Function at 0x10093fa
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x568
mov eax, dword [0x101803c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x550], esi
mov eax, esi
test esi, esi
jne 0x1009426
mov eax, 0x10017b0
push eax
push 0x10030d0
call fcn.0100d383
and dword [ebp - 0x54c], 0
push esi
push 0x1003098
mov esi, 0x104
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.0100742b
add esp, 0x18
lea ecx, [ebp - 0x54c]
call fcn.01005bd9
push eax
mov ebx, 0x20019
push ebx
push 0
lea eax, [ebp - 0x130]
push eax
mov edi, 0x80000002
push edi
call fcn.01005c13
add esp, 0x14
test eax, eax
jne 0x10094f5
lea eax, [ebp - 0x55c]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x568]
push eax
push 0
push 0x1003088
push dword [ebp - 0x54c]
mov dword [ebp - 0x55c], 0x103
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10094f5
push dword [ebp + 0xc]
mov byte [ebp - 0x339], al
lea eax, [ebp - 0x43c]
push eax
mov dword [ebp - 0x55c], 0x103
call fcn.01007db7
pop ecx
pop ecx
mov bl, al
lea ecx, [ebp - 0x54c]
call fcn.01005bf7
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.0100d419
leave
ret
push 0x28
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x550]
call fcn.01006304
lea eax, [ebp - 0x2c]
push eax
push 0x1003040
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.0100742b
add esp, 0x1c
lea ecx, [ebp - 0x54c]
call fcn.01005bd9
push eax
push ebx
push 0
lea eax, [ebp - 0x130]
push eax
push edi
call fcn.01005c13
add esp, 0x14
test eax, eax
jne 0x100961b
lea ecx, [ebp - 0x558]
push ecx
lea ecx, [ebp - 0x338]
push ecx
lea ecx, [ebp - 0x564]
push ecx
push eax
lea ecx, [ebp - 0x554]
push ecx
lea ecx, [ebp - 0x548]
push ecx
mov dword [ebp - 0x550], eax
push eax
jmp 0x10095bd
push dword [ebp + 0xc]
inc dword [ebp - 0x550]
lea eax, [ebp - 0x338]
push eax
call fcn.01007db7
pop ecx
pop ecx
test al, al
je 0x10096dc
lea eax, [ebp - 0x558]
push eax
lea eax, [ebp - 0x338]
push eax
lea eax, [ebp - 0x564]
push eax
push 0
lea eax, [ebp - 0x554]
push eax
lea eax, [ebp - 0x548]
push eax
push dword [ebp - 0x550]
push dword [ebp - 0x54c]
mov dword [ebp - 0x558], esi
mov dword [ebp - 0x554], 0x10a
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x1009573
lea ecx, [ebp - 0x54c]
call fcn.01005bd9
push eax
push ebx
push 0
push 0x1002ff8
push edi
call fcn.01005c13
add esp, 0x14
test eax, eax
jne 0x100961b
push dword [ebp + 0xc]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x54c]
call fcn.010065a8
add esp, 0xc
test eax, eax
je 0x10096dc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x550]
push eax
call fcn.01007b66
pop ecx
push eax
push 0x1002f98
lea eax, [ebp - 0x130]
push esi
push eax
call fcn.0100742b
xor esi, esi
add esp, 0x14
cmp dword [ebp - 0x550], esi
jne 0x10096dc
lea ecx, [ebp - 0x54c]
call fcn.01005bd9
push eax
push ebx
push esi
lea eax, [ebp - 0x130]
push eax
push edi
call fcn.01005c13
xor ebx, ebx
add esp, 0x14
inc ebx
test eax, eax
jne 0x10094d9
lea eax, [ebp - 0x550]
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x560]
push eax
push esi
push 0x1003088
push dword [ebp - 0x54c]
mov edi, 0x103
mov dword [ebp - 0x550], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10096dc
cmp dword [ebp - 0x560], ebx
jne 0x10096dc
push dword [ebp + 0xc]
mov byte [ebp - 0x131], al
lea eax, [ebp - 0x234]
push eax
mov dword [ebp - 0x550], edi
call fcn.01007db7
pop ecx
pop ecx
test al, al
jne 0x10094d9
xor bl, bl
jmp 0x10094d9