Function at 0xa2bd57
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentThreadId]
push eax
push ebx
push 0x1fffff
call dword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_OpenThread]
mov dword [0xa45134], eax
call fcn.00a21c33
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.api_ms_win_core_heap_l1_2_0.dll_HeapSetInformation]
lea eax, [ebp - 0x10]
mov dword [ebp - 0xc], ebx
push eax
push 0x20019
push ebx
push 0xa2be78
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
je 0xa3c48e
lea eax, [ebp - 1]
mov byte [0xa45048], 1
mov edx, 0xa60880
mov dword [0xa45188], eax
call fcn.00a2c0e2
dec eax
neg eax
sbb al, al
and byte [0xa45048], al
call fcn.00a2bfe1
xor eax, eax
mov dword [ebp - 8], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
lea ecx, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00a2c887
cmp dword [ebp - 0xc], 1
je 0xa3c4be
mov edi, 0xff
test eax, eax
je 0xa3c4f1
push ebx
push 0xa45620
call sub.msvcrt.dll__setjmp3
pop ecx
pop ecx
mov ecx, dword [0xa450ac]
test eax, eax
jne 0xa3c4db
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0xa2be65
mov esi, ebx
mov edx, dword [ebp + esi*4 - 0x2c]
test edx, edx
jne 0xa2bece
inc esi
cmp esi, 3
jl 0xa2be2c
call fcn.00a21c4a
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
push 0xa45200
push eax
mov dword [0xa45160], eax
call dword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetCPInfo]
call fcn.00a21c33
mov ecx, dword [0xa450ac]
test ecx, ecx
je 0xa3628d
mov ecx, dword [ebp - 8]
call fcn.00a2bc91
int3
push dword [0xa450bc]
xor ecx, ecx
inc ecx
call fcn.00a241a8
xor ecx, ecx
cmp eax, 1
je 0xa2beff
cmp eax, 0xffffffff
je 0xa2be70
mov edx, eax
call fcn.00a210dc
test eax, eax
je 0xa2be38
mov dword [ebp - 8], eax
jmp 0xa2be38
inc ecx
jmp 0xa2be70
mov dword [0xa450b0], ebx
jmp 0xa3c4f1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 4
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push 0xa3c604
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
jmp 0xa2bdb4
push ebx
push 0x40002729
call fcn.00a2e4e8
pop ecx
pop ecx
push ebx
call 0xa3f69c
mov ecx, 0xff
jmp 0xa2be70
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0xa2be26
mov dword [ebp - 8], edi
jmp 0xa2be26
push ebx
push 0xa45620
call sub.msvcrt.dll__setjmp3
mov dword [ebp - 8], eax
pop ecx
pop ecx
push 2
pop esi
test eax, eax
je 0xa3c513
cmp eax, esi
jne 0xa3c513
xor ecx, ecx
jmp 0xa2be70
cmp dword [ebp - 0xc], esi
jne 0xa3c532
push ebx
push 0x40002729
call fcn.00a2e4e8
pop ecx
pop ecx
push ebx
call 0xa3f69c
mov ecx, edi
jmp 0xa2be70
xor ecx, ecx
call fcn.00a246ae
test eax, eax
jne 0xa3c54e
push 3
pop esi
push 0x8000
push ebx
call dword [sym.imp.msvcrt.dll__setmode]
pop ecx
pop ecx
push ebx
call fcn.00a2af1c
mov ebx, dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_EnterCriticalSection]
push dword [0xa4515c]
mov byte [0xa45042], 0
call ebx
push dword [0xa4515c]
and dword [0xa45164], 0
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
push 0
xor edx, edx
mov ecx, esi
call fcn.00a241a8
mov edi, eax
cmp edi, 1
je 0xa3c55a
cmp edi, 0xffffffff
je 0xa3c50c
push dword [0xa4515c]
call ebx
push dword [0xa4515c]
and dword [0xa45164], 0
call dword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_LeaveCriticalSection]
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
push 0xa45200
push eax
mov dword [0xa45160], eax
call dword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetCPInfo]
call fcn.00a21c33
mov edx, edi
xor ecx, ecx
call fcn.00a210dc
mov byte [0xa45045], 0
call fcn.00a21c4a
call dword [sym.imp.api_ms_win_core_console_l1_1_0.dll_GetConsoleOutputCP]
push 0xa45200
push eax
mov dword [0xa45160], eax
call dword [sym.imp.api_ms_win_core_localization_l1_2_1.dll_GetCPInfo]
call fcn.00a21c33
jmp 0xa3c55a