Function at 0x100142b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1004487e
call fcn.10029f1c
sub esp, 0x64
push ebx
push esi
push edi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
xor bl, bl
push str.SoftwareClasses_
mov byte [ebp - 0xd], bl
call fcn.10003846
push 0xffffffffffffffff
xor edi, edi
mov byte [ebp - 4], 1
push edi
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x58]
call fcn.100063c6
mov esi, str.CLSID
push esi
call fcn.10003e62
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.1000646c
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x28]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call esi
test eax, eax
jne 0x1001469f
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], edi
push eax
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], edi
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x100466b0
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x1001463e
cmp dword [ebp - 0x18], 1
jne 0x1001460c
push dword [ebp - 0x14]
call fcn.10025e1e
pop ecx
mov ebx, eax
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push 0
push 0x100466b0
push dword [ebp - 0x28]
call edi
test eax, eax
jne 0x100145a5
push str.SoftwareClassesCLSID_
lea ecx, [ebp - 0x40]
call fcn.10003846
push ebx
mov byte [ebp - 4], 2
call fcn.10003e62
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x40]
call fcn.1000646c
push str.LocalServer32
call fcn.10003e62
pop ecx
push eax
push str.LocalServer32
lea ecx, [ebp - 0x40]
call fcn.1000646c
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x24]
push ecx
push 0x20019
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push 0
push eax
push 0x80000002
call esi
xor esi, esi
test eax, eax
jne 0x10014547
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], esi
push eax
push esi
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], esi
push eax
push esi
push 0x100466b0
push dword [ebp - 0x24]
call edi
test eax, eax
jne 0x100144e8
cmp dword [ebp - 0x20], 1
jne 0x100144b8
push dword [ebp - 0x1c]
call fcn.10025e1e
pop ecx
mov esi, eax
lea eax, [ebp - 0x1c]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push 0
push 0x100466b0
push dword [ebp - 0x24]
call edi
test eax, eax
sete cl
mov byte [ebp - 0xd], cl
test cl, cl
je 0x10014454
push esi
call fcn.10003e62
pop ecx
mov ecx, dword [ebp + 0x20]
push eax
push esi
call fcn.10003d32
jmp 0x100144aa
push eax
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.10022435
add esp, 0xc
push eax
push str._:
push esi
push str.RegQueryValueEx_
push dword [section..data]
mov byte [ebp - 4], 3
call fcn.100098a5
pop ecx
pop ecx
mov ecx, eax
call fcn.10014ba1
push eax
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
push eax
call fcn.10005504
add esp, 0xc
lea ecx, [ebp - 0x70]
push 0
push 1
call fcn.10003be3
push esi
call fcn.1002ab36
pop ecx
xor esi, esi
jmp 0x1001453c
push str._nest_pas_:_REG_SZ
push esi
push str.Le_type_retourn
push dword [section..data]
call fcn.100098a5
pop ecx
pop ecx
mov ecx, eax
call fcn.10014ba1
push eax
call fcn.100098a5
push eax
call fcn.10005504
add esp, 0xc
jmp 0x1001453c
push eax
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.10022435
add esp, 0xc
push eax
push str._:
push esi
push str.RegQueryValueEx_
push dword [section..data]
mov byte [ebp - 4], 4
call fcn.100098a5
pop ecx
pop ecx
mov ecx, eax
call fcn.10014ba1
push eax
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
push eax
call fcn.10005504
add esp, 0xc
lea ecx, [ebp - 0x70]
push esi
push 1
call fcn.10003be3
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001459f
push eax
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.10022435
add esp, 0xc
push eax
push str._:
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 5
push eax
push str.RegOpenKeyEx_
push dword [section..data]
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
pop ecx
pop ecx
push eax
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
push eax
call fcn.10005504
add esp, 0xc
lea ecx, [ebp - 0x70]
push esi
push 1
call fcn.10003be3
push esi
lea ecx, [ebp - 0x40]
jmp 0x100145f4
push eax
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.10022435
add esp, 0xc
push eax
push str._:
push ebx
push str.RegQueryValueEx_
push dword [section..data]
mov byte [ebp - 4], 6
call fcn.100098a5
pop ecx
pop ecx
mov ecx, eax
call fcn.10014ba1
push eax
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
push eax
call fcn.10005504
add esp, 0xc
lea ecx, [ebp - 0x70]
push 0
push 1
call fcn.10003be3
push ebx
call fcn.1002ab36
mov bl, byte [ebp - 0xd]
xor edi, edi
pop ecx
jmp 0x10014694
push str._nest_pas_:_REG_SZ
xor edi, edi
push edi
push str.Le_type_retourn
push dword [section..data]
call fcn.100098a5
pop ecx
pop ecx
mov ecx, eax
call fcn.10014ba1
push eax
call fcn.100098a5
push eax
call fcn.10005504
add esp, 0xc
jmp 0x10014694
push eax
xor edi, edi
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.10022435
add esp, 0xc
push eax
push str._:
push edi
push str.RegQueryValueEx_
push dword [section..data]
mov byte [ebp - 4], 7
call fcn.100098a5
pop ecx
pop ecx
mov ecx, eax
call fcn.10014ba1
push eax
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
push eax
call fcn.10005504
add esp, 0xc
lea ecx, [ebp - 0x70]
push edi
push 1
call fcn.10003be3
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100146f7
push eax
lea eax, [ebp - 0x70]
push edi
push eax
call fcn.10022435
add esp, 0xc
push eax
push str._:
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 8
push eax
push str.RegOpenKeyEx_
push dword [section..data]
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
pop ecx
pop ecx
push eax
call fcn.100098a5
pop ecx
pop ecx
push eax
call fcn.10005259
push eax
call fcn.10005504
add esp, 0xc
lea ecx, [ebp - 0x70]
push edi
push 1
call fcn.10003be3
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.10003be3
push edi
push 1
lea ecx, [ebp + 8]
call fcn.10003be3
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret