Function at 0x1013b872
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x101d5abc]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, edx
mov dword [ebp - 0x238], ebx
push esi
mov esi, ecx
mov dword [ebp - 0x224], esi
test ebx, ebx
jne 0x1013b8a7
mov eax, 0x80070057
jmp 0x1013bb3a
push 0x1003f8e3
push 0x34
call fcn.10188c5c
pop ecx
pop ecx
test eax, eax
je 0x1013bb32
xor edx, edx
mov ecx, dword [edx + 0x10008674]
add edx, 8
and dword [ecx + eax], 0
cmp edx, 0x68
jb 0x1013b8bf
push edi
mov dword [ebx], eax
xor ebx, ebx
push 0x208
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea edx, [ebp - 0x20c]
mov edi, 0x104
mov ecx, esi
push edi
call fcn.1013d9f0
mov esi, eax
test esi, esi
js 0x1013b93e
push 0x1001d750
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.10045073
mov esi, eax
test esi, esi
js 0x1013b93e
lea eax, [ebp - 0x220]
mov edx, edi
push eax
lea ecx, [ebp - 0x20c]
call fcn.10134ca9
mov esi, eax
test esi, esi
jns 0x1013b93e
mov dword [ebp - 0x21c], ebx
jmp 0x1013b94a
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x21c], eax
mov ecx, ebx
mov edi, ebx
mov dword [ebp - 0x210], ecx
test esi, esi
js 0x1013bb18
push ebx
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1013b9e6
mov eax, dword [ebp - 0x218]
xor ecx, ecx
push 0x1003f8e3
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10188c5c
mov edi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x214]
push 0x1003f8e3
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10188c5c
mov ecx, eax
add esp, 0x10
mov dword [ebp - 0x210], ecx
test ecx, ecx
je 0x1013b9df
test edi, edi
jne 0x1013b9f7
mov esi, 0x8007000e
jmp 0x1013b9f7
mov ecx, ebx
jg 0x1013b9ee
mov esi, eax
jmp 0x1013b9f7
movzx esi, ax
or esi, 0x80070000
test esi, esi
js 0x1013bb18
cmp ebx, dword [ebp - 0x22c]
jae 0x1013bb18
mov eax, dword [ebp - 0x218]
inc eax
mov dword [ebp - 0x230], eax
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x228]
push eax
push ecx
push 0
push 0
lea eax, [ebp - 0x230]
push eax
push edi
push ebx
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1013ba5a
jg 0x1013ba4f
mov esi, eax
jmp 0x1013ba7b
movzx esi, ax
or esi, 0x80070000
jmp 0x1013ba7b
mov eax, dword [ebp - 0x214]
xor edx, edx
mov ecx, dword [ebp - 0x210]
shr eax, 1
mov word [ecx + eax*2 - 2], dx
xor ecx, ecx
mov eax, dword [ebp - 0x218]
mov word [edi + eax*2], cx
test esi, esi
js 0x1013bb03
lea edx, [ebp - 0x234]
mov ecx, edi
call fcn.1013b7bf
test eax, eax
js 0x1013bb03
mov eax, dword [ebp - 0x234]
xor ecx, ecx
mov edx, dword [ebp - 0x228]
shr edx, 1
add edx, dword [ebp - 0x21c]
mov esi, dword [eax*8 + 0x10008674]
mov eax, dword [ebp - 0x238]
push 0x1003f8e3
mov dword [ebp - 0x23c], edx
push 2
add esi, dword [eax]
mov eax, edx
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10188c5c
mov dword [esi], eax
pop ecx
pop ecx
test eax, eax
je 0x1013bb13
push dword [ebp - 0x210]
lea ecx, [ebp - 0x20c]
push ecx
push 0x10020168
push dword [ebp - 0x23c]
push eax
call fcn.10045113
add esp, 0x14
mov esi, eax
inc ebx
test esi, esi
js 0x1013bb18
mov ecx, dword [ebp - 0x210]
jmp 0x1013b9ff
mov esi, 0x8007000e
push dword [ebp - 0x210]
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
push edi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void__]
pop ecx
pop ecx
mov eax, esi
pop edi
jmp 0x1013bb3a
and dword [ebx], 0
mov eax, 0x8007000e
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.101885f0
leave
ret