Function at 0x101ae0c4
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x4b4
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x4b0], eax
mov eax, dword [esp + 0x4b8]
push ebx
push ebp
push esi
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x4cc]
push edi
mov dword [esp + 0x34], eax
lea eax, [esp + 0x28]
push eax
push 0x10026954
push SysReAllocString
xor ebx, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x101ae117
mov eax, 0x8002801c
jmp 0x101ae39c
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0x38], eax
push 0x40
lea ecx, [esp + 0x7c]
push ecx
push eax
push dword [esp + 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x101ae394
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x7c]
push eax
push dword [esp + 0x30]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x101ae38f
xor esi, esi
jmp 0x101ae365
push 0xa
lea eax, [esp + 0x54]
push eax
push esi
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x101ae377
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x54]
push eax
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x101ae372
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x4d0]
push dword [esp + 0x1c]
call fcn.10026cae
mov ebx, eax
test ebx, ebx
js 0x101ae35c
push 0x10
push 0xa
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x3c]
call dword [sym.imp.msvcr100.dll__ultoa_s]
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x60]
push eax
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x101ae35e
and dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x6c]
push eax
push 0x101ae3b8
push dword [esp + 0x20]
mov dword [esp + 0x20], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x101ae223
lea eax, [esp + 0x68]
push eax
call dword [sym.imp.msvcr100.dll_atoi]
movzx eax, ax
pop ecx
mov dword [esp + 0x18], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0xbc]
push eax
push 0x1001b984
push dword [esp + 0x20]
mov dword [esp + 0x20], 0x200
call fcn.10026bfd
cmp dword [esp + 0x10], 0
jne 0x101ae268
push 0x1001b984
lea eax, [esp + 0xbc]
push 0x100
push eax
call dword [sym.imp.msvcr100.dll_wcscpy_s]
add esp, 0xc
test byte [esp + 0x18], 7
jne 0x101ae354
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0x18], 0x208
call fcn.101fbf6a
push 0x10
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x58]
push eax
call dword [sym.imp.msvcr100.dll_strtoul]
movzx eax, ax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x30]
add esp, 0xc
cmp byte [eax], 0x2e
jne 0x101ae354
push 0x10
lea ecx, [esp + 0x28]
inc eax
push ecx
push eax
mov dword [esp + 0x30], eax
call dword [sym.imp.msvcr100.dll_strtoul]
add esp, 0xc
push 0
movzx edi, ax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c0]
push eax
push 0x10026d48
push dword [esp + 0x2c]
call fcn.1015692e
test eax, eax
jne 0x101ae2f3
push dword [esp + 0x3c]
jmp 0x101ae31c
cmp eax, 0x8002801c
jne 0x101ae354
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x2c0]
push eax
push 0x1014d504
push dword [esp + 0x2c]
call fcn.1015692e
test eax, eax
jne 0x101ae354
push eax
push eax
push eax
push eax
lea eax, [esp + 0xc8]
push eax
push dword [esp + 0x44]
lea esi, [esp + 0x58]
push edi
push dword [esp + 0x34]
lea eax, [esp + 0x2d8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 2
movsd dword es:[edi], dword [esi]
push eax
push dword [esp + 0x6c]
movsd dword es:[edi], dword [esi]
call fcn.101ad8cf
mov esi, dword [esp + 0x2c]
push dword [esp + 0x1c]
call ebp
jmp 0x101ae35e
xor ebx, ebx
push dword [esp + 0x14]
call ebp
inc esi
mov dword [esp + 0x2c], esi
test ebx, ebx
js 0x101ae377
jmp 0x101ae160
mov ebx, 0x8002801c
push dword [esp + 0x20]
call ebp
mov eax, dword [esp + 0x38]
inc eax
mov dword [esp + 0x38], eax
test ebx, ebx
js 0x101ae394
jmp 0x101ae123
mov ebx, 0x8002801c
push dword [esp + 0x28]
call ebp
mov eax, ebx
mov ecx, dword [esp + 0x4c0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x4b4
ret 0xc