Function at 0x100099a0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1003775b
push eax
mov eax, 0x18ac
mov dword fs:[0], esp
call fcn.10024bc0
mov eax, dword [esp + 0x18c0]
mov ecx, dword [eax]
push esi
push edi
push ecx
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], 0x1770
xor esi, esi
call fcn.1000b730
mov eax, dword [esp + 8]
mov dword [esp + 0x18bc], esi
mov ecx, 0x1003bb51
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009a13
test dl, dl
je 0x10009a0c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009a13
add eax, 2
add ecx, 2
test dl, dl
jne 0x100099f0
xor eax, eax
or edi, 0xffffffff
jmp 0x10009a1c
sbb eax, eax
mov edi, 0xffffffff
sbb eax, edi
xor edx, edx
test eax, eax
sete dl
mov eax, edx
test eax, eax
je 0x10009a6a
push str.0000
call fcn.10003360
mov ecx, dword [esp + 0x18d0]
mov dword [ecx], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x18bc], edi
lea edx, [eax + 0xc]
lock xadd dword [edx], edi
dec edi
test edi, edi
jg 0x10009a63
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x10009be1
lea ecx, [esp + 0xc]
push ecx
call fcn.100136a0
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x10009ac8
push 0x1003be28
call fcn.10003360
mov edx, dword [esp + 0x18d0]
mov dword [edx], eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
add esp, 4
mov dword [esp + 0x18bc], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009abe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 0x80004005
jmp 0x10009be1
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x148]
push edx
lea eax, [esp + 0x1c]
push eax
push 0
push str.hlpreg
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10009b36
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x18cc]
push eax
mov dword [edx], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
add eax, 0xfffffff0
mov dword [esp + 0x18bc], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009b2c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
jmp 0x10009be1
mov eax, 0x1b4e81b5
mul dword [esp + 0x10]
push ebp
mov ebp, edx
shr ebp, 5
test ebp, ebp
jle 0x10009b96
lea edi, [esp + 0x148]
mov ecx, dword [esp + 0xc]
mov eax, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x10009b76
test dl, dl
je 0x10009b72
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x10009b76
add eax, 2
add ecx, 2
test dl, dl
jne 0x10009b56
xor eax, eax
jmp 0x10009b7b
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
test eax, eax
jne 0x10009bfa
inc esi
add edi, 0x12c
cmp esi, ebp
jl 0x10009b50
or edi, 0xffffffff
push 0x1003be2c
call fcn.10003360
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18d4]
add esp, 4
push edx
mov dword [ecx], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18c0], edi
lea ecx, [eax + 0xc]
lock xadd dword [ecx], edi
dec edi
test edi, edi
jg 0x10009bdb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
pop ebp
mov ecx, dword [esp + 0x18b4]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x18b8
ret 0xc
imul esi, esi, 0x12c
push 0x12b
lea edx, [esp + 0x21]
push 0
push edx
lea esi, [esp + esi + 0x154]
mov byte [esp + 0x28], 0
call fcn.10023f90
add esi, 0x32
push esi
push 0x1003bf10
push str.__result__:___s_:__s__
lea eax, [esp + 0x34]
push 0x12c
push eax
call fcn.10023f6f
lea ecx, [esp + 0x3c]
push ecx
call fcn.100250f2
push eax
call fcn.10003360
mov edx, dword [esp + 0x18f8]
mov dword [edx], eax
mov eax, dword [esp + 0x38]
add esp, 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x18c0], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x10009c8c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x10009be0