Function at 0x100c222
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
push dword [eax + 0x3f644]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x208], 0x200
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
xor ebx, ebx
push ebx
push 2
push 0x1001b3c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
call esi
cmp eax, ebx
jle 0x100c291
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c2e2
mov ecx, dword [ebp - 0x20c]
push 0x100
lea eax, [ecx + 0x400]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0100c0a2
mov edi, eax
cmp edi, ebx
jge 0x100c309
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0xc
jmp 0x100c520
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0xd
jmp 0x100c520
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b98
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c340
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c3a3
xor eax, eax
cmp ax, word [ebp - 0x204]
je 0x100c370
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x20c]
push 0x100
add eax, 0xa08
push eax
call fcn.0100a692
jmp 0x100c3c8
mov edi, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push 0x1001b20
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009390
jmp 0x100c3c8
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c3c8
test byte [eax + 0x1c], 4
je 0x100c3c8
push edi
push 0x1001b20
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
cmp edi, ebx
jl 0x100c785
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b54
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c407
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c452
mov ecx, dword [ebp - 0x20c]
push 0x100
push ecx
lea eax, [ebp - 0x204]
push eax
call fcn.0100c0a2
mov edi, eax
cmp edi, ebx
jge 0x100c479
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0x10
jmp 0x100c520
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0x11
jmp 0x100c520
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b68
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c4b0
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c4fe
mov ecx, dword [ebp - 0x20c]
push 0x100
lea eax, [ecx + 0x200]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0100c0a2
mov edi, eax
cmp edi, ebx
jge 0x100c530
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0x12
jmp 0x100c520
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086d5
jmp 0x100c785
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001bcc
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c567
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c60a
mov eax, dword [ebp - 0x20c]
mov eax, dword [eax + 0xa00]
cmp eax, ebx
je 0x100c594
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x20c]
mov dword [eax + 0xa00], ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x214], ebx
call fcn.0100bd24
mov dword [ebp - 0x218], eax
cmp eax, ebx
je 0x100c60a
mov eax, dword [ebp - 0x214]
push 0xa
add eax, 2
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x214], eax
jle 0x100c60a
push ebx
push 0x16
call fcn.01008e4c
push eax
push 0x16
call fcn.01008a72
push eax
movzx eax, word [ebp - 0x214]
push 1
push eax
push dword [ebp - 0x218]
call dword [sym.imp.USER32.dll_LoadImageW]
mov ecx, dword [ebp - 0x20c]
mov dword [ecx + 0xa00], eax
mov eax, dword [ebp - 0x20c]
cmp dword [eax + 0xa00], ebx
jne 0x100c649
mov edi, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push 0x1001b20
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009390
cmp edi, ebx
jl 0x100c785
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b80
push ebx
push dword [ebp - 0x210]
mov edi, 0x200
mov dword [ebp - 0x208], edi
call esi
cmp eax, ebx
jle 0x100c68b
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x100c783
xor eax, eax
cmp ax, word [ebp - 0x204]
je 0x100c758
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x20c]
push 0x100
add eax, 0x800
push eax
call fcn.0100a692
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001bb4
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], edi
call esi
cmp eax, ebx
jle 0x100c6f0
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c739
mov ecx, dword [ebp - 0x20c]
push 0x100
lea eax, [ecx + 0x600]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0100c0a2
mov edi, eax
cmp edi, ebx
jge 0x100c785
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0x15
jmp 0x100c520
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push edi
push 0x1001b20
push 0x16
jmp 0x100c520
mov edi, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c785
test byte [eax + 0x1c], 4
je 0x100c785
push 0x1001b20
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01009390
jmp 0x100c785
xor edi, edi
mov eax, dword [ebp - 0x20c]
push dword [eax + 0x3f644]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a181
leave
ret 4