Function at 0x1001bfb0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
jmp 0x10093930
push esi
call fcn.1004f190
mov esi, eax
call fcn.10097220
test esi, esi
je 0x10093946
call fcn.10098920
call fcn.10093980
test esi, esi
je 0x10093954
call fcn.10093e00
call fcn.10094230
test esi, esi
je 0x10093962
call fcn.100944c0
call fcn.10094d40
test esi, esi
je 0x10093970
call fcn.100950c0
call fcn.10095420
test esi, esi
pop esi
je 0x1009397f
jmp 0x100963b0
ret
mov eax, 0x2dcc
call fcn.10126240
mov eax, dword [0x1017455c]
xor eax, esp
mov dword [esp + 0x2dc8], eax
push esi
push 0x40f
xor esi, esi
lea eax, [esp + 0x21a1]
push esi
push eax
mov byte [esp + 0x21a8], 0
call fcn.10116880
push 0x40f
lea ecx, [esp + 0x1889]
push esi
push ecx
mov byte [esp + 0x1890], 0
call fcn.10116880
push 0x40f
lea edx, [esp + 0x855]
push esi
push edx
mov byte [esp + 0x85c], 0
call fcn.10116880
push 0x40f
lea eax, [esp + 0x1081]
push esi
push eax
mov byte [esp + 0x1088], 0
call fcn.10116880
push 0x40f
lea ecx, [esp + 0x149d]
push esi
push ecx
mov byte [esp + 0x14a4], 0
call fcn.10116880
push 0x40f
lea edx, [esp + 0x25ed]
push esi
push edx
mov byte [esp + 0x25f4], 0
call fcn.10116880
add esp, 0x48
push 0x40f
lea eax, [esp + 0xc4d]
push esi
push eax
mov byte [esp + 0xc54], 0
call fcn.10116880
push 0x40f
lea ecx, [esp + 0x29]
push esi
push ecx
mov byte [esp + 0x30], 0
call fcn.10116880
push 0x40f
lea edx, [esp + 0x29d9]
push esi
push edx
mov byte [esp + 0x29e0], 0
call fcn.10116880
add esp, 0x24
cmp dword [0x1018e0b4], 0xffffffff
jne 0x100964dc
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x100964dc
mov dword [0x1018e0b4], esi
cmp dword [0x10191cb8], esi
jne 0x10097206
push ebx
push ebp
push edi
lea eax, [esp + 0x844]
push 0x1013f817
push eax
call fcn.1010d6a8
add esp, 8
lea ecx, [esp + 0x20]
push ecx
push 0x20119
lea edx, [esp + 0x84c]
push edx
push closesocket
call fcn.10062150
test eax, eax
jne 0x10097203
mov dword [esp + 0x1c], esi
cmp dword [0x10191cb8], esi
jne 0x10097203
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ebx, [ebx]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
push 0x410
lea eax, [esp + 0x438]
push eax
push ecx
push edx
mov ebx, 1
mov byte [esp + 0x444], 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100971f8
cmp dword [0x10191874], eax
je 0x10096585
push 0x10191c8c
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cbc], ebx
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x1888]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x1884]
push str.igfx.CUITestConfig.1
push edx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x100971e5
lea eax, [esp + 0x1884]
push str.HeaderFooter.HeaderFooter.1
push eax
call fcn.1011c280
add esp, 8
test eax, eax
je 0x100971e5
lea ecx, [esp + 0x1884]
push str.ADCS
push ecx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x100971e5
lea edx, [esp + 0x1884]
push str.WBEMComLocator
push edx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x100971e5
mov eax, str.Nero
lea ecx, [esp + 0x1884]
call fcn.10031940
test eax, eax
je 0x100971e5
lea eax, [esp + 0x1884]
push str.TimeStamp
push eax
call fcn.1011c280
add esp, 8
test eax, eax
je 0x100971e5
lea ecx, [esp + 0x1884]
push str.kavvlg.kavvlg
push ecx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x100971e5
lea edx, [esp + 0x1884]
push str.kavvlg.kavvlg.1
push edx
call fcn.1011c280
add esp, 8
test eax, eax
je 0x100971e5
lea eax, [esp + 0x434]
push eax
lea ecx, [esp + 0x848]
push str._s_shellopencommand
push ecx
call fcn.1010d6a8
lea edx, [esp + 0x440]
push edx
lea eax, [esp + 0x1074]
push str.HKCR64_s_shell
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x44c]
push ecx
lea edx, [esp + 0x1490]
push str.HKCR64_s_shellopencommand
push edx
call fcn.1010d6a8
add esp, 0x24
lea eax, [esp + 0x10]
push eax
push 0x20119
lea ecx, [esp + 0x84c]
push ecx
push closesocket
call fcn.10062150
test eax, eax
jne 0x10096805
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push edx
mov dword [esp + 0x2c], 0x410
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x24], 0
je 0x10096805
xor edi, edi
lea esi, [esp + 0x24]
call fcn.10014dd0
test eax, eax
