Function at 0x102557b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102fa80]
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], eax
push edi
xor eax, eax
inc eax
mov dword [esi + 0x22c], eax
mov dword [esi + 0x230], eax
mov dword [esi + 0x1d4], eax
lea eax, [ebp - 0x118]
push eax
xor edi, edi
lea eax, [ebp - 0x110]
push eax
push edi
push 0x20019
push edi
push 0x1001b84
push edi
push str.SoftwareMicrosoftWindows_NTCurrentVersionTerminal_ServerTSADMIN
lea ebx, [esi + 0x12c]
or dword [ebx], 0xffffffff
push 0x80000001
mov dword [esi + 0x234], 0x1388
mov dword [esi + 0x238], 0x3e8
mov dword [esi + 0x1d8], edi
mov dword [esi + 0x1dc], 0x6a
mov dword [esi + 0x1e0], 2
mov dword [esi + 0x1e4], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10258be
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x114]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push str.Placement
push dword [ebp - 0x110]
mov dword [ebp - 0x108], 0x100
call edi
test eax, eax
jne 0x10256b8
cmp word [ebp - 0x104], ax
je 0x10256b8
lea eax, [esi + 0x130]
push eax
push ebx
lea eax, [esi + 0x128]
push eax
lea eax, [esi + 0x124]
push eax
lea eax, [esi + 0x120]
push eax
lea eax, [esi + 0x11c]
push eax
lea eax, [esi + 0x118]
push eax
lea eax, [esi + 0x114]
push eax
lea eax, [esi + 0x110]
push eax
lea eax, [esi + 0x10c]
push eax
lea eax, [ebp - 0x104]
push str._u__u__d__d__d__d__d__d__d__d
push eax
call dword [sym.imp.msvcrt.dll_swscanf]
add esp, 0x30
cmp eax, 0xa
je 0x10256bb
or dword [ebx], 0xffffffff
or dword [esi + 0x108], 0xffffffff
push 4
pop ebx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.Confirmation
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x10256ff
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x22c], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.SaveSettingsOnExit
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x1025739
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x230], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.ShowSystemProcesses
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x1025773
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x1d4], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.ListRefreshTime
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x10257ad
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x234], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.StatusRefreshTime
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x10257e7
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x238], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.ShadowHotkeyKey
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x1025821
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x1dc], eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.ShadowHotkeyShift
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x102585b
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x1e0], eax
cmp dword [esi + 0x1dc], 0x1b
jne 0x1025878
mov dword [esi + 0x1dc], 0x6a
mov dword [esi + 0x1e0], 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.TreeWidth
push dword [ebp - 0x110]
mov dword [ebp - 0x108], ebx
call edi
test eax, eax
jne 0x10258b2
mov eax, dword [ebp - 0x10c]
mov dword [esi + 0x1e4], eax
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01027cb3
leave
ret