Function at 0xc29dccc
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xecc
mov eax, dword [0xc2b2728]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor edi, edi
xor esi, esi
inc edi
mov dword [ebp - 0xec4], 0x50
mov dword [ebp - 0xeb0], edi
mov dword [ebp - 0xeb4], esi
cmp dword [0xc2b2790], esi
jne 0xc29dfcb
lea eax, [ebp - 0xeb8]
push eax
push 0x20019
push esi
push 0xc281910
push 0x80000002
call fcn.0c285b00
test eax, eax
jne 0xc29dfcb
push ebx
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xeac]
push eax
lea eax, [ebp - 0x6a4]
push eax
push esi
push dword [ebp - 0xeb8]
mov dword [ebp - 0xeac], 0x200
call fcn.0c285c90
mov ebx, 0x103
mov dword [ebp - 0xec0], edi
cmp eax, ebx
je 0xc29dfbe
push 4
pop edi
cmp eax, esi
je 0xc29dd7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xc29df83
lea eax, [ebp - 0xea8]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x6a4]
push eax
push dword [ebp - 0xeb8]
call fcn.0c285b00
test eax, eax
jne 0xc29dd71
lea eax, [ebp - 0xeac]
push eax
push esi
lea eax, [ebp - 0xeb0]
push eax
push esi
push 0xc2814a4
push dword [ebp - 0xea8]
call fcn.0c285b76
test eax, eax
jne 0xc29ddca
or dword [ebp - 0xeb4], 2
lea eax, [ebp - 0xeac]
push eax
lea eax, [ebp - 0xea4]
push eax
lea eax, [ebp - 0xeb0]
push eax
push esi
push 0xc281498
push dword [ebp - 0xea8]
mov dword [ebp - 0xeac], 0x400
call fcn.0c285b76
test eax, eax
je 0xc29de09
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0xc29df77
lea eax, [ebp - 0xeac]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0xeb0]
push eax
push esi
push 0xc2818fc
push dword [ebp - 0xea8]
mov dword [ebp - 0xeac], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xc29de9b
or dword [ebp - 0xeb4], 1
lea eax, [ebp - 0xeac]
push eax
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0xeb0]
push eax
push esi
push 0xc281454
push dword [ebp - 0xea8]
mov dword [ebp - 0xeac], 0x400
call fcn.0c285b76
test eax, eax
je 0xc29de9b
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0xaa4]
push eax
call fcn.0c29d5d5
lea eax, [ebp - 0xec4]
push eax
lea eax, [ebp - 0xa4]
push eax
lea eax, [ebp - 0xeb0]
push eax
push esi
push 0xc28148c
push dword [ebp - 0xea8]
mov dword [ebp - 0xec4], 0x50
call fcn.0c285b76
test eax, eax
jne 0xc29df77
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xec8]
push eax
lea eax, [ebp - 0xeb0]
push eax
push esi
push 0xc28143c
push dword [ebp - 0xea8]
mov dword [ebp - 0xeb0], edi
mov dword [ebp - 0xebc], edi
mov dword [ebp - 0xec8], esi
call fcn.0c285b76
lea eax, [ebp - 0xebc]
push eax
lea eax, [ebp - 0xecc]
push eax
lea eax, [ebp - 0xeb0]
push eax
push esi
push 0xc28143c
push dword [ebp - 0xea8]
mov dword [ebp - 0xebc], edi
mov dword [ebp - 0xecc], esi
call fcn.0c285b76
push dword [ebp - 0xeb4]
lea eax, [ebp - 0xa4]
push dword [ebp - 0xecc]
push dword [ebp - 0xec8]
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0xaa4]
push eax
lea eax, [ebp - 0xea4]
push eax
lea eax, [ebp - 0x6a4]
push eax
call fcn.0c29dbd1
push dword [ebp - 0xea8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xeac]
push eax
lea eax, [ebp - 0x6a4]
push eax
push dword [ebp - 0xec0]
mov dword [ebp - 0xeac], 0x200
push dword [ebp - 0xeb8]
call fcn.0c285c90
inc dword [ebp - 0xec0]
cmp eax, ebx
jne 0xc29dd6d
push dword [ebp - 0xeb8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0c2af3be
leave
ret