Function at 0x102c60d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], ebx
je 0x102c699
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test byte [ebp + 0x10], 1
je 0x102c66a
cmp eax, 2
je 0x102c655
cmp eax, 3
jne 0x102c66a
cmp eax, ebx
jle 0x102c663
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x102c81e
cmp eax, ebx
je 0x102c69f
jle 0x102c67a
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0xc]
mov edi, eax
push 0x101986c
push 1
push edi
push 0x4000000
call fcn.0101e5b9
add esp, 0x14
jmp 0x102c81e
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x102c755
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.0101db19
mov edi, eax
cmp edi, ebx
jge 0x102c6c7
push 0x10199c4
push 1
push edi
jmp 0x102c716
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x102c728
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 1
je 0x102c79e
cmp dword [ebp - 0xc], 2
je 0x102c79e
push 0x101999c
mov eax, 0x8007000d
push 1
mov edi, eax
push eax
push 0x4000000
call fcn.0101e5b9
add esp, 0x10
jmp 0x102c81d
cmp eax, 0xea
je 0x102c6f3
test byte [ebp + 0x10], 1
je 0x102c73a
cmp eax, 2
je 0x102c776
cmp eax, ebx
jle 0x102c748
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x1019948
jmp 0x102c7f3
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test byte [ebp + 0x10], 1
je 0x102c780
cmp eax, 2
jne 0x102c780
mov edi, 0x80070002
jmp 0x102c81d
cmp eax, ebx
je 0x102c6f3
jle 0x102c794
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x10198f8
jmp 0x102c7f3
cmp dword [ebp - 0x14], ebx
jne 0x102c807
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
inc eax
push eax
push esi
mov dword [ebp - 0x10], eax
call fcn.0101dbdf
mov edi, eax
cmp edi, ebx
jge 0x102c7c4
push dword [ebp + 0x14]
push 0x10198c0
jmp 0x102c7f5
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x102c807
jle 0x102c7eb
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x101989c
mov edi, eax
push 1
push edi
push 0x4000000
call fcn.0101e5b9
add esp, 0x14
jmp 0x102c81d
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov word [eax + edx*2 - 4], cx
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
mov word [eax + edx*2 - 2], cx
pop esi
cmp dword [ebp + 0xc], ebx
je 0x102c831
cmp dword [ebp - 4], ebx
je 0x102c831
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0x14