jne 0x10096805
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10096784
lea eax, [esp + eax + 0x24]
mov ecx, esi
cmp eax, ecx
jbe 0x10096805
jmp 0x10096770
cmp byte [eax], 0x20
je 0x10096784
sub eax, ebx
lea edx, [esp + 0x24]
cmp eax, edx
ja 0x10096770
jmp 0x10096805
lea eax, [esp + 0x434]
push eax
call fcn.100152f0
add esp, 4
test eax, eax
jne 0x10096805
lea edi, [esp + 0x434]
call fcn.10014390
test eax, eax
jne 0x10096805
cmp dword [0x10191874], eax
je 0x100967bb
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], ebx
cmp dword [0x1018e0b4], 0xffffffff
jne 0x100967e3
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x100967e3
mov dword [0x1018e0b4], 0
lea ecx, [esp + 0x24]
push ecx
push 1
push 4
lea ecx, [esp + 0x1070]
mov ebx, str.open
call fcn.10093730
add esp, 0xc
mov ebx, 1
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x848]
push str._s_shellenqueuecommand
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x1074]
push str.HKCR64_s_shell
push edx
call fcn.1010d6a8
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x1490]
push str.HKCR64_s_shellenqueuecommand
push ecx
call fcn.1010d6a8
add esp, 0x24
lea edx, [esp + 0x10]
push edx
push 0x20119
lea eax, [esp + 0x84c]
push eax
push closesocket
call fcn.10062150
test eax, eax
jne 0x10096985
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x2c], al
lea eax, [esp + 0x20]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x410
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x24], 0
je 0x10096985
xor edi, edi
lea esi, [esp + 0x24]
call fcn.10014dd0
test eax, eax
jne 0x10096985
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10096904
lea eax, [esp + eax + 0x24]
mov ecx, esi
cmp eax, ecx
jbe 0x10096985
jmp 0x100968f0
cmp byte [eax], 0x20
je 0x10096904
sub eax, ebx
lea edx, [esp + 0x24]
cmp eax, edx
ja 0x100968f0
jmp 0x10096985
lea eax, [esp + 0x434]
push eax
call fcn.100152f0
add esp, 4
test eax, eax
jne 0x10096985
lea edi, [esp + 0x434]
call fcn.10014390
test eax, eax
jne 0x10096985
cmp dword [0x10191874], eax
je 0x1009693b
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], ebx
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10096963
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10096963
mov dword [0x1018e0b4], 0
lea ecx, [esp + 0x24]
push ecx
push 1
push 4
lea ecx, [esp + 0x1070]
mov ebx, str.enqueue
call fcn.10093730
add esp, 0xc
mov ebx, 1
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x848]
push str._s_shellplaycommand
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x1074]
push str.HKCR64_s_shell
push edx
call fcn.1010d6a8
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x1490]
push str.HKCR64_s_shellplaycommand
push ecx
call fcn.1010d6a8
add esp, 0x24
lea edx, [esp + 0x10]
push edx
push 0x20119
lea eax, [esp + 0x84c]
push eax
push closesocket
call fcn.10062150
test eax, eax
jne 0x10096b05
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x2c], al
lea eax, [esp + 0x20]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x410
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x24], 0
je 0x10096b05
xor edi, edi
lea esi, [esp + 0x24]
call fcn.10014dd0
test eax, eax
jne 0x10096b05
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10096a84
lea eax, [esp + eax + 0x24]
mov ecx, esi
cmp eax, ecx
jbe 0x10096b05
jmp 0x10096a70
cmp byte [eax], 0x20
je 0x10096a84
sub eax, ebx
lea edx, [esp + 0x24]
cmp eax, edx
ja 0x10096a70
jmp 0x10096b05
lea eax, [esp + 0x434]
push eax
call fcn.100152f0
add esp, 4
test eax, eax
jne 0x10096b05
lea edi, [esp + 0x434]
call fcn.10014390
test eax, eax
jne 0x10096b05
cmp dword [0x10191874], eax
je 0x10096abb
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], ebx
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10096ae3
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10096ae3
mov dword [0x1018e0b4], 0
lea ecx, [esp + 0x24]
push ecx
push 1
push 4
lea ecx, [esp + 0x1070]
mov ebx, str.play
call fcn.10093730
add esp, 0xc
mov ebx, 1
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x848]
push str._s_shellprintcommand
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x1074]
push str.HKCR64_s_shell
push edx
