edx
call fcn.1008df4c
add esp, 0xc
test eax, eax
jne 0x1002faa8
lea eax, [esp + 0x24]
push eax
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x144]
push ecx
lea edx, [esp + 0x38]
push edx
mov edx, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x48]
push ecx
push edx
mov dword [esp + 0x3c], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x1002faa8
mov eax, dword [esp + 0x2c]
push eax
lea ecx, [esp + 0x144]
call fcn.1002f230
add esp, 4
mov dword [esp + 0x20], eax
inc esi
cmp esi, dword [esp + 0x1c]
jb 0x1002f9f0
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [esp + 0x254], bl
mov edi, 0x10
cmp dword [esp + 0x274], edi
jb 0x1002fae3
mov edx, dword [esp + 0x260]
push edx
call fcn.100799fa
add esp, 4
mov esi, 0xf
mov dword [esp + 0x274], esi
mov dword [esp + 0x270], ebx
mov byte [esp + 0x260], bl
mov dword [esp + 0x254], 0xffffffff
cmp dword [esp + 0x290], edi
jb 0x1002fb21
mov eax, dword [esp + 0x27c]
push eax
call fcn.100799fa
add esp, 4
mov eax, dword [esp + 0x20]
mov dword [esp + 0x290], esi
mov dword [esp + 0x28c], ebx
mov byte [esp + 0x27c], bl
mov ecx, dword [esp + 0x24c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x234]
xor ecx, esp
call fcn.10079a05
add esp, 0x244
ret