Function at 0x10018c28
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1444
call fcn.1001f380
mov eax, dword [0x1006b1fc]
xor eax, esp
mov dword [esp + 0x1440], eax
mov eax, dword [esp + 0x1448]
push ebx
push ebp
push esi
push edi
mov ebp, 0x400
mov dword [esp + 0x28], eax
push ebp
xor ebx, ebx
lea eax, [esp + 0x454]
push ebx
push eax
call fcn.10022670
add esp, 0xc
push 0x10053cb0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10018f03
push ebp
lea ecx, [esp + 0x454]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x450]
push ebp
push eax
call fcn.1002ee74
pop ecx
pop ecx
test eax, eax
je 0x10018f03
lea eax, [esp + 0x450]
push str.jvm.dll
push eax
call fcn.10022900
pop ecx
pop ecx
test eax, eax
je 0x10018f03
push ebp
lea eax, [esp + 0x854]
push eax
lea eax, [esp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 0x850]
push ebp
push eax
call fcn.1002ee74
pop ecx
pop ecx
test eax, eax
je 0x10018f03
lea eax, [esp + 0x850]
push str._bin
push eax
call fcn.10022900
pop ecx
pop ecx
test eax, eax
je 0x10018d08
mov byte [eax], bl
push 0x20019
push 0x10053cc8
mov edi, ebx
mov dword [esp + 0x40], ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x44]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.10006b74
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x38]
test eax, eax
jne 0x10018f4d
mov edi, 0x20019
lea ecx, [esp + 0x2c]
push edi
push 0x10053cd4
push ebp
call fcn.10006b74
test eax, eax
jne 0x10018f5f
push edi
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x48]
push 0x10053ce0
push edi
call fcn.10006b74
mov ebx, dword [esp + 0x44]
test eax, eax
jne 0x10018eee
and dword [esp + 0x14], 0
mov eax, 0x400
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x54]
push 0
push eax
call fcn.10022670
add esp, 0xc
lea eax, [esp + 0x10]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [esp + 0x64]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10018eee
xor eax, eax
xor ecx, ecx
inc eax
xor edx, edx
cmp dword [esp + 0x10], ecx
jbe 0x10018eb0
cmp byte [esp + edx + 0x50], 0x2e
jne 0x10018dfc
inc ecx
cmp ecx, eax
jg 0x10018e0b
inc edx
cmp edx, dword [esp + 0x10]
jb 0x10018df0
cmp ecx, eax
jle 0x10018eb0
push 3
lea eax, [esp + 0x54]
push 0x10053cfc
push eax
call fcn.10024500
add esp, 0xc
test eax, eax
js 0x10018eb0
push 0x20019
lea eax, [esp + 0x54]
push eax
push ebx
lea ecx, [esp + 0x24]
call fcn.10006b74
test eax, eax
jne 0x10018eb0
mov eax, 0x400
push eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc54]
push 0
push eax
call fcn.10022670
add esp, 0xc
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push eax
lea eax, [esp + 0xc54]
push eax
push 0x10053d00
call fcn.100073a2
test eax, eax
jne 0x10018eb0
push 0x400
lea eax, [esp + 0x1054]
push eax
lea eax, [esp + 0xc58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 0x850]
push eax
lea eax, [esp + 0x1054]
push eax
call fcn.1002ec11
pop ecx
pop ecx
test eax, eax
je 0x10018f1e
mov eax, dword [esp + 0x14]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x400
push ecx
lea ecx, [esp + 0x64]
inc eax
push ecx
push eax
push ebx
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10018ddf
cmp dword [esp + 0x18], 0
je 0x10018eee
push dword [esp + 0x18]
call esi
test ebx, ebx
je 0x10018ef5
push ebx
call esi
test edi, edi
je 0x10018efc
push edi
call esi
test ebp, ebp
je 0x10018f03
push ebp
call esi
xor eax, eax
mov ecx, dword [esp + 0x1450]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001f12f
add esp, 0x1444
ret
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1460]
push dword [esp + 0x30]
call fcn.10024438
add esp, 0xc
cmp dword [esp + 0x18], 0
je 0x10018f43
push dword [esp + 0x18]
call esi
test ebx, ebx
je 0x10018f4a
push ebx
call esi
xor ebx, ebx
inc ebx
test edi, edi
je 0x10018f54
push edi
call esi
test ebp, ebp
je 0x10018f5b
push ebp
call esi
mov eax, ebx
jmp 0x10018f05
mov edi, dword [esp + 0x2c]
jmp 0x10018f4d