call fcn.1010d6a8
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x1490]
push str.HKCR64_s_shellprintcommand
push ecx
call fcn.1010d6a8
add esp, 0x24
lea edx, [esp + 0x10]
push edx
push 0x20119
lea eax, [esp + 0x84c]
push eax
push closesocket
call fcn.10062150
test eax, eax
jne 0x10096c85
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x2c], al
lea eax, [esp + 0x20]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x410
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x24], 0
je 0x10096c85
xor edi, edi
lea esi, [esp + 0x24]
call fcn.10014dd0
test eax, eax
jne 0x10096c85
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10096c04
lea eax, [esp + eax + 0x24]
mov ecx, esi
cmp eax, ecx
jbe 0x10096c85
jmp 0x10096bf0
cmp byte [eax], 0x20
je 0x10096c04
sub eax, ebx
lea edx, [esp + 0x24]
cmp eax, edx
ja 0x10096bf0
jmp 0x10096c85
lea eax, [esp + 0x434]
push eax
call fcn.100152f0
add esp, 4
test eax, eax
jne 0x10096c85
lea edi, [esp + 0x434]
call fcn.10014390
test eax, eax
jne 0x10096c85
cmp dword [0x10191874], eax
je 0x10096c3b
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], ebx
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10096c63
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10096c63
mov dword [0x1018e0b4], 0
lea ecx, [esp + 0x24]
push ecx
push 1
push 4
lea ecx, [esp + 0x1070]
mov ebx, str.print
call fcn.10093730
add esp, 0xc
mov ebx, 1
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x848]
push str._s_shellprinttocommand
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x1074]
push str.HKCR64_s_shell
push edx
call fcn.1010d6a8
lea eax, [esp + 0x44c]
push eax
lea ecx, [esp + 0x1490]
push str.HKCR64_s_shellprinttocommand
push ecx
call fcn.1010d6a8
add esp, 0x24
lea edx, [esp + 0x10]
push edx
push 0x20119
lea eax, [esp + 0x84c]
push eax
push closesocket
call fcn.10062150
test eax, eax
jne 0x10096dfd
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x28]
push edx
mov byte [esp + 0x2c], al
lea eax, [esp + 0x20]
push eax
push 0
push 0
push ecx
mov dword [esp + 0x2c], 0x410
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x24], 0
je 0x10096dfd
xor edi, edi
lea esi, [esp + 0x24]
call fcn.10014dd0
test eax, eax
jne 0x10096dfd
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10096d81
lea eax, [esp + eax + 0x24]
mov ecx, esi
cmp eax, ecx
jbe 0x10096dfd
jmp 0x10096d70
cmp byte [eax], 0x20
je 0x10096d81
sub eax, ebx
lea edx, [esp + 0x24]
cmp eax, edx
ja 0x10096d70
jmp 0x10096dfd
lea eax, [esp + 0x434]
push eax
call fcn.100152f0
add esp, 4
test eax, eax
jne 0x10096dfd
lea edi, [esp + 0x434]
call fcn.10014390
test eax, eax
jne 0x10096dfd
cmp dword [0x10191874], eax
je 0x10096db8
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
add dword [0x10191cc4], ebx
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10096de0
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10096de0
mov dword [0x1018e0b4], 0
lea ecx, [esp + 0x24]
push ecx
push 1
push 4
lea ecx, [esp + 0x1070]
mov ebx, str.printto
call fcn.10093730
add esp, 0xc
cmp byte [esp + 0x434], 0x2e
jne 0x1009709d
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x848]
push 0x1013fb04
push eax
xor esi, esi
call fcn.1010d6a8
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x1484]
push str.HKCR64_s
push edx
call fcn.1010d6a8
add esp, 0x18
lea eax, [esp + 0x10]
push eax
push 0x20119
lea ecx, [esp + 0x84c]
push ecx
push closesocket
call fcn.10062150
test eax, eax
jne 0x1009709d
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
mov byte [esp + 0x20a8], al
mov byte [esp + 0xc58], al
lea eax, [esp + 0x20a8]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push str.NoOpen
mov edi, 0x410
push edx
mov dword [esp + 0x2c], edi
call ebp
test eax, eax
jne 0x10096ea5
lea esi, [eax + 1]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc58]
push ecx
lea edx, [esp + 0x20]
push edx
push 0
push 0
push eax
mov dword [esp + 0x2c], edi
call ebp
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x1009709d
cmp byte [esp + 0xc54], 0
je 0x1009709d
lea edx, [esp + 0xc54]
push 0x20
push edx
call fcn.1010d780
add esp, 8
test eax, eax
jne 0x1009709d
push str..AssocFile.
