Function at 0x101e4c3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x70
mov eax, 0x1020d9a
call fcn.01017758
mov eax, ecx
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x78], ecx
cmp esi, ebx
jne 0x101e4f0
mov eax, 0x80070057
jmp 0x101e6cc
push 0x5c
pop ecx
cmp cx, word [esi]
jne 0x101e4fa
inc esi
inc esi
push dword [eax + 0x10]
lea ecx, [ebp - 0x6c]
call fcn.01006860
push 0x100256c
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], ebx
call fcn.01006860
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0101e44c
mov ecx, dword [ebp - 0x68]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x101e534
call fcn.01004de0
push esi
lea ecx, [ebp - 0x68]
call fcn.01006860
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0101e44c
mov ecx, dword [ebp - 0x68]
cmp ecx, ebx
je 0x101e559
call fcn.01004de0
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x64], ebx
cmp edi, ebx
je 0x101e567
mov eax, dword [edi]
jmp 0x101e569
xor eax, eax
lea ecx, [ebp - 0x64]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x101e5ab
jle 0x101e58f
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.0101dd7e
cmp edi, ebx
je 0x101e5a4
mov ecx, edi
call fcn.01004de0
mov eax, esi
jmp 0x101e6cc
xor eax, eax
push 0x4e
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x1002564
push dword [ebp - 0x64]
mov dword [ebp - 0x7c], 0x50
call esi
cmp eax, ebx
jne 0x101e583
cmp dword [ebp - 0x70], 1
je 0x101e60e
lea ecx, [ebp - 0x64]
call fcn.0101dd7e
cmp edi, ebx
je 0x101e604
mov ecx, edi
call fcn.01004de0
mov eax, 0x80020005
jmp 0x101e6cc
push dword [ebp - 0x74]
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
mov edi, eax
cmp edi, ebx
jge 0x101e642
lea ecx, [ebp - 0x64]
call fcn.0101dd7e
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e63b
call fcn.01004de0
mov eax, edi
jmp 0x101e6cc
cmp dword [ebp - 0x78], ebx
je 0x101e6b6
push 4
pop edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x1002558
push dword [ebp - 0x64]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x74], edi
call esi
cmp eax, ebx
je 0x101e691
jle 0x101e677
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.0101dd7e
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e5a4
jmp 0x101e59f
cmp dword [ebp - 0x70], edi
je 0x101e6ae
lea ecx, [ebp - 0x64]
call fcn.0101dd7e
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e604
jmp 0x101e5ff
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
lea ecx, [ebp - 0x64]
call fcn.0101dd7e
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e6ca
call fcn.01004de0
xor eax, eax
call fcn.010177ac
ret 0xc