Function at 0x1002462
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2f8
mov eax, dword [0x100b080]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x2b8], esi
mov dword [ebp - 0x2c4], eax
mov dword [ebp - 0x2ac], 1
call fcn.010021be
push 0x100126c
push eax
mov dword [ebp - 0x2c0], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x2a4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor edi, edi
cmp eax, 0xffffffff
mov dword [ebp - 0x2b4], eax
jne 0x10022e5
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
je 0x10023e2
call esi
cmp eax, 3
je 0x10023e2
mov dword [ebp - 0x2ac], edi
jmp 0x10023e2
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push dword [ebp - 0x2b8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
push 0x1001260
mov dword [ebp - 0x2b0], eax
call esi
mov ecx, dword [ebp - 0x2b0]
add ecx, eax
lea eax, [ebp - 0x278]
push eax
mov dword [ebp - 0x2b0], ecx
call esi
mov ecx, dword [ebp - 0x2b0]
lea eax, [ecx + eax + 1]
cmp eax, 0x208
jge 0x1002562
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x2c0]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
test byte [ebp - 0x2a4], 0x10
je 0x1002414
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push 0x100125c
lea eax, [ebp - 0x278]
push eax
call esi
test eax, eax
je 0x1002562
push 0x1001254
lea eax, [ebp - 0x278]
push eax
call esi
test eax, eax
je 0x1002562
mov esi, dword [ebp - 0x2c4]
cmp esi, edi
je 0x10023b6
jmp 0x10023b1
push dword [ebp - 0x2b8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1002562
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], di
jne 0x1002391
push dword [ebp - 0x2c4]
push dword [ebp - 0x2a8]
push dword [ebp - 0x2bc]
push dword [ebp - 0x2b8]
call fcn.01002248
test eax, eax
jne 0x1002562
mov dword [ebp - 0x2ac], edi
pop ebx
cmp dword [ebp - 0x2b4], 0xffffffff
mov eax, dword [ebp - 0x2c0]
mov word [eax], di
pop edi
pop esi
je 0x1002402
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x2ac]
call fcn.010039ea
leave
ret 0x10
mov eax, dword [ebp - 0x284]
add dword [0x100ba0c], eax
cmp dword [ebp - 0x2a8], edi
je 0x1002562
lea eax, [ebp - 0x278]
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 6
jl 0x1002477
push 6
lea eax, [ebp - 0x278]
push eax
push 6
push 0x1001244
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x1002477
xor eax, eax
cmp dword [0x100ba04], edi
setne al
mov esi, eax
cmp esi, edi
je 0x1002562
cmp dword [0x100bd14], edi
mov eax, dword [ebp - 0x284]
je 0x100248e
cmp eax, 0x800
ja 0x100248e
xor esi, esi
cmp esi, edi
je 0x1002562
mov ecx, dword [ebp - 0x2bc]
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 0x2f8]
push eax
push edi
push 0x104d
push dword [ebp - 0x2a8]
mov dword [ebp - 0x2f8], 0xd
mov dword [ebp - 0x2f4], edi
mov dword [ebp - 0x2f0], edi
mov dword [ebp - 0x2ec], edi
mov dword [ebp - 0x2e8], 3
mov dword [ebp - 0x2e4], ecx
call ebx
mov esi, eax
mov eax, dword [ebp - 0x284]
cmp eax, 0x400
ja 0x10024f7
xor eax, eax
inc eax
jmp 0x10024fa
shr eax, 0xa
push eax
push 0x100bc80
lea eax, [ebp - 0x54]
push 0x28
push eax
call fcn.01003d93
lea eax, [ebp - 0x54]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x284]
add esp, 0x10
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 0x2f8]
push eax
push edi
push 0x104c
push dword [ebp - 0x2a8]
mov dword [ebp - 0x2f8], 9
mov dword [ebp - 0x2f4], esi
mov dword [ebp - 0x2f0], 1
mov dword [ebp - 0x2ec], edi
mov dword [ebp - 0x2e8], 3
call ebx
lea eax, [ebp - 0x2a4]
push eax
push dword [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10022ec
jmp 0x10023e1