Function at 0x1002b4f1
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x10057f0c
call fcn.10056dd0
sub esp, 0x40
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], ecx
je 0x1002b54f
cmp byte [ebp + 0x18], 0
je 0x1002b52b
push 0x26c3
push 0x514
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x1002b70a
lea eax, [ebp + 0x27]
mov byte [ebp + 0x27], 0
push eax
push ecx
push 0x7c92
push ecx
push ecx
mov edx, 0x21ab
mov cl, 1
call fcn.1002a169
add esp, 0x14
jmp 0x1002b70a
mov dword [ebp - 0x28], 0x35d7
xor esi, esi
cmp dword [ebp - 0x28], 0x3802
jle 0x1002b5b6
mov edi, esi
mov ebx, esi
mov eax, edi
lea ecx, [ebp - 0x4c]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002b581
mov eax, dword [eax]
push eax
call fcn.10040493
pop ecx
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.1000c5c5
inc ebx
cmp ebx, 0x6906
jl 0x1002b565
inc edi
cmp edi, 0x3ac7
jl 0x1002b563
push esi
push esi
push 0xb8e
push esi
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp byte [ebp + 0x14], 0
je 0x1002b5df
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x1002b6f6
push esi
push esi
push esi
push esi
push esi
push esi
push 0x19a9
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1002b6f6
mov dword [ebp - 0x24], 0x1c11
mov edi, 0x10070c18
cmp dword [ebp - 0x24], 0x1c31
jle 0x1002b65e
mov ebx, esi
mov dword [ebp - 0x20], ebx
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, ebx
mov dword [ebp - 0x18], esi
cdq
idiv ecx
mov eax, esi
mov ecx, edx
mov dword [ebp - 0x2c], ecx
mov ebx, esi
mov esi, ecx
mov ecx, eax
shl esi, cl
mov eax, esi
mov ecx, edi
and eax, ebx
cdq
push edx
push eax
call fcn.1000bb2c
inc ebx
cmp ebx, 0x78e1
jl 0x1002b615
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x18], eax
push 0
pop esi
cmp eax, 0x1830
jl 0x1002b60d
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x595b
jl 0x1002b5fe
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x6f69
jl 0x1002b5f9
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x1a5d
jge 0x1002b676
mov edx, str.ogu_rkovqyd_ftoq_fjmbev_apzban
mov ecx, edi
call fcn.1000e878
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x2cac
cmp dword [ebp - 0x24], 0x2f9a
jle 0x1002b6b2
mov ebx, esi
mov dword [ebp + 0x24], esi
mov eax, esi
mov ecx, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.1000bb2c
inc esi
cmp esi, 0x3a59
jl 0x1002b68f
inc ebx
push 0
pop esi
cmp ebx, 0x403e
jl 0x1002b68c
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x2bf5
jge 0x1002b6ce
mov edx, str.zsbll_fhzzcxcy_iqffjqi
mov ecx, edi
call fcn.1000e878
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp + 0xc]
push dword [eax]
mov eax, dword [ebp + 0x10]
mov edx, dword [edx]
mov ecx, dword [ecx]
push dword [eax]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp + 0x1c]
push dword [eax]
call fcn.100296c2
add esp, 0x10
cmp dword [ebp - 0x28], 0x3533
jge 0x1002b70a
push str.dzzx_zdykxyoa_degs_kccwu_zqpm_ajtkbtx_katljx_oyyvx_fsfbvju_lkf
call fcn.10040493
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret