Function at 0x1021810
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1039004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push edi
xor ebx, ebx
push 0x1fe
lea edx, [ebp - 0x206]
push ebx
push edx
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x420], ecx
mov word [ebp - 0x208], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x418]
push ecx
push ebx
lea edx, [esi + 0x64]
push edx
mov dword [ebp - 0x424], 0x105
call sub.instapi.dll_GetInstRegPathByID
test eax, eax
je 0x10218de
mov word [ebp - 0x210], bx
mov ecx, 0x105
lea eax, [ebp - 0x418]
lea esp, [esp]
cmp word [eax], bx
je 0x102189f
add eax, 2
sub ecx, 1
jne 0x1021890
jmp 0x10218c8
cmp ecx, ebx
je 0x10218c8
mov eax, 0x105
sub eax, ecx
push 0x101a9ec
mov ecx, 0x105
sub ecx, eax
push ecx
lea edx, [ebp + eax*2 - 0x418]
push edx
call fcn.0101ed00
cmp eax, ebx
jge 0x10218f2
lea eax, [ebp - 0x418]
push eax
push 0x20a
push 0xc04e0001
call fcn.010240e0
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
lea edi, [esi + 0x4d8]
push edi
push 0x20019
push ebx
lea ecx, [ebp - 0x418]
push ecx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x1021930
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
mov edx, dword [esi + 0x4d4]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov eax, dword [esi + 0x4d4]
mov ecx, dword [edi]
push 1
push eax
push 4
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x1021975
push 0xc04e0006
call fcn.0101f4c0
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8
mov edi, dword [edi]
lea eax, [ebp - 0x208]
test eax, eax
mov dword [ebp - 0x424], 0x200
je 0x1021995
mov dword [ebp - 0x424], 0x1fc
lea ecx, [ebp - 0x424]
push ecx
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x428]
push eax
push ebx
push 0x101aa14
push edi
mov dword [ebp - 0x428], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10219cc
cmp eax, 0xea
jne 0x1021a9e
cmp dword [ebp - 0x428], 7
je 0x1021a6c
push 0x70c
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, 1
add eax, eax
xor eax, dword [esi + 0xcc]
and eax, 2
xor dword [esi + 0xcc], eax
test byte [esi + 0xcc], 2
jne 0x1021c6e
cmp word [ebp - 0x208], bx
lea edi, [ebp - 0x208]
je 0x1021c6e
mov ebx, dword [sym.imp.MSVCR80.dll__wcsicmp]
push 0x101aa30
push edi
call ebx
add esp, 8
test eax, eax
je 0x1021c45
push 0x101aa38
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1021aba
mov ecx, dword [ebp - 0x41c]
mov edx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x420]
push edx
mov edx, esi
call fcn.0101fe00
test eax, eax
jne 0x1021c45
mov eax, 0x101aa40
jmp 0x1021c3e
cmp eax, ebx
mov ecx, dword [ebp - 0x424]
jne 0x1021a82
mov edx, ecx
shr edx, 1
mov word [ebp + edx*2 - 0x208], bx
add ecx, 2
cmp eax, ebx
jne 0x1021a95
mov edx, ecx
shr edx, 1
mov word [ebp + edx*2 - 0x208], bx
add ecx, 2
mov dword [ebp - 0x424], ecx
cmp eax, ebx
jne 0x10219e4
cmp word [ebp - 0x208], bx
je 0x10219e4
xor eax, eax
jmp 0x10219e9
push 0x101aa48
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1021af3
mov eax, dword [ebp - 0x420]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x41c]
push eax
push ecx
mov ecx, esi
call fcn.01020450
test eax, eax
jne 0x1021c45
mov eax, 0x101aa48
jmp 0x1021c3e
push 0x101aa50
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1021b2d
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov eax, esi
call fcn.01020820
test eax, eax
jne 0x1021c45
mov eax, 0x101aa50
jmp 0x1021c3e
push 0x101aa58
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1021b66
mov edx, dword [ebp - 0x41c]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x420]
push edx
push eax
mov edx, esi
call fcn.010208a0
test eax, eax
jne 0x1021c45
mov eax, 0x101aa58
jmp 0x1021c3e
push 0x101aa60
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1021b9f
mov ecx, dword [ebp - 0x420]
mov edx, dword [ebp + 8]
push ecx
push edx
mov edx, dword [ebp - 0x41c]
mov ecx, esi
call fcn.01020a30
test eax, eax
jne 0x1021c45
mov eax, 0x101aa60
jmp 0x1021c3e
push 0x101aa6c
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1021bd1
mov eax, dword [ebp - 0x41c]
mov ecx, dword [ebp + 8]
push eax
push ecx
mov ecx, dword [ebp - 0x420]
mov edx, esi
call fcn.01020b20
test eax, eax
jne 0x1021c45
mov eax, 0x101aa6c
jmp 0x1021c3e
push 0x101aa74
push edi
call ebx
add esp, 8
test eax, eax
jne 0x1021c03
mov edx, dword [ebp - 0x420]
mov eax, dword [ebp + 8]
push edx
mov edx, dword [ebp - 0x41c]
push eax
mov ecx, esi
call fcn.01020c90
test eax, eax
jne 0x1021c45
mov eax, 0x101aa74
jmp 0x1021c3e
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
test byte [0x103a4fc], 2
je 0x1021c3c
mov ecx, dword [0x103b304]
test ecx, ecx
je 0x1021c3c
mov edx, dword [0x103b304]
mov eax, dword [0x103b10c]
push edi
push edx
push 0x175000
push eax
call fcn.01024ec0
add esp, 0x10
mov eax, edi
mov ecx, esi
call fcn.0101f4f0
mov eax, edi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1021c50
sub eax, edx
sar eax, 1
cmp word [edi + eax*2 + 2], cx
lea edi, [edi + eax*2 + 2]
jne 0x1021a20
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.01029f27
mov esp, ebp
pop ebp
ret 8