Function at 0x10018330
Capabilities:
Link many functions at runtime
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1005a6e0
push 0x10021870
mov eax, dword fs:[0]
push eax
sub esp, 0x494
mov eax, dword [0x1005e068]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x48c], edx
mov eax, ecx
mov dword [ebp - 0x488], eax
mov dword [ebp - 0x4a0], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x484], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x49c], eax
xor edi, edi
mov dword [ebp - 0x474], edi
push 0x40
push edi
lea eax, [ebp - 0x5c]
push eax
call fcn.10022540
push 0x208
push edi
lea eax, [ebp - 0x264]
push eax
call fcn.10022540
push 0x208
push edi
lea eax, [ebp - 0x46c]
push eax
call fcn.10022540
add esp, 0x24
push 0x100575f0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x480], eax
push 0x10057628
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [ebp - 0x470], eax
push 0x1005760c
push dword [ebp - 0x480]
call esi
mov dword [ebp - 0x490], eax
push str.RegEnumValueW
push dword [ebp - 0x480]
call esi
push 0x1005764c
push dword [ebp - 0x480]
call esi
push 0x1005761c
push dword [ebp - 0x480]
call esi
mov dword [ebp - 0x4a4], eax
mov dword [ebp - 4], edi
lea eax, [ebp - 0x478]
push eax
push 0x20019
push edi
push dword [ebp - 0x48c]
mov esi, dword [ebp - 0x488]
push esi
call dword [ebp - 0x490]
test eax, eax
je 0x10018464
or edi, 0xffffffff
mov dword [ebp - 0x474], edi
jmp case.0x10018471.5
mov eax, dword [ebp + 0xc]
dec eax
cmp eax, 6
ja case.0x10018471.5
jmp dword [eax*4 + 0x100186bc]
mov dword [ebp - 0x47c], 0x208
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push ebx
push dword [ebp - 0x478]
call dword [ebp - 0x470]
test eax, eax
jne case.0x10018471.5
lea ecx, [ebp - 0x264]
call fcn.100182c0
push eax
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, 1
mov dword [ebp - 0x474], edi
jmp case.0x10018471.5
mov dword [ebp - 0x47c], 0x208
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push ebx
push dword [ebp - 0x478]
call dword [ebp - 0x470]
test eax, eax
jne case.0x10018471.5
lea esi, [ebp - 0x264]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x46c]
cmp word [esi], 0
je 0x10018549
push esi
push eax
call edi
push 0x10056314
lea eax, [ebp - 0x46c]
push eax
call edi
mov dword [ebp - 0x494], esi
cmp word [esi], 0
je 0x10018542
add esi, 2
jmp 0x10018531
mov esi, 2
jmp 0x10018513
push eax
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, 1
mov dword [ebp - 0x474], edi
jmp 0x1001864f
mov dword [ebp - 0x47c], 4
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x498]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push ebx
push dword [ebp - 0x478]
call dword [ebp - 0x470]
test eax, eax
jne case.0x10018471.5
push dword [ebp - 0x498]
push 0x10056778
mov eax, dword [ebp - 0x484]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov edi, 1
mov dword [ebp - 0x474], edi
jmp case.0x10018471.5
mov dword [ebp - 0x470], 0
lea eax, [ebp - 0x470]
push eax
push 0
push 0
push 0
push ebx
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100185f8
or edi, 0xffffffff
mov dword [ebp - 0x474], edi
jmp case.0x10018471.5
push dword [ebp - 0x470]
call fcn.1001fd9a
add esp, 4
mov esi, eax
lea eax, [ebp - 0x470]
push eax
push esi
push 0
push 0
push ebx
push dword [ebp - 0x478]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10018639
push esi
call fcn.1001fdc6
add esp, 4
or edi, 0xffffffff
mov dword [ebp - 0x474], edi
jmp 0x1001864f
mov eax, dword [ebp - 0x484]
mov dword [eax], esi
mov eax, dword [ebp - 0x470]
mov ecx, dword [ebp - 0x49c]
mov dword [ecx], eax
mov esi, dword [ebp - 0x488]
nop word [eax + eax]
mov dword [ebp - 4], 0xfffffffe
call fcn.100186a7
mov eax, dword [ebp - 0x480]
test eax, eax
je 0x1001867d
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1001f7ed
mov esp, ebp
pop ebp
ret