Function at 0x100094e6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x1006800c]
xor ecx, ebp
mov dword [esp + 0xc0], ecx
mov dword [eax], 1
xor esi, esi
lea ebx, [esp + 0xb0]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
sub esp, 0x1c
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x1005d210]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
mov ecx, ebx
call fcn.100043cc
lea ecx, [edi + 0x24]
mov eax, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x1005d210]
movups xmmword [esp + 8], xmm0
mov dword [esp], eax
mov dword [esp + 4], str.TaskLastRunTime
mov dword [esp + 0x28], ecx
call fcn.100043cc
push str.LocalIeToEdgeBhoMutex
call fcn.1000f102
add esp, 4
mov dword [esp + 4], edi
mov dword [edi + 0x30], eax
xor ebx, ebx
dec ebx
test eax, eax
je 0x10009652
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100095fa
push 2
call fcn.1000f952
add esp, 4
test al, al
je 0x10009652
lea esi, [esp + 0x20]
mov ecx, esi
push 2
push 0x9f
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f99c
mov ecx, esi
call fcn.10002820
push 0x2d
push str.Failed_to_acquire_last_run_mutex_at_startup:
push eax
call fcn.100065e4
add esp, 0xc
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
push eax
call fcn.10001dc0
mov ecx, esi
call fcn.1000fcf8
jmp 0x10009652
mov ecx, dword [esp + 4]
mov eax, dword [ecx + 0x34]
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
xor ebx, ebx
cmp esi, eax
je 0x10009649
mov edi, esi
jmp 0x100097a5
and ecx, 0x7f
push ecx
push esi
push eax
call fcn.100065e4
add esp, 0xc
push str._registry_value:
push eax
call fcn.10003222
add esp, 8
mov ecx, eax
push ebx
call fcn.10001bb0
mov ecx, edi
call fcn.1000fcf8
mov ecx, dword [esp + 4]
xor ebx, ebx
dec ebx
push dword [ecx + 0x30]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x10009664
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.1002bd4a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov ebx, eax
push 2
call fcn.1000f952
add esp, 4
test al, al
mov ecx, dword [esp + 4]
je 0x10009646
lea edi, [esp + 0x20]
mov ecx, edi
push 2
push 0xc1
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
push 0x19
push str.Failed_to_read_write_the
push eax
call fcn.100065e4
add esp, 0xc
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x10009617
mov ecx, dword [esi + 4]
mov esi, dword [esi]
jmp 0x1000961a
xor ebx, ebx
mov ecx, dword [esp + 4]
jmp 0x10009649
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x100096eb
mov eax, dword [esi]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ecx
push 8
lea edx, [esp + 0x24]
push edx
push 0xb
push ecx
push eax
mov eax, dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1000967e
push 0
call fcn.1000f952
add esp, 4
test al, al
mov ebx, 0
mov eax, dword [esp + 4]
je 0x10009785
lea edi, [esp + 0x20]
mov ecx, edi
push 0
push 0xae
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x10009758
mov ecx, dword [esi + 4]
mov edx, dword [esi]
jmp 0x1000975d
and ecx, 0x7f
mov edx, esi
push ecx
push edx
push eax
call fcn.100065e4
add esp, 0xc
push 0xf
push str._initial_run:_0
push eax
call fcn.100065e4
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.1000fcf8
mov eax, dword [esp + 4]
push ebx
push ebx
mov edi, dword [esp + 0x10]
push edi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetTimer]
add esi, 0x30
add edi, 0x30
cmp esi, dword [esp + 0x14]
je 0x100096d6
mov dword [esp + 8], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x100097bb
mov eax, dword [esi]
mov dword [esp + 0xbc], 0xffffffff
mov dword [esp + 0x20], 8
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0xc4]
push ecx
push ebx
push eax
mov eax, dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0xbc]
cmp ecx, 0xb
mov edx, 0
mov ebx, 0xd
cmove ebx, edx
test eax, eax
cmovne ebx, eax
cmp ebx, 2
je 0x100096e1
cmp byte [esi + 0x18], 0
jne 0x100096e1
test eax, eax
jne 0x10009680
cmp ecx, 0xb
jne 0x10009680
call fcn.1000f0c4
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
sub eax, ecx
sbb edx, edi
mov ecx, dword [esi + 0x10]
mov ebx, 0xdc3cba00
add ecx, ebx
mov ebx, dword [esi + 0x14]
adc ebx, 0xffffffff
cmp eax, ecx
sbb edx, ebx
jae 0x10009873
mov ecx, dword [esp + 4]
push esi
push edi
push dword [esp + 0x18]
call fcn.100098fc
xor ebx, ebx
mov edi, dword [esp + 8]
jmp 0x10009795
push 0
call fcn.1000f952
add esp, 4
test al, al
mov eax, dword [esp + 4]
mov ebx, 0
je 0x100098f0
lea edi, [esp + 0x20]
mov ecx, edi
push 0
push 0xb9
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f99c
mov ecx, edi
call fcn.10002820
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x100098b7
mov ecx, dword [esi + 4]
mov edx, dword [esi]
jmp 0x100098bc
and ecx, 0x7f
mov edx, esi
push ecx
push edx
push eax
call fcn.100065e4
add esp, 0xc
push 0xe
push str._initial_run:
push eax
call fcn.100065e4
add esp, 0xc
mov ecx, eax
push 0xea60
call fcn.10001dc0
lea ecx, [esp + 0x20]
call fcn.1000fcf8
mov eax, dword [esp + 4]
push 0
push 0xea60
jmp 0x10009787