Function at 0x1016e85
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x438
mov eax, 0x103fa6e
call fcn.0103d928
mov esi, ecx
xor edi, edi
mov dword [ebp - 0x424], edi
push edi
push dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x438]
push eax
call fcn.01016e0b
mov dword [ebp - 4], edi
mov byte [ebp - 4], 1
lea eax, [ebp - 0x424]
push eax
push 1
push edi
push 0x1002e84
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101710b
mov dword [ebp - 0x41c], 0x400
mov dword [ebp - 0x418], edi
push 0x3fe
push edi
lea eax, [ebp - 0x414]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x10028d0
push 0x402
lea eax, [ebp - 0x418]
push eax
call fcn.01016d53
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
push edi
push 0x1002e74
push dword [ebp - 0x424]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
test eax, eax
jne 0x1016f8d
mov eax, dword [ebp - 0x41c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x418], cx
push 0x1002e70
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1016f6e
mov dword [esi], 1
jmp 0x1016f8d
push 0x1002e6c
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
mov dword [esi], eax
mov dword [ebp - 0x420], edi
lea eax, [ebp - 0x420]
push eax
push 0x1016cef
lea eax, [ebp - 0x444]
push eax
call fcn.010347dd
mov byte [ebp - 4], 2
lea eax, [ebp - 0x41c]
push eax
push edi
push edi
push edi
push 0x1002e48
push dword [ebp - 0x424]
call ebx
test eax, eax
jne 0x10170a0
mov eax, dword [ebp - 0x41c]
inc eax
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0103d496
pop ecx
mov dword [ebp - 0x420], eax
cmp eax, edi
je 0x10170a0
lea ecx, [ebp - 0x41c]
push ecx
push eax
push edi
push edi
push 0x1002e48
push dword [ebp - 0x424]
call ebx
test eax, eax
jne 0x10170a0
mov eax, dword [ebp - 0x41c]
shr eax, 1
xor ecx, ecx
mov edx, dword [ebp - 0x420]
mov word [edx + eax*2], cx
mov eax, dword [esi + 4]
cmp eax, edi
je 0x101703c
push eax
call fcn.0103d416
pop ecx
mov dword [esi + 4], edi
push dword [ebp - 0x420]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
call ebx
inc eax
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0103d496
pop ecx
mov dword [esi + 4], eax
cmp eax, edi
jne 0x1017082
mov dword [ebp - 0x428], 0xbbef
push 0x1044b0c
lea eax, [ebp - 0x428]
push eax
call sub.msvcrt.dll__CxxThrowException
push dword [ebp - 0x420]
push dword [ebp - 0x420]
call ebx
inc eax
push eax
push dword [esi + 4]
call fcn.01011d82
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x41c], 0x400
xor eax, eax
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
push edi
push 0x1002e24
push dword [ebp - 0x424]
call ebx
test eax, eax
jne 0x10170fb
mov eax, dword [ebp - 0x41c]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2 - 0x418], cx
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
cdq
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], edx
mov byte [ebp - 4], 1
lea eax, [ebp - 0x444]
push eax
call fcn.01016ded
mov dword [ebp - 4], edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x438]
push eax
call fcn.01016d37
call fcn.0103d993
ret