Function at 0x101b97a
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x10316ec
call fcn.01025710
sub esp, 0x27c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x1007168
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x14], esp
push 0
mov ebx, 0x200
push ebx
push 0x20d
mov edi, 0x1006b64
push edi
mov esi, 0x1006ad8
push esi
call fcn.0101170a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.01011772
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.01019341
mov byte [ebp - 4], 2
and dword [ebp - 0x3c], 0
mov byte [ebp - 4], 3
cmp dword [0x103c1c4], 0
jne 0x101bced
push 0x14
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x101ba0b
mov ecx, eax
call fcn.01019ad2
jmp 0x101ba0d
xor eax, eax
mov dword [ebp - 0x44], eax
mov byte [ebp - 4], 3
mov dword [0x103c1c4], eax
test eax, eax
jne 0x101ba4d
push 0x10064dc
push 0x8007000e
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x48], esp
push eax
push ebx
push 0x220
push edi
push esi
call fcn.0101170a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.01011923
add esp, 0x4c
push 0x10068f4
push 0x10068a8
push 0x1007158
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x248]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x101bad9
jle 0x101ba9f
and eax, 0xffff
or eax, 0x80070000
push 0x10068f4
push 0x10068a8
push 0x10070f8
push eax
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x250], esp
push 0
push ebx
push 0x22c
push edi
push esi
call fcn.0101170a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.010265d8
add esp, 0x54
and byte [ebp - 0x251], 0
and dword [ebp - 0x258], 0
cmp byte [ebp - 0x251], 0
jne 0x101bced
mov dword [ebp - 0x25c], 0x100
lea eax, [ebp - 0x264]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x258]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x101bb9e
cmp eax, 0x103
je 0x101bb92
test eax, eax
jle 0x101bb46
and eax, 0xffff
or eax, 0x80070000
push dword [ebp - 0x258]
lea ecx, [ebp - 0x248]
push ecx
push 0x10068f4
push 0x10068a8
push 0x10070b0
push eax
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x268], esp
push 0
push ebx
push 0x268
push edi
push esi
call fcn.0101170a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.010265d8
add esp, 0x5c
jmp 0x101bc44
mov byte [ebp - 0x251], 1
jmp 0x101bc44
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x3c]
call fcn.0101a8de
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x30], eax
test eax, eax
jge 0x101bbf7
push eax
lea eax, [ebp - 0x248]
push eax
push 0x1007040
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x270], esp
push 0
push ebx
push 0x24d
push edi
push esi
call fcn.0101170a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.01012a35
add esp, 0x50
jmp 0x101bc44
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [0x103c1c4]
add ecx, 4
call fcn.0101b415
test eax, eax
jne 0x101bc40
push 0x1006d48
push 0x8007000e
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x274], esp
push eax
push ebx
push 0x259
push edi
push esi
call fcn.0101170a
mov byte [ebp - 4], 3
lea eax, [ebp - 0x30]
push eax
call fcn.01011923
add esp, 0x4c
and dword [ebp - 0x38], 0
inc dword [ebp - 0x258]
jmp 0x101bae7
mov dword [ebp - 4], 2
xor eax, eax
cmp dword [ebp - 0x3c], eax
je 0x101bd04
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x101bd3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x1006fe0
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x284], esp
push 0
push ebx
push 0x275
push edi
push esi
call fcn.0101170a
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
call fcn.01011891
add esp, 0x4c
cmp dword [ebp - 0x30], 0
jge 0x101bd7e
call fcn.0101b60e
push dword [ebp - 0x30]
push 0x1006f78
push dword [ebp - 0x30]
sub esp, 0x40
mov ecx, esp
mov dword [ebp - 0x288], esp
push 0
push ebx
push 0x27c
push edi
push esi
call fcn.0101170a
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
call fcn.01011923
add esp, 0x50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x38]
call fcn.01019368
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.01011818
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret