Function at 0x10020d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
mov eax, dword [0x1006d258]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x10061d00
push 1
push 0x10061d04
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
mov dword [ebp - 0x40c], 0xffffff38
mov byte [ebp - 0x408], 0
push 0x3ff
push 0
lea eax, [ebp - 0x407]
push eax
call fcn.1004e3d0
add esp, 0xc
mov byte [ebp - 0x424], 0
xor ecx, ecx
mov dword [ebp - 0x423], ecx
mov dword [ebp - 0x41f], ecx
mov dword [ebp - 0x41b], ecx
mov dword [ebp - 0x417], ecx
mov byte [ebp - 0x42c], 0
xor edx, edx
mov word [ebp - 0x42b], dx
mov byte [ebp - 0x430], 0
xor eax, eax
mov word [ebp - 0x42f], ax
mov byte [ebp - 0x42d], al
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push 0x10061d1c
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x10020fd8
lea edx, [ebp - 0x424]
push edx
call fcn.100129e0
mov ax, word [ebp - 0x422]
mov word [ebp - 0x42c], ax
mov dword [ebp - 0x434], 0
jmp 0x10020e34
mov ecx, dword [ebp - 0x434]
add ecx, 1
mov dword [ebp - 0x434], ecx
cmp dword [ebp - 0x428], 0
jne 0x10020fce
mov dword [ebp - 0x438], 0x104
mov byte [ebp - 0x540], 0
push 0x103
push 0
lea edx, [ebp - 0x53f]
push edx
call fcn.1004e3d0
add esp, 0xc
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x438]
push eax
lea ecx, [ebp - 0x540]
push ecx
mov edx, dword [ebp - 0x434]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x10020fc9
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x650], 0x104
mov byte [ebp - 0x648], 0
push 0x103
push 0
lea ecx, [ebp - 0x647]
push ecx
call fcn.1004e3d0
add esp, 0xc
lea edx, [ebp - 0x650]
push edx
lea eax, [ebp - 0x648]
push eax
lea ecx, [ebp - 0x64c]
push ecx
push 0
lea edx, [ebp - 0x540]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
mov dword [ebp - 0x430], ecx
lea edx, [ebp - 0x648]
mov dword [ebp - 0x654], edx
mov eax, dword [ebp - 0x654]
add eax, 1
mov dword [ebp - 0x658], eax
mov ecx, dword [ebp - 0x654]
mov dl, byte [ecx]
mov byte [ebp - 0x659], dl
add dword [ebp - 0x654], 1
cmp byte [ebp - 0x659], 0
jne 0x10020f1e
mov eax, dword [ebp - 0x654]
sub eax, dword [ebp - 0x658]
mov dword [ebp - 0x660], eax
mov ecx, dword [ebp - 0x660]
sub ecx, 3
push ecx
lea edx, [ebp - 0x645]
push edx
lea eax, [ebp - 0x430]
push eax
call fcn.1004ec60
add esp, 0xc
lea ecx, [ebp - 0x430]
push ecx
call fcn.100481ab
add esp, 4
mov dword [0x100b8458], eax
mov edx, dword [ebp + 8]
mov dword [0x100b844c], edx
push 0x10061d3c
lea eax, [ebp - 0x42c]
push eax
lea ecx, [ebp - 0x408]
push ecx
call sym.ksnetcomm.dll_ReaderInitialization
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0x30
jne 0x10020fc9
lea edx, [ebp - 0x430]
push edx
call fcn.100481ab
add esp, 4
mov dword [ebp - 0x40c], eax
jmp 0x10020fce
jmp 0x10020e25
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x10061d40
push 1
push 0x10061d48
push 1
push str.ksnetcomm.reader
push 0x10071118
call fcn.100122f0
add esp, 0x18
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10048168
mov esp, ebp
pop ebp
ret 4