Function at 0x10082040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e86bc
mov eax, dword fs:[0]
push eax
sub esp, 0x25c
mov eax, dword [0x101401a0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov esi, ecx
mov dword [ebp - 0x25c], eax
call fcn.1008eaa0
test edi, edi
je 0x10082223
test ebx, ebx
je 0x10082223
mov eax, dword [ebp - 0x25c]
test eax, eax
je 0x10082223
cmp word [ebx], 0
je 0x10082223
cmp word [eax], 0
je 0x10082223
movzx eax, byte [ebp + 0x14]
neg eax
sbb eax, eax
and eax, 0x100
lea ecx, [ebp - 0x260]
push ecx
or eax, 1
push eax
push 0
push ebx
push edi
mov dword [ebp - 0x260], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test edi, edi
je 0x10082142
push 2
lea edx, [ebp - 0x238]
push edi
push edx
call fcn.1008b390
add esp, 0xc
cmp dword [ebp - 0x220], 8
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 4], 2
mov dword [esi + 4], edi
jae 0x10082119
lea ecx, [ebp - 0x234]
push ecx
lea eax, [esi + 8]
push str.RegOpenKeyEx_failed__s
push eax
call fcn.10086430
add esp, 0xc
lea ecx, [ebp - 0x238]
mov dword [ebp - 4], 0xffffffff
call fcn.100030e5
jmp 0x100822e5
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
mov dword [ebp - 0x268], 0x208
mov dword [ebp - 0x264], 1
call fcn.100ab9a0
add esp, 0xc
lea ecx, [ebp - 0x268]
push ecx
mov ecx, dword [ebp - 0x25c]
lea edx, [ebp - 0x218]
push edx
mov edx, dword [ebp - 0x260]
lea eax, [ebp - 0x264]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [ebp - 0x260]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x10082204
push 2
lea ecx, [ebp - 0x258]
push edi
push ecx
call fcn.1008b390
add esp, 0xc
cmp dword [ebp - 0x240], 8
mov ecx, dword [ebp - 0x254]
mov dword [ebp - 4], 3
mov dword [esi + 4], edi
jae 0x100821db
lea ecx, [ebp - 0x254]
push ecx
lea eax, [esi + 8]
push str.RegQueryValueEx_failed__s
push eax
call fcn.10086430
add esp, 0xc
lea ecx, [ebp - 0x258]
mov dword [ebp - 4], 0xffffffff
call fcn.100030e5
jmp 0x100822e5
push 0x3a
push 0x1012a734
push 0x1012c400
lea edx, [ebp - 0x218]
push edx
mov ecx, esi
call fcn.10081f10
jmp 0x100822e7
push str.invalid_parameter_hRootsubKeyvalueName
lea ecx, [ebp - 0x238]
mov dword [esi + 4], 0x57
call fcn.10005438
push 0xffffffffffffffff
xor edi, edi
push edi
lea eax, [ebp - 0x238]
lea ecx, [esi + 8]
push eax
mov dword [ebp - 4], edi
call fcn.1000304d
cmp dword [ebp - 0x220], 8
jb 0x10082269
mov ecx, dword [ebp - 0x234]
push ecx
call fcn.100a1c40
add esp, 4
xor edx, edx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], edi
mov word [ebp - 0x234], dx
mov dword [ebp - 4], 1
cmp dword [ebp - 0x238], edi
je 0x100822d6
push 3
lea ecx, [ebp - 0x25c]
call fcn.1007c350
mov eax, dword [ebp - 0x238]
cmp dword [eax + 4], edi
je 0x100822c2
lea esp, [esp]
mov ecx, dword [eax + 4]
mov dword [ecx], edi
mov edx, dword [eax + 4]
mov ecx, dword [edx + 4]
mov dword [eax + 4], ecx
cmp ecx, edi
jne 0x100822b0
mov edx, dword [ebp - 0x238]
lea ecx, [ebp - 0x25c]
mov dword [edx + 4], edi
call fcn.1007c390
mov eax, dword [ebp - 0x238]
push eax
call fcn.100a1c40
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100a1c30
mov esp, ebp
pop ebp
ret 0x10