Function at 0x10002f20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1ac
mov eax, dword [0x10053008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10054020], 0
push esi
jne 0x100030f7
push str.SoftwareBiometric_CenterID_Center_
lea eax, [ebp - 0x188]
mov dword [ebp - 0x1a8], 0
push str._sIDC_Log_Manager
push eax
mov dword [ebp - 0x1ac], 0
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1a8]
add esp, 0xc
push eax
push 0x201
push 0
lea eax, [ebp - 0x188]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x100030f7
lea eax, [ebp - 0x1ac]
push eax
push 0x201
push 0
push str.SOFTWAREBiometric_CenterID_CenterIDC_SmartCard_ConnectorMada
push 0x80000002
call esi
test eax, eax
jne 0x100030f7
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x19c], eax
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x1a4], 0x104
push eax
lea eax, [ebp - 0x19c]
push eax
push 0
push str.LoggingOn
push dword [ebp - 0x1ac]
call esi
test eax, eax
jne 0x10003044
cmp dword [ebp - 0x19c], 4
mov dword [0x10054020], 1
jne 0x100030e1
movzx eax, byte [ebp - 0x107]
movzx ecx, byte [ebp - 0x108]
add ecx, eax
movzx eax, byte [ebp - 0x106]
add ecx, eax
movzx eax, byte [ebp - 0x105]
add ecx, eax
je 0x100030e1
mov dword [0x10054020], 2
jmp 0x10003051
cmp dword [0x10054020], 2
jne 0x100030e1
lea eax, [ebp - 0x1a4]
mov dword [ebp - 0x1a4], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x19c]
push eax
push 0
push str.LogPath
push dword [ebp - 0x1a8]
call esi
test eax, eax
jne 0x100030e1
cmp dword [ebp - 0x19c], 1
jne 0x100030e1
push eax
call fcn.10021508
mov dword [ebp - 0x190], eax
lea eax, [ebp - 0x190]
push eax
mov dword [ebp - 0x18c], edx
call fcn.1002118e
push dword [eax]
mov ecx, dword [eax + 0x10]
push dword [eax + 4]
inc ecx
push dword [eax + 8]
push dword [eax + 0xc]
mov eax, dword [eax + 0x14]
push ecx
add eax, 0x76c
push eax
lea eax, [ebp - 0x108]
push eax
push str._sMada_04d_02d_02d__02d_02d_02d.log
push 0x104
push 0x10053e18
call fcn.100033e0
add esp, 0x30
push dword [ebp - 0x1a8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x1ac]
call esi
cmp dword [0x10054020], 1
je 0x100031d4
push 0x1004862c
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x1a0], 0
push 0x10053e18
push eax
call fcn.1000ec8e
add esp, 0xc
test eax, eax
jne 0x100031c1
push 0x800
call fcn.10003502
add esp, 4
mov esi, eax
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
push 0x400
push esi
call fcn.100033a0
push dword [eax + 4]
push dword [eax]
call fcn.100203fe
add esp, 0x1c
lea eax, [ebp - 0x198]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
movzx eax, word [ebp - 0x18a]
push eax
movzx eax, word [ebp - 0x18c]
push eax
movzx eax, word [ebp - 0x18e]
push eax
movzx eax, word [ebp - 0x190]
push eax
push str._02d:_02d:_02d._03d:__04d:_04d:__s_n
push dword [ebp - 0x1a0]
call fcn.100033b0
push dword [ebp - 0x1a0]
call fcn.10020b5f
push 2
push esi
call fcn.100034f4
add esp, 0x30
mov eax, dword [ebp - 0x1a0]
test eax, eax
je 0x100031d4
push eax
call fcn.100204f2
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100034e6
mov esp, ebp
pop ebp
ret