Function at 0x100a4f4
Capabilities:
Query or enumerate registry value

Disassembly:
mov dword [ebp - 0x1c], edi
jmp 0x100a763
mov dword [ebp - 0x1c], 0xb
jmp 0x100a763
inc esi
inc esi
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x20], edi
je 0x100a4c5
push dword [ebp - 0x20]
call fcn.010399ae
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x28], edi
je 0x100a4d5
push dword [ebp - 0x28]
call fcn.010399ae
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x24], edi
je 0x100a5c1
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov dword [ebp - 0x24], edi
jmp 0x100a5c1
push 0x38
push 0x100a690
call fcn.010015a0
xor edi, edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 4], edi
lea eax, [ebp - 0x2c]
push eax
push 1
push edi
push 0x100a620
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x100a763
lea eax, [ebp - 0x34]
push eax
push edi
lea eax, [ebp - 0x38]
push eax
push edi
mov esi, 0x100a600
push esi
push dword [ebp - 0x2c]
mov ebx, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
call ebx
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x100a763
push dword [ebp - 0x34]
call fcn.0103a4f1
mov dword [ebp - 0x30], eax
cmp eax, edi
je 0x100a763
lea eax, [ebp - 0x34]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x38]
push eax
push edi
push esi
push dword [ebp - 0x2c]
call ebx
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x100a763
cmp dword [ebp - 0x38], 1
jne 0x100a354
mov eax, dword [ebp - 0x34]
cmp eax, 2
jb 0x100a354
shr eax, 1
mov ecx, dword [ebp - 0x30]
cmp word [ecx + eax*2 - 2], di
jne 0x100a354
mov dword [ebp - 0x3c], ecx
mov esi, dword [ebp - 0x3c]
movzx eax, word [esi]
cmp ax, di
je 0x100a34c
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], edi
cmp ax, 0x2c
je 0x100a4b0
mov ebx, esi
movzx eax, word [esi]
cmp ax, di
je 0x100a6ac
cmp ax, 0x2c
je 0x100a6ac
inc esi
inc esi
mov dword [ebp - 0x3c], esi
jmp 0x100a5e2
sub esi, ebx
sar esi, 1
je 0x100a4b5
lea eax, [esi + esi + 2]
push eax
call fcn.0103a4f1
mov dword [ebp - 0x20], eax
cmp eax, edi
je 0x1024715
push ebx
lea ecx, [esi + 1]
push ecx
push eax
call fcn.0100a315
lea eax, [esi + esi + 0x66]
push eax
call fcn.0103a4f1
mov ebx, eax
mov dword [ebp - 0x28], ebx
cmp ebx, edi
je 0x1024715
add esi, 0x33
push 0x100a7b0
push esi
push ebx
call fcn.0100a315
push dword [ebp - 0x20]
push esi
push ebx
call fcn.0100a7fb
push 0x100a78c
push esi
push ebx
call fcn.0100a7fb
lea eax, [ebp - 0x24]
push eax
xor esi, esi
inc esi
push esi
push edi
push ebx
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
jne 0x100a763
push 4
pop ebx
mov dword [ebp - 0x44], ebx
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
push edi
push 0x100a780
push dword [ebp - 0x24]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], eax
cmp eax, edi
je 0x1024721
cmp eax, 2
je 0x100a4b5
mov dword [ebp - 4], 0xfffffffe
call fcn.0100a365
xor eax, eax
cmp dword [ebp - 0x40], edi
sete al
call fcn.01001580
ret
mov dword [ebp - 0x1c], 8
jmp 0x100a763
cmp dword [ebp - 0x38], ebx
jne 0x100a354
test byte [ebp - 0x48], 2
je 0x100a4b5
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], esi
jmp 0x100a763