Function at 0x100a8ca
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ebx, ebx
lea eax, [ebp - 0x210]
push eax
mov esi, 0x20019
push esi
push ebx
push 0x1002270
push 0x80000002
mov dword [ebp - 0x220], ecx
mov dword [ebp - 0x208], ebx
mov dword [ebp - 0x210], ebx
mov dword [ebp - 0x214], ebx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
call edi
test eax, eax
jne 0x100ab72
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 0x20
push 0x10022c8
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x20c], 0x200
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
cmp eax, ebx
jle 0x100a96b
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
mov dword [ebp - 0x208], eax
jl 0x100ab26
lea eax, [ebp - 0x214]
push eax
push esi
push ebx
push 0x10022dc
push dword [ebp - 0x210]
call edi
test eax, eax
jne 0x100aaeb
lea edi, [ebp - 0x204]
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100a9a2
sub eax, edx
sar eax, 1
mov dword [ebp - 0x224], eax
je 0x100aadd
mov ebx, 0x1001aa4
jmp 0x100a9c8
mov esi, 0x20019
mov ecx, dword [ebp - 0x220]
push 8
pop eax
cmp ax, word [ecx]
jbe 0x100aadb
cmp dword [ebp - 0x20c], 0
jbe 0x100aadb
cmp dword [0x1021270], 0
je 0x100aadb
lea eax, [ebp - 0x218]
push eax
push esi
push 0
push edi
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100aa56
push dword [ebp - 0x218]
mov ecx, dword [ebp - 0x220]
push edi
call fcn.0100a6cf
mov esi, eax
test esi, esi
jge 0x100aa48
mov eax, dword [section..data]
cmp eax, section..data
je 0x100aa48
test byte [eax + 0x1c], 4
je 0x100aa48
push esi
push ebx
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100aa8e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x100aa6a
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100aa8e
test byte [eax + 0x1c], 4
je 0x100aa8e
push esi
push edi
push ebx
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100a508
test esi, esi
jl 0x100aaa5
cmp dword [ebp - 0x21c], 0
jne 0x100aaa5
mov dword [ebp - 0x21c], 1
mov eax, dword [ebp - 0x224]
add eax, eax
push 0xfffffffffffffffe
pop ecx
sub ecx, eax
add dword [ebp - 0x20c], ecx
lea edi, [edi + eax + 2]
mov eax, edi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x100aac1
sub eax, ecx
sar eax, 1
mov dword [ebp - 0x224], eax
jne 0x100a9c3
xor ebx, ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100ab50
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
jle 0x100aaff
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x208], eax
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ab50
test byte [eax + 0x1c], 4
je 0x100ab50
push dword [ebp - 0x208]
push 0x1001aa4
push 0x15
jmp 0x100ab45
mov eax, dword [section..data]
cmp eax, section..data
je 0x100ab50
test byte [eax + 0x1c], 4
je 0x100ab50
push dword [ebp - 0x208]
push 0x1001aa4
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x208], ebx
jge 0x100ab72
cmp dword [ebp - 0x21c], ebx
je 0x100ab72
mov dword [ebp - 0x208], ebx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x208]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a14f
leave
ret