Function at 0x100a551
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xd94
mov eax, dword [reloc.msvcrt.dll___p__commode]
push ebx
mov ebx, dword [ebp + 0x24]
push esi
push edi
push 0xf
pop esi
xor edi, edi
push edi
push 0x64
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x28]
push dword [ebp + 0xc]
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
mov dword [ebp - reloc.msvcrt.dll___p__commode], edi
mov dword [ebp - reloc.msvcrt.dll___p__commode], 0xc8
call fcn.01017fa0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push edx
push eax
call fcn.01018000
push edi
push 0x64
push dword [ebp + 0x18]
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
push dword [ebp + 0x14]
mov dword [ebp - reloc.msvcrt.dll___p__commode], edx
call fcn.01017fa0
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push edx
push eax
call fcn.01018000
push 0x1002278
push dword [ebp - 0xd50]
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
mov dword [ebp - reloc.msvcrt.dll___p__commode], edx
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, reloc.msvcrt.dll___p__commode
push eax
lea eax, [ebp - 0xcc]
push eax
push 0x1002250
push 0x1001680
lea eax, reloc.msvcrt.dll___p__commode
push eax
call fcn.0100ae6d
push dword [ebp - 0xd64]
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - reloc.msvcrt.dll___p__commode], edi
jne 0x100a542
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.msvcrt.dll__wtoi]
mov esi, eax
cmp esi, 0x32
pop ecx
jbe 0x100a53b
push 0x32
pop esi
cmp esi, 1
jae 0x100a542
xor esi, esi
call fcn.0100b23e
test eax, eax
je 0x100a586
push esi
push dword [ebp - 0xd5c]
push dword [ebp - 0xd60]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 0xd54]
push dword [ebp - 0xd58]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0x10021e8
push 2
push 0x4f8
push 0x53
call fcn.0100b327
add esp, 0x34
mov eax, dword [ebp - reloc.msvcrt.dll___p__commode]
cmp eax, edi
jg 0x100a721
jl 0x100a5a2
cmp dword [ebp - reloc.msvcrt.dll___p__commode], esi
jae 0x100a721
cmp dword [ebp - reloc.msvcrt.dll___p__commode], eax
jg 0x100a643
jl 0x100a5c2
mov eax, dword [ebp - reloc.msvcrt.dll___p__commode]
cmp dword [ebp - reloc.msvcrt.dll___p__commode], eax
jae 0x100a643
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01018000
cmp edx, edi
jl 0x100a611
jg 0x100a5dd
cmp eax, edi
jbe 0x100a611
cmp edx, edi
jg 0x100a611
jl 0x100a5e8
cmp eax, 1
jae 0x100a611
mov eax, dword [ebp - reloc.msvcrt.dll___p__commode]
mov dword [ebp - reloc.msvcrt.dll___p__commode], esi
mov esi, 0x320
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
push esi
lea eax, reloc.msvcrt.dll___p__commode
push eax
push 0x2d9
jmp 0x100a6ad
mov eax, dword [ebp - reloc.msvcrt.dll___p__commode]
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
mov eax, dword [ebp - reloc.msvcrt.dll___p__commode]
mov dword [ebp - reloc.msvcrt.dll___p__commode], esi
mov esi, 0x320
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
push esi
lea eax, reloc.msvcrt.dll___p__commode
push eax
push 0x2d0
jmp 0x100a6b3
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.01018000
cmp edx, edi
jl 0x100a689
jg 0x100a65e
cmp eax, edi
jbe 0x100a689
cmp edx, edi
jg 0x100a689
jl 0x100a669
cmp eax, 1
jae 0x100a689
mov dword [ebp - reloc.msvcrt.dll___p__commode], esi
mov esi, 0x320
push esi
lea eax, reloc.msvcrt.dll___p__commode
push eax
mov dword [ebp - reloc.msvcrt.dll___p__commode], edi
push 0x2da
jmp 0x100a6ad
mov eax, dword [ebp - reloc.msvcrt.dll___p__commode]
mov dword [ebp - reloc.msvcrt.dll___p__commode], esi
mov esi, 0x320
mov dword [ebp - reloc.msvcrt.dll___p__commode], eax
push esi
lea eax, reloc.msvcrt.dll___p__commode
push eax
push 0x2d1
mov dword [ebp - reloc.msvcrt.dll___p__commode], edi
push edi
mov dword [ebp - reloc.msvcrt.dll___p__commode], ebx
call fcn.0100adb1
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push eax
call ebx
cmp dword [ebp + 8], edi
jne 0x100a6f9
push esi
lea eax, reloc.msvcrt.dll___p__commode
push eax
push 0x2e2
push edi
call fcn.0100adb1
push eax
call ebx
lea eax, reloc.msvcrt.dll___p__commode
push eax
lea eax, reloc.msvcrt.dll___p__commode
push eax
call dword [sym.imp.msvcrt.dll_wcscat]
pop ecx
pop ecx
lea eax, reloc.msvcrt.dll___p__commode
push eax
push dword [ebp + 0x2c]
lea eax, reloc.msvcrt.dll___p__commode
push dword [ebp - 0xd50]
push edi
push edi
push eax
push 0x2400
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
xor eax, eax
jmp 0x100a724
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01017c5b
leave
ret 0x28