Function at 0x10014640
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1c18
call fcn.102244a0
mov eax, 0x400
push ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], eax
mov al, byte [esp + 0x1c28]
push ebp
mov edx, ecx
xor ebp, ebp
push esi
cmp al, 0x15
push edi
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], ebp
jne 0x100146b1
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, reloc.platform.dll_Ordinal_2
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HKEY_LOCAL_MACHINESoftwareMicrosoftWindowsCurrentVersion_
jmp 0x1001479e
cmp al, 0x16
jne 0x1001475c
mov eax, dword [edx + 0x324]
cmp eax, ebp
jne 0x10014702
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, reloc.platform.dll_Ordinal_1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion_
jmp 0x1001479e
mov ebx, eax
mov edi, str.SoftwareMicrosoftWindowsCurrentVersion_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
lea esi, [esp + 0x428]
sub edi, ecx
mov eax, ecx
mov dword [esp + 0x14], esi
mov esi, edi
mov edi, dword [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push str.SoftwareMicrosoftWindowsCurrentVersion_
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [edx + 0x328]
lea edx, [esp + 0xc2c]
push ecx
push str.HKEY_USERS
push str._s_s_s_
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
jmp 0x100147bb
cmp al, 0x17
jne 0x10014cd7
mov edi, str..DEFAULTSoftwareMicrosoftWindowsCurrentVersion_
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov ebx, Ordinal_6
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0xc28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.HKEY_USERS.DEFAULTSoftwareMicrosoftWindowsCurrentVersion_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ax, word [esp + 0x1c30]
cmp ax, 0xa
jne 0x1001480b
mov edi, 0x102326f0
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xc28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x102326f0
jmp 0x10014897
cmp ax, 0xb
jne 0x10014850
mov edi, str.RunOnce
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xc28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.RunOnce
jmp 0x10014897
cmp ax, 0xc
jne 0x10014cd7
mov edi, str.RunServices
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x428]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [esp + 0xc28]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.RunServices
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x1c3c]
lea edx, [esp + 0x42c]
or ecx, 0xf003f
push ecx
push ebp
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10014cd7
mov ecx, dword [esp + 0x20]
lea edi, [esp + 0x828]
mov edx, ecx
mov dword [esp + 0x10], ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea edx, [esp + 0x20]
and ecx, 3
rep stosb byte es:[edi], al
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x28]
push eax
push ecx
mov ecx, dword [esp + 0x1c]
push ebp
push ebp
lea eax, [esp + 0x838]
push edx
push eax
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x10014cba
mov ebp, dword [esp + 0x1c2c]
mov edx, dword [esp + 0x1c]
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x28]
push edx
lea ecx, [esp + 0x82c]
push eax
mov eax, dword [esp + 0x1c40]
lea edx, [esp + 0x430]
push ecx
push edx
push eax
push ebx
call fcn.10013db0
add esp, 0x18
cmp eax, 1
jne 0x10014c75
mov cl, byte [esp + 0x28]
mov byte [esp + 0x427], 0
test cl, cl
lea eax, [esp + 0x28]
je 0x1001499d
cmp byte [eax], 0x22
jne 0x10014995
mov byte [eax], 0x20
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x1001498d
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x100149bd
lea eax, [esp + ecx + 0x27]
mov cl, byte [esp + ecx + 0x27]
cmp cl, 0x5c
jne 0x100149bd
mov byte [eax], 0
lea ecx, [esp + 0x1428]
