Function at 0x1013f46
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x1018fe9
call fcn.01001b63
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
push 0x1014190
mov dword [ebp - 0x14], ebx
call fcn.01015dc9
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1013f8e
mov eax, 0x80040153
call fcn.010014c4
ret 0xc
cmp dword [ebp - 0x14], ebx
jbe 0x1013f81
cmp dword [ebp - 0x18], 1
je 0x1013fa5
cmp dword [ebp - 0x18], 2
je 0x1013fa5
cmp dword [ebp - 0x18], 7
jne 0x1013fa9
add dword [ebp - 0x14], 2
push dword [ebp - 0x14]
call fcn.0100220e
mov esi, dword [ebp - 0x14]
mov edi, eax
pop ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], esi
cmp edi, ebx
jne 0x1013fd2
mov dword [ebp - 0x1c], ebx
push 0x101b618
lea eax, [ebp - 0x1c]
push eax
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call sym.WmiApSrv.exe_private:_unsigned_long_int___thiscall_CRegistry::GetCurrentRawKeyValue_struct_HKEY_____unsigned_short_int_const___void___unsigned_long_int___unsigned_long_int__
cmp eax, ebx
je 0x1013ff9
push edi
call fcn.0100b675
pop ecx
jmp 0x1013f81
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jbe 0x1013ff0
cmp eax, 2
jbe 0x101415a
cmp eax, 3
je 0x1014113
cmp eax, 4
je 0x10140a5
cmp eax, 7
jne 0x1013ff0
mov eax, dword [ebp - 0x14]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x1014038
mov byte [edi + eax], 0
mov eax, dword [ebp - 0x14]
mov byte [edi + eax + 1], 0
jmp 0x1014043
lea eax, [edi + esi]
mov byte [eax - 2], 0
mov byte [eax - 1], 0
mov eax, edi
mov ebx, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x101404a
sub eax, edx
sar eax, 1
mov esi, eax
mov dword [ebp + 0xc], esi
test esi, esi
je 0x1014175
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x24]
ja 0x1014175
mov ecx, dword [ebp + 0x10]
push ebx
call sym.WmiApSrv.exe_public:_class_CHString_const____thiscall_CHString::operator_unsigned_short_int_const__
mov ecx, dword [ebp + 0x10]
push 0x101419c
call sym.WmiApSrv.exe_public:_class_CHString_const____thiscall_CHString::operator_unsigned_short_int_const__
lea ebx, [ebx + esi*2 + 2]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1014090
sub eax, edx
sar eax, 1
mov esi, eax
add dword [ebp + 0xc], esi
jmp 0x101405d
cmp dword [ebp - 0x14], 4
jne 0x1013ff0
push 0x200
call fcn.0100220e
mov esi, eax
pop ecx
mov dword [ebp + 0xc], esi
cmp esi, ebx
je 0x1014103
push dword [edi]
mov byte [ebp - 4], 1
push 0x1014194
push 0x100
push esi
call fcn.01005e75
mov ecx, dword [ebp + 0x10]
add esp, 0x10
push esi
call fcn.01015dc9
push esi
call fcn.0100b675
pop ecx
jmp 0x1014175
mov dword [ebp - 0x28], ebx
push 0x101b618
lea eax, [ebp - 0x28]
jmp 0x1013fcc
mov ecx, dword [ebp + 0x10]
call sym.WmiApSrv.exe_public:_void___thiscall_CHString::Empty_void_
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
mov esi, eax
shr eax, 1
and esi, 1
add eax, esi
mov ebx, eax
push ebx
call sym.WmiApSrv.exe_public:_unsigned_short_int____thiscall_CHString::GetBuffer_int_
push dword [ebp - 0x14]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
test esi, esi
je 0x101414f
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + eax], 0
mov ecx, dword [ebp + 0x10]
push ebx
call sym.WmiApSrv.exe_public:_unsigned_short_int____thiscall_CHString::GetBufferSetLength_int_
jmp 0x1014175
mov eax, dword [ebp - 0x14]
cmp eax, esi
jae 0x1014167
mov byte [edi + eax], 0
jmp 0x101416c
mov byte [edi + esi - 1], 0
mov ecx, dword [ebp + 0x10]
push edi
call fcn.01015dc9
or dword [ebp - 4], 0xffffffff
push edi
call fcn.0100b675
pop ecx
xor eax, eax
jmp 0x1013f86