Function at 0x10098c40
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a7e11
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [esp + 0x74]
xor ebx, ebx
cmp esi, ebx
jne 0x10098c79
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
add esp, 0x64
ret 0x10
mov edx, dword [esp + 0x7c]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [eax]
lea eax, [esp + 0x78]
push ecx
push eax
mov ecx, edx
call fcn.10099640
mov eax, dword [esp + 0x78]
cmp eax, ebx
jle 0x10098e8c
push ebp
push edi
mov ebp, esi
mov dword [esp + 0x7c], eax
mov eax, dword [ebp + 4]
mov esi, dword [ebp]
xor edx, edx
dec eax
mov edi, edx
mov dword [esp + 0x30], ebx
mov ecx, edx
mov dword [esp + 0x34], edi
mov dword [esp + 0x3c], edx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x40], edx
je 0x10098d14
dec eax
je 0x10098cee
sub eax, 2
jne 0x10098d38
push 4
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov ecx, 4
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], ecx
jmp 0x10098d38
push 0x104
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov ecx, 0x104
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], 2
jmp 0x10098d38
push 0x104
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
mov ecx, 0x104
add esp, 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], 1
mov edx, ecx
xor eax, eax
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x3c], eax
push ecx
mov ecx, dword [esp + 0x7c]
lea eax, [esp + 0x34]
push edx
push eax
push ebx
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x10098d89
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x34]
cmp eax, ebx
je 0x10098d89
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov dword [esp + 0x34], ebx
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dl, byte [esp + 0x84]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x20], dl
push ecx
push esi
lea ecx, [esp + 0x28]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
call dword [sym.imp.MSVCP60.dll_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const___unsigned_int_]
lea eax, [esp + 0x20]
lea ecx, [esp + 0x44]
push eax
mov dword [esp + 0x74], ebx
call dword [sym.imp.MSVCP60.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const__]
mov ecx, 5
lea esi, [esp + 0x30]
lea edi, [esp + 0x54]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x44]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov byte [esp + 0x78], 1
call fcn.10099940
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
lea ecx, [esp + 0x20]
call fcn.1009a340
mov esi, dword [esp + 0x18]
push 1
lea ecx, [esp + 0x48]
mov byte [esp + 0x74], bl
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov edx, dword [esp + 0x40]
mov dword [esp + 0x70], 0xffffffff
mov dword [esi + 0x2c], edx
mov eax, dword [esp + 0x3c]
mov dword [esi + 0x28], eax
mov ecx, dword [esp + 0x38]
mov dword [esi + 0x24], ecx
mov edx, dword [esp + 0x34]
mov dword [esi + 0x20], edx
mov eax, dword [esp + 0x30]
mov dword [esi + 0x1c], eax
mov eax, dword [esp + 0x24]
cmp eax, ebx
je 0x10098e6c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x10098e63
cmp al, 0xff
je 0x10098e63
dec al
mov byte [ecx], al
jmp 0x10098e6c
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x7c]
add ebp, 8
dec eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x7c], eax
jne 0x10098ca4
pop edi
pop ebp
mov ecx, dword [esp + 0x60]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x64
ret 0x10