Function at 0x1015c6c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x103e210
call fcn.0103cb58
sub esp, 0x448
mov eax, dword [0x104a0fc]
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
xor esi, esi
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x420], esi
lea eax, [ebp - 0x424]
push eax
push 1
push esi
push 0x1002e1c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1015f43
mov dword [ebp - 0x41c], 0x400
mov dword [ebp - 0x418], esi
mov ecx, 0xff
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x1002868
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x1002e0c
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1015d5e
cmp dword [ebp - 0x420], 1
jne 0x1015e96
mov eax, dword [ebp - 0x41c]
shr eax, 1
mov word [ebp + eax*2 - 0x418], si
push 0x1002e08
lea eax, [ebp - 0x418]
push eax
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
call edi
pop ecx
pop ecx
test eax, eax
jne 0x1015e76
mov dword [ebx], 1
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x41c], 0x400
lea eax, [ebp - 0x41c]
push eax
push esi
lea eax, [ebp - 0x420]
push eax
push esi
push 0x1002de4
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1015ed0
cmp dword [ebp - 0x420], 1
jne 0x1015f7b
mov eax, dword [ebp - 0x41c]
inc eax
shr eax, 1
shl eax, 1
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov edi, eax
mov dword [ebp - 0x454], edi
mov dword [ebp - 0x428], edi
cmp edi, esi
je 0x1015ed0
lea eax, [ebp - 0x41c]
push eax
push edi
lea eax, [ebp - 0x420]
push eax
push esi
push 0x1002de4
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1015ed0
cmp dword [ebp - 0x420], 1
jne 0x1015f5e
mov eax, dword [ebp - 0x41c]
shr eax, 1
mov word [ebp + eax*2 - 0x418], si
mov eax, dword [ebx + 4]
cmp eax, esi
je 0x1015e29
mov dword [ebp - 0x440], eax
push eax
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebx + 4], esi
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x448], eax
mov dword [ebx + 4], eax
push edi
cmp eax, esi
jne 0x1015eb6
mov dword [ebp - 0x450], edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x438], 0xbbef
mov dword [esp], 0x10421cc
lea eax, [ebp - 0x438]
jmp 0x1015fb3
push 0x1002de0
lea eax, [ebp - 0x418]
push eax
call edi
pop ecx
pop ecx
neg eax
sbb eax, eax
and eax, 0xfffffffe
inc eax
inc eax
mov dword [ebx], eax
jmp 0x1015d5e
push 0xd
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x430], esi
push 0x1042c20
lea eax, [ebp - 0x430]
jmp 0x1015fb3
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov dword [ebp - 0x444], edi
push edi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x41c], 0x400
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x420]
push eax
push esi
push 0x1002dbc
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1015f37
cmp dword [ebp - 0x420], 1
jne 0x1015f98
mov eax, dword [ebp - 0x41c]
shr eax, 1
mov word [ebp + eax*2 - 0x418], si
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.msvcrt.dll__wtol]
pop ecx
cdq
mov dword [ebx + 0x18], eax
mov dword [ebx + 0x1c], edx
push dword [ebp - 0x424]
call dword [entry0]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x14]
call fcn.0103c70f
pop edi
pop esi
pop ebx
leave
ret
push 0xd
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x43c], esi
push 0x1042c20
lea eax, [ebp - 0x43c]
jmp 0x1015fb3
push 0xd
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x42c], esi
push 0x1042c20
lea eax, [ebp - 0x42c]
jmp 0x1015fb3
push 0xd
pop esi
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x434], esi
push 0x1042c20
lea eax, [ebp - 0x434]
push eax
call sub.msvcrt.dll__CxxThrowException
mov eax, dword [ebp - 0x44c]
push dword [eax + 4]
call fcn.0103c827
mov eax, 0x1015f43
ret