Function at 0x10028590
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x102445d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x808], 0
push 0
push eax
call fcn.101679e0
lea eax, [ebp - 0x808]
mov edi, 0x400
push eax
push str.MfxTrace_OutputMode
push str.SoftwareIntelIntel_MFX_Trace
push SysReAllocString
lea ebx, [ebp - 0x804]
mov dword [ebp - 0x818], edi
call fcn.10028c30
mov ecx, dword [0x1024344c]
test eax, eax
lea eax, [ebp - 0x808]
cmovns ecx, dword [ebp - 0x808]
push eax
push str.MfxTrace_Level
push str.SoftwareIntelIntel_MFX_Trace
push SysReAllocString
mov dword [0x1024344c], ecx
call fcn.10028c30
mov ecx, dword [0x10243450]
add esp, 0x2c
test eax, eax
mov dword [ebp - 0x814], 0
lea eax, [ebp - 0x814]
mov dword [ebp - 0x810], 0x1000
cmovns ecx, dword [ebp - 0x808]
push eax
push 1
push 0
push str.SoftwareIntelIntel_MFX_Trace
push SysReAllocString
mov dword [0x10243450], ecx
mov dword [ebp - 0x80c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10028834
push esi
lea eax, [ebp - 0x810]
push eax
mov eax, ebx
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push str.MfxTrace_Categories
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x814]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10028821
cmp dword [ebp - 0x80c], 7
jne 0x10028821
cmp word [ebp - 0x804], si
je 0x10028821
mov esi, 0x20c
push edi
push ebx
call fcn.10185510
mov edi, eax
add esp, 8
cmp dword [ebp - 0x818], edi
je 0x10028821
mov eax, dword [0x10249de8]
xor ecx, ecx
inc edi
lea eax, [eax + 1]
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
push dword [0x10249dec]
call fcn.101856c0
add esp, 8
test eax, eax
je 0x10028821
imul ecx, dword [0x10249de8], 0x20c
push ebx
push 0x1020b850
push 0x104
mov dword [0x10249dec], eax
add ecx, eax
push ecx
call fcn.10028320
imul edx, dword [0x10249de8], 0x20c
add esp, 0x10
mov ecx, dword [0x10249dec]
mov eax, dword [0x10243450]
mov dword [ebp - 0x814], 0
mov dword [ebp - 0x810], 4
mov dword [ebp - 0x80c], 0
mov dword [edx + ecx + 0x208], eax
lea eax, [ebp - 0x814]
imul esi, dword [0x10249de8], 0x20c
push eax
push 1
push 0
push str.SoftwareIntelIntel_MFX_TraceCategories
add esi, dword [0x10249dec]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100287fd
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x808]
push eax
lea eax, [ebp - 0x80c]
push eax
push 0
push esi
push dword [ebp - 0x814]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x814]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x100287fd
cmp dword [ebp - 0x80c], 4
jne 0x100287fd
imul edx, dword [0x10249de8], 0x20c
mov eax, dword [0x10249dec]
mov ecx, dword [ebp - 0x808]
mov dword [edx + eax + 0x208], ecx
sub dword [ebp - 0x818], edi
lea ebx, [ebx + edi*2]
inc dword [0x10249de8]
mov esi, 0x20c
cmp word [ebx], 0
mov edi, dword [ebp - 0x818]
jne 0x100286d1
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101658c8
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.101658c8
mov esp, ebp
pop ebp
ret