Function at 0x100064e7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1cc
mov eax, 0x10052573
call fcn.10037d5a
mov esi, ecx
movzx eax, word [esi + 0x3d4]
xor ebx, ebx
lea edi, [ebp - 0x8c]
mov dword [ebp - 0x194], esi
mov dword [ebp - 0x198], eax
mov dword [esi + 0x3d8], ebx
call fcn.1001df2e
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x38], ebx
mov word [ebp - 0x48], ax
lea eax, [ebp - 0x4c]
push eax
mov byte [ebp - 4], 1
call fcn.10006334
push 0x10057f80
mov dword [ebp - 0x190], eax
call fcn.10005d87
pop ecx
test eax, eax
jne 0x100065bc
push 0x10057f9c
call fcn.10005d87
pop ecx
test eax, eax
jne 0x100065bc
push str.CryptEnabled
call fcn.10005d87
pop ecx
test eax, eax
jne 0x100065bc
cmp dword [ebp - 0x190], ebx
jne 0x100065bc
cmp byte [ebp - 0x8c], bl
jne 0x100065bc
mov eax, dword [ebp - 0x194]
lea edi, [esi + 0x3bc]
mov esi, 0x10057d60
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [eax + 0x20], 0x20
movsd dword es:[edi], dword [esi]
add eax, 0x14
push eax
push 2
movsd dword es:[edi], dword [esi]
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
push ebx
push 1
lea esi, [ebp - 0x4c]
call fcn.100021ef
push ebx
push 1
jmp 0x10006869
xor eax, eax
cmp byte [ebp - 0x8c], bl
push str.CryptEnabled
setne al
mov dword [esi + 0x3d8], eax
call fcn.10005d87
test eax, eax
pop ecx
mov eax, 0x10057fc0
jne 0x100065e6
mov eax, 0x10057fd0
push eax
lea esi, [ebp - 0x30]
call fcn.10001ec7
push str.c034105b
push reloc.WS2_32.dll_bind
mov edx, str.Softwareprojonepodlp_smpcache_
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.1002d927
pop ecx
pop ecx
mov byte [ebp - 4], 3
cmp dword [ebp - 0x50], 8
mov eax, dword [ebp - 0x64]
jae 0x1000661c
lea eax, [ebp - 0x64]
push eax
call fcn.1002be36
mov edi, 0x10057fec
test eax, eax
je 0x1000666e
push str._g:gI
lea eax, [ebp - 0x30]
push eax
call fcn.10005536
push edi
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x1bc]
push eax
call fcn.10006a01
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 4
call fcn.10005b87
push ebx
push 1
lea esi, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.100021ef
call fcn.1001c848
test eax, eax
jne 0x1000668f
push str.S_MR
lea eax, [ebp - 0x30]
push eax
call fcn.10005536
mov dword [ebp - 0x198], 0x68
push str.CryptEnabled
call fcn.10005d87
pop ecx
test eax, eax
je 0x100066f3
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x1bc]
push 0x10058008
push eax
call fcn.10006a47
add esp, 0xc
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.10005b87
push ebx
push 1
lea esi, [ebp - 0x1bc]
mov byte [ebp - 4], 3
call fcn.100021ef
push edi
lea eax, [ebp - 0x30]
push eax
call fcn.10005536
cmp dword [ebp - 0x190], ebx
je 0x100066f3
mov dword [ebp - 0x198], 0x69
lea edi, [ebp - 0x18c]
call fcn.10001363
mov eax, edi
push eax
mov byte [ebp - 4], 6
call fcn.1001da80
pop ecx
test eax, eax
je 0x10006775
mov eax, edi
push eax
lea ecx, [ebp - 0x1d8]
call fcn.100011df
pop ecx
mov byte [ebp - 4], 7
cmp dword [eax + 0x18], 8
jb 0x1000672d
mov eax, dword [eax + 4]
jmp 0x10006730
add eax, 4
push eax
push 0x10058014
lea ecx, [ebp - 0x1bc]
call fcn.1002d7c0
pop ecx
pop ecx
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 8
call fcn.10005b87
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x1bc]
call fcn.100021ef
push ebx
push edi
lea esi, [ebp - 0x1d8]
mov byte [ebp - 4], 6
call fcn.100021ef
jmp 0x10006778
xor edi, edi
inc edi
push 4
pop esi
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x19c]
push eax
push str.__activeRule
push str.Softwareprojonepodlp_smpcache_
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x190], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100067bf
cmp dword [ebp - 0x19c], esi
jne 0x100067bf
mov eax, dword [ebp - 0x1a0]
jmp 0x100067c1
xor eax, eax
cmp eax, ebx
je 0x100067de
cmp eax, 2
mov eax, str._u7bVeu
je 0x100067d4
mov eax, 0x1005805c
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.10005536
push 0x10057f9c
call fcn.10005d87
pop ecx
test eax, eax
jne 0x10006811
mov eax, dword [ebp - 0x194]
cmp dword [eax + 0x3d8], ebx
jne 0x10006811
push str.CryptEnabled
call fcn.10005d87
pop ecx
test eax, eax
je 0x1000681f
push 0x1005808c
jmp 0x10006816
push 0x10058074
lea eax, [ebp - 0x30]
push eax
call fcn.10005536
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x1000682b
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x198]
mov eax, dword [ebp - 0x194]
push edi
call fcn.1000687a
lea esi, [ebp - 0x18c]
call fcn.10001a1c
push ebx
push edi
lea esi, [ebp - 0x68]
call fcn.100021ef
push ebx
push edi
lea esi, [ebp - 0x30]
call fcn.100021ef
push ebx
push edi
lea esi, [ebp - 0x4c]
call fcn.100021ef
push ebx
push edi
lea ecx, [ebp - 0x88]
call fcn.100020f3
call fcn.10037ddd
ret