Function at 0x1002af5a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0xc
mov dword [0x102cb054], eax
mov eax, dword [esp + 0x1c]
mov dword [0x102cb058], eax
mov eax, dword [esp + 0x18]
push ebx
push esi
mov dword [0x102cb05c], eax
mov eax, dword [section..data]
xor ebx, ebx
inc ebx
cmp eax, section..data
je 0x1002afa3
test byte [eax + 0x1c], bl
je 0x1002afa3
push 0x10238268
push 0x10
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
push ebp
push 0x10237a58
push 0xd
call fcn.1002a53c
xor ebp, ebp
push 0xc
mov dword [esp + 0x34], ebp
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebp
mov dword [esp + 0x18], ebp
call fcn.1002a528
push eax
call fcn.1019baa0
push 0xc
call fcn.1002a528
push eax
mov esi, 0x104
push esi
push 0x102cabe8
call fcn.101df899
add esp, 0x20
push esi
mov esi, 0x102cb4c0
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1002b031
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b029
test byte [eax + 0x1c], bl
je 0x1002b029
push 0x10238268
push 0x11
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
push 0xe
pop esi
jmp 0x1002b349
push 0x5c
push esi
call fcn.101d2ffa
pop ecx
pop ecx
lea ecx, [eax + 2]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x1002b041
sub ecx, edx
sar ecx, 1
cmp ecx, 0x3e
jbe 0x1002b059
push 0x19
jmp 0x1002b02b
lea eax, [esp + 0x14]
push eax
call fcn.10035126
pop ecx
test eax, eax
jne 0x1002b06c
push 7
jmp 0x1002b02b
call fcn.1019a510
test eax, eax
jne 0x1002b079
push 8
jmp 0x1002b02b
push edi
push ebp
lea eax, [esp + 0x30]
push eax
push 0x1f0001
push ebp
push 0x10237a5c
call fcn.1002a89e
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1002b0d2
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b2a2
test byte [eax + 0x1c], bl
je 0x1002b2a2
push 0x10238268
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
jmp 0x1002b2a2
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b0f8
test byte [eax + 0x1c], bl
je 0x1002b0f8
push 0x10238268
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
cmp dword [0x102cb098], ebp
je 0x1002b108
push 0xe
pop esi
jmp 0x1002b2a2
push ebp
lea eax, [esp + 0x28]
push eax
push 0x1f0003
push ebx
push 0x10237ab0
call fcn.1002a89e
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1002b15a
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b295
test byte [eax + 0x1c], bl
je 0x1002b295
push 0x10238268
push 0x15
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
jmp 0x1002b295
push ebp
lea eax, [esp + 0x14]
push eax
push 0xf013f
push 2
push ebp
call fcn.1002a89e
mov ebx, dword [esp + 0x24]
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1002b1ae
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b28b
test byte [eax + 0x1c], 1
je 0x1002b28b
push 0x10238268
push 0x16
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
jmp 0x1002b28b
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ebp
push eax
push ebp
push ebp
push ebp
push 0x10237ac4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1002b1f9
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b1f1
test byte [eax + 0x1c], 1
je 0x1002b1f1
push 0x10238268
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
push 2
pop esi
jmp 0x1002b28b
push 0xa
call fcn.1002a528
mov ebp, dword [esp + 0x28]
pop ecx
cmp word [eax], 0x30
jne 0x1002b2e1
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b236
test byte [eax + 0x1c], 1
je 0x1002b236
push 0x10238268
push 0x18
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
push 0
lea eax, [esp + 0x2c]
push eax
push 0x1f0001
push 0
push 0x10237ad8
call fcn.1002a89e
mov esi, eax
add esp, 0x14
test esi, esi
je 0x1002b2b8
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b27e
test byte [eax + 0x1c], 1
je 0x1002b27e
push 0x10238268
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
cmp dword [esp + 0x28], 0
je 0x1002b28b
push dword [esp + 0x28]
call edi
test ebx, ebx
je 0x1002b292
push ebx
call edi
xor ebx, ebx
inc ebx
cmp dword [esp + 0x24], 0
je 0x1002b2a2
push dword [esp + 0x24]
call edi
cmp dword [esp + 0x2c], 0
je 0x1002b348
push dword [esp + 0x2c]
call edi
jmp 0x1002b348
mov eax, dword [section..data]
cmp eax, section..data
je 0x1002b2e8
test byte [eax + 0x1c], 1
je 0x1002b2e8
push 0x10238268
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c92e
add esp, 0x10
jmp 0x1002b2e8
push ebp
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xb
call fcn.1002a528
pop ecx
mov ecx, dword [0x102cb050]
push 1
cmp word [eax], 0x31
pop eax
push dword [esp + 0x18]
cmove ecx, eax
mov dword [0x102cb2b4], ebx
mov eax, dword [esp + 0x30]
xor ebx, ebx
mov dword [0x102cadf4], eax
inc ebx
mov eax, dword [esp + 0x2c]
push 0x10237ae0
push 0xc
mov dword [0x102cb050], ecx
mov dword [0x102cadf0], eax
mov dword [0x102cb0a4], ebp
mov dword [0x102cb098], ebx
call fcn.1002a528
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
pop edi
push esi
push 0x10237ae8
push 0xa
call fcn.1002a528
pop ecx
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, dword [section..data]
pop ebp
cmp eax, section..data
je 0x1002b389
test byte [eax + 0x1c], bl
je 0x1002b389
push esi
push 0x10238268
push 0x1c
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.1001c94b
add esp, 0x14
pop esi
pop ebx
add esp, 0xc
ret