Function at 0x1010a7f
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10352a0], 0
je 0x1010cb5
push ebx
push esi
push dword [ebp + 8]
call fcn.01010f1a
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
test ecx, ecx
je 0x1010aac
cmp word [ecx], bx
jne 0x1010ab1
mov ecx, 0x1006d58
push ecx
push eax
call fcn.010111ce
mov esi, eax
test esi, esi
je 0x1010ca8
push esi
call fcn.010109fa
test eax, eax
jne 0x1010ca3
push edi
lea eax, [ebp + 8]
push eax
push ebx
push 0x1006d5c
xor edi, edi
push esi
mov dword [ebp + 8], ebx
inc edi
mov dword [ebp - 4], ebx
call sub.MSVCR100.dll__swscanf_s_l
add esp, 0x10
push 4
pop ebx
cmp eax, edi
jne 0x1010aff
mov dword [ebp + 0xc], ebx
lea eax, [ebp + 8]
jmp 0x1010c2e
push ebx
push 0x1006d74
push ebx
push esi
call fcn.01010a24
push 3
pop edx
test al, al
je 0x1010b1a
mov ecx, ebx
mov dword [ebp + 0xc], edx
jmp 0x1010b6f
push ebx
push 0x1006d80
push ebx
push esi
call fcn.01010a24
test al, al
je 0x1010c55
lea ecx, [ebp - 8]
push ecx
xor ecx, ecx
push ecx
lea eax, [esi + 8]
push 0x1006d8c
push eax
call sub.MSVCR100.dll__swscanf_s_l
add esp, 0x10
cmp eax, 1
jne 0x1010c55
push 0x3a
pop eax
mov ecx, ebx
cmp word [esi + 8], ax
je 0x1010b62
inc ecx
cmp word [esi + ecx*2], ax
jne 0x1010b5b
mov edi, dword [ebp - 8]
mov dword [ebp + 0xc], edi
inc ecx
je 0x1010c55
mov edx, esi
lea edi, [edx + 2]
xor ebx, ebx
mov ax, word [edx]
add edx, 2
cmp ax, bx
jne 0x1010b76
sub edx, edi
sar edx, 1
sub edx, ecx
push 3
pop edi
mov eax, edx
xor edx, edx
div edi
lea edi, [esi + ecx*2]
xor ecx, ecx
mov dword [ebp + 0x10], ecx
lea ebx, [eax + 1]
lea eax, [ebp + 8]
push eax
push ecx
push 0x1006d98
push edi
mov dword [ebp - 0xc], ebx
call sub.MSVCR100.dll__swscanf_s_l
add esp, 0x10
cmp eax, 1
jne 0x1010c05
mov ebx, dword [ebp + 0x10]
push 0x2c
pop ecx
jmp 0x1010bc6
test ax, ax
je 0x1010bce
add edi, 2
movzx eax, word [edi]
cmp ax, cx
jne 0x1010bbe
mov al, byte [ebp + 8]
mov byte [ebx + esi], al
inc ebx
cmp word [edi], cx
jne 0x1010bdd
add edi, 2
xor ecx, ecx
cmp word [edi], cx
je 0x1010bff
lea eax, [ebp + 8]
push eax
push ecx
push 0x1006d98
push edi
call sub.MSVCR100.dll__swscanf_s_l
add esp, 0x10
push 0x2c
pop ecx
cmp eax, 1
je 0x1010bc6
mov dword [ebp + 0x10], ebx
mov ebx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
cmp ebx, eax
jne 0x1010c50
mov edx, dword [ebp + 0xc]
cmp edx, 1
je 0x1010c1e
cmp edx, 7
je 0x1010c1e
cmp edx, 2
jne 0x1010c2c
test bl, 1
jne 0x1010c50
add ebx, 2
xor ecx, ecx
mov word [eax + esi], cx
mov eax, esi
mov edi, dword [ebp + 0xc]
cmp dword [ebp + 0x18], 0
mov ecx, dword [ebp + 0x1c]
je 0x1010c7d
cmp dword [ecx], ebx
jb 0x1010c76
push ebx
push eax
push dword [ebp + 0x18]
call sub.MSVCR100.dll_memcpy
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
jmp 0x1010c7d
push 0xd
pop ebx
jmp 0x1010c8f
mov ebx, esi
lea ecx, [ebx + 2]
xor edx, edx
mov ax, word [ebx]
add ebx, 2
cmp ax, dx
jne 0x1010c5c
sub ebx, ecx
sar ebx, 1
lea ebx, [ebx*2 + 2]
mov eax, esi
jmp 0x1010c31
mov dword [ebp - 4], 0xea
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x1010c86
mov dword [eax], edi
test ecx, ecx
je 0x1010c8c
mov dword [ecx], ebx
mov ebx, dword [ebp - 4]
pop edi
push esi
xor eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1010cab
push 2
pop ebx
jmp 0x1010c90
push 8
pop ebx
push ebx
call fcn.01010cd6
pop esi
pop ebx
jmp 0x1010ccd
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
leave
ret 0x18