lea ecx, [esp + 0xc58]
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
jne 0x1009709d
lea eax, [esp + 0xc54]
push eax
lea ecx, [esp + 0x848]
push 0x1013fb04
push ecx
call fcn.1010d6a8
add esp, 0xc
lea edx, [esp + 0x10]
push edx
push 0x20119
lea eax, [esp + 0x84c]
push eax
push closesocket
call fcn.10062150
test eax, eax
je 0x10097092
lea ecx, [esp + 0x434]
push ecx
lea edx, [esp + 0x848]
push str._s_shellopencommand
push edx
call fcn.1010d6a8
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0x20119
lea ecx, [esp + 0x84c]
push ecx
push closesocket
call fcn.10062150
test eax, eax
jne 0x10097025
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
mov byte [esp + 0x1c98], al
lea eax, [esp + 0x1c98]
push eax
push esi
push esi
push esi
push ecx
mov dword [esp + 0x2c], edi
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [esp + 0x1c94], 0
je 0x10097025
xor edi, edi
lea esi, [esp + 0x1c94]
call fcn.10014dd0
test eax, eax
jne 0x1009709d
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10097025
lea eax, [esp + eax + 0x1c94]
mov ecx, esi
cmp eax, ecx
jbe 0x1009709d
cmp byte [eax], 0x20
je 0x10097025
dec eax
lea edx, [esp + 0x1c94]
cmp eax, edx
ja 0x10097012
jmp 0x1009709d
lea eax, [esp + 0x434]
push eax
call fcn.100152f0
add esp, 4
test eax, eax
jne 0x1009709d
cmp dword [0x10191874], eax
je 0x1009704c
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x10191cc4]
cmp dword [0x1018e0b4], 0xffffffff
jne 0x10097074
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x10097074
mov dword [0x1018e0b4], 0
push 0
push 1
push 5
lea ecx, [esp + 0x1480]
lea ebx, [esp + 0xc60]
call fcn.10093730
add esp, 0xc
jmp 0x1009709d
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x434]
push edx
lea eax, [esp + 0x848]
push str._sDefaultIcon
push eax
call fcn.1010d6a8
lea ecx, [esp + 0x440]
push ecx
lea edx, [esp + 0x1484]
push str.HKCR64_sDefaultIcon
push edx
call fcn.1010d6a8
add esp, 0x18
lea eax, [esp + 0x10]
push eax
push 0x20119
lea ecx, [esp + 0x84c]
push ecx
push closesocket
call fcn.10062150
test eax, eax
jne 0x100971df
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea ebx, [eax + 1]
lea eax, [esp + 0xc58]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push 0
push edx
mov dword [esp + 0x2c], 0x410
call ebp
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
lea esi, [esp + 0xc54]
call fcn.10014dd0
test eax, eax
jne 0x10097171
push 0x1014a6b4
mov ecx, esi
call fcn.10047020
add esp, 4
cmp eax, 0xffffffff
je 0x10097173
lea eax, [esp + eax + 0xc54]
mov ecx, esi
cmp eax, ecx
jbe 0x10097171
mov edi, edi
cmp byte [eax], 0x20
je 0x10097173
dec eax
lea edx, [esp + 0xc54]
cmp eax, edx
ja 0x10097160
xor ebx, ebx
cmp byte [esp + 0xc54], 0x40
je 0x100971df
test ebx, ebx
je 0x100971df
cmp dword [0x10191874], 0
je 0x10097195
push 0x10191cac
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
inc dword [0x10191cc4]
cmp dword [0x1018e0b4], 0xffffffff
jne 0x100971bd
call sym.EncDec.dll_isRunningAsAdministrator
mov dword [0x1018e0b4], eax
cmp eax, 0xffffffff
jne 0x100971bd
mov dword [0x1018e0b4], 0
lea eax, [esp + 0xc54]
push eax
push 1
push 0x10
lea ecx, [esp + 0x1480]
lea ebx, [esp + 0x850]
call fcn.10093730
add esp, 0xc
inc dword [esp + 0x1c]
jmp 0x100971e9
add dword [esp + 0x1c], ebx
cmp dword [0x10191cb8], 0
je 0x10096540
jmp 0x10097203
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x2dcc]
pop esi
xor ecx, esp
xor eax, eax
call fcn.1010d699
add esp, 0x2dcc
ret