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.10016850
mov ecx, 0x100
lea esi, [esp + 0x1430]
lea edi, [esp + 0x30]
lea eax, [esp + 0x1030]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x30]
push eax
push ecx
call fcn.10016cb0
add esp, 0x10
cmp eax, 1
jne 0x10014bed
lea edx, [esp + 0x1028]
push edx
call dword [sym.imp.MSVCRT.dll__strupr]
mov eax, dword [esp + 0x1c40]
add esp, 4
test eax, eax
jne 0x10014b6b
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x1028]
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, edx
jbe 0x10014aea
lea eax, [esp + 0x1828]
push 0x400
lea ecx, [esp + 0x102c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x10014aa5
cmp eax, 0x400
ja 0x10014aa5
lea edx, [esp + 0x1828]
push ebp
push edx
call dword [sym.imp.MSVCRT.dll_strstr]
mov edx, eax
add esp, 8
test edx, edx
je 0x10014c75
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
mov dl, byte [edx]
cmp dl, 0x20
je 0x10014b04
test dl, dl
jne 0x10014c75
jmp 0x10014b04
lea eax, [esp + 0x1028]
push ebp
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edx, eax
add esp, 8
test edx, edx
je 0x10014c75
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
add edx, ecx
mov dl, byte [edx]
cmp dl, 0x20
je 0x10014b04
cmp dl, 0x2c
je 0x10014b04
test dl, dl
je 0x10014b04
cmp dl, 0x3a
jne 0x10014c75
jmp 0x10014b04
lea ecx, [esp + 0x1028]
push ecx
push ebp
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x10014c75
mov ecx, dword [0x107ab9f4]
test ecx, ecx
je 0x10014b3c
lea eax, [esp + 0x24]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x1c]
lea esi, [eax + 0x31c]
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x834]
push eax
lea eax, [esp + 0xc38]
push eax
mov eax, dword [0x107ab9f8]
push eax
call dword [edx + 0x1c]
mov eax, dword [esp + 0x1c38]
lea ecx, [esp + 0x828]
lea edx, [esp + 0x428]
push ecx
push edx
push eax
push ebx
call fcn.10013e80
add esp, 0x10
cmp eax, 1
jne 0x10014c75
jmp 0x10014c6d
lea ecx, [esp + 0x1028]
push ebp
push ecx
mov ecx, dword [esp + 0x20]
call fcn.100168e0
cmp eax, 1
jne 0x10014c75
mov ecx, dword [0x107ab9f4]
test ecx, ecx
je 0x10014bbe
lea eax, [esp + 0x24]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x1c]
lea esi, [eax + 0x31c]
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x834]
push eax
lea eax, [esp + 0xc38]
push eax
mov eax, dword [0x107ab9f8]
push eax
call dword [edx + 0x1c]
mov eax, dword [esp + 0x1c38]
lea ecx, [esp + 0x828]
lea edx, [esp + 0x428]
push ecx
push edx
push eax
push ebx
call fcn.10013e80
add esp, 0x10
cmp eax, 1
jne 0x10014c75
jmp 0x10014c6d
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.MSVCRT.dll__strupr]
mov ecx, dword [esp + 0x1c]
add esp, 4
lea edx, [esp + 0x28]
push ebp
push edx
call fcn.100168e0
cmp eax, 1
jne 0x10014c75
mov ecx, dword [0x107ab9f4]
test ecx, ecx
je 0x10014c47
lea eax, [esp + 0x24]
mov edx, dword [ecx]
push eax
mov eax, dword [esp + 0x1c]
lea esi, [eax + 0x31c]
mov eax, dword [eax]
push esi
push eax
lea eax, [esp + 0x834]
push eax
lea eax, [esp + 0xc38]
push eax
mov eax, dword [0x107ab9f8]
push eax
call dword [edx + 0x1c]
mov eax, dword [esp + 0x1c38]
lea ecx, [esp + 0x828]
lea edx, [esp + 0x428]
push ecx
push edx
push eax
push ebx
call fcn.10013e80
add esp, 0x10
cmp eax, 1
jne 0x10014c75
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x10]
mov ecx, 0x400
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x28]
push ecx
push edx
push 0
lea ecx, [esp + 0x2c]
push 0
lea edx, [esp + 0x838]
inc eax
push ecx
push edx
mov dword [esp + 0x28], eax
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x10014938
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c18
ret 0x14
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c18
ret 0x14