Function at 0x1002d635
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x8c8]
sub esp, 0x948
mov eax, dword [0x1012c510]
xor eax, ebp
mov dword [ebp + 0x8c4], eax
push ebx
mov eax, dword [ebp + 0x8d0]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea edx, [ebp - 0x74]
push edx
lea edx, [ebp - 0x64]
push edx
xor esi, esi
push esi
mov ebx, 0x20019
push ebx
push esi
push esi
push esi
push ecx
push eax
call edi
test eax, eax
jne 0x1002d834
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push ebx
push esi
push esi
push esi
push str.DownloadInformation
push dword [ebp - 0x64]
call edi
test eax, eax
jne 0x1002d82b
push 0x40e
mov word [ebp - 0x5c], ax
lea eax, [ebp - 0x5a]
push esi
push eax
call fcn.100c1480
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push 0x10109300
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x410
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002d82b
lea eax, [ebp - 0x80]
push eax
push 2
push esi
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov dword [ebp - 0x70], eax
cmp eax, 0xffffffff
je 0x1002d82b
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push esi
push esi
push esi
push str.ContainsFiles
push dword [ebp - 0x64]
call edi
test eax, eax
jne 0x1002d822
push esi
push esi
push esi
push esi
mov word [ebp + 0x3b4], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x3b4]
push eax
push esi
push dword [ebp - 0x6c]
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x68], 0x410
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1002d819
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea eax, [ebp + 0x3b4]
push 0x5c
push eax
call fcn.100c3ac7
pop ecx
pop ecx
cmp eax, esi
je 0x1002d768
add eax, 2
jmp 0x1002d76e
lea eax, [ebp + 0x3b4]
push esi
push 0x7f
lea ecx, [ebp + 0x7c4]
push ecx
push str.RegisterServer
push eax
push dword [ebp - 0x70]
push esi
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
test eax, eax
je 0x1002d7da
lea eax, [ebp + 0x7c4]
push 0x10109ee8
push eax
call fcn.100c244d
pop ecx
pop ecx
test eax, eax
jne 0x1002d7da
lea eax, [ebp + 0x3b4]
push eax
call fcn.1001621a
mov edi, eax
cmp edi, esi
je 0x1002d7da
push 0x1010a448
push edi
call ebx
cmp eax, esi
je 0x1002d7c5
push 1
call eax
push 0x1010a464
push edi
call ebx
cmp eax, esi
je 0x1002d7d3
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x3e8
ja 0x1002d819
push esi
push esi
push esi
xor eax, eax
push esi
mov word [ebp + 0x3b4], ax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x3b4]
push eax
push dword [ebp - 0x60]
mov dword [ebp - 0x68], 0x410
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1002d74f
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x70]
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x8c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100bfae1
add ebp, 0x8c8
leave
ret