Function at 0x10014873
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x100440b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov edi, edx
mov dword [ebp - 0x220], edi
mov esi, ecx
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x21c], ebx
mov dword [ebp - 0x214], ebx
call fcn.10016e9e
test al, al
je 0x100148c8
push dword [ebp + 8]
mov edx, edi
mov ecx, esi
call fcn.100152f6
test al, al
je 0x100148c8
xor eax, eax
inc eax
jmp 0x10014af5
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x214]
push eax
push 1
push ebx
push esi
push SysReAllocString
call edi
test eax, eax
jne 0x10014af3
push 0xffffffffffffffff
push str.shellopencommand
lea eax, [ebp - 0x210]
push 0x101
push eax
call fcn.100152f6
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 1
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call edi
test eax, eax
je 0x100149f5
lea eax, [ebp - 0x214]
push eax
push 1
push ebx
push esi
push SysReAllocString
call edi
mov esi, eax
test esi, esi
jne 0x10014a24
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x200
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x10014a24
cmp dword [ebp - 0x21c], 1
jne 0x100149aa
cmp dword [ebp - 0x218], ebx
jbe 0x100149aa
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x214]
push eax
push 1
push ebx
lea eax, [ebp - 0x210]
push eax
push SysReAllocString
call edi
mov esi, eax
test esi, esi
jne 0x10014a24
push 0xffffffffffffffff
push str.shellopencommand
lea eax, [ebp - 0x210]
push 0x101
push eax
call fcn.100152f6
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
push 1
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x214]
call edi
mov esi, eax
test esi, esi
jne 0x10014a24
cmp dword [ebp - 0x21c], 1
jne 0x10014a24
cmp dword [ebp - 0x218], ebx
jbe 0x10014a24
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x200
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp dword [ebp - 0x214], ebx
je 0x10014a38
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10014af3
xor eax, eax
lea esi, [ebp - 0x210]
push 0x22
mov word [ebp - 0x10], ax
pop eax
cmp ax, word [ebp - 0x210]
jne 0x10014a72
push eax
lea esi, [ebp - 0x20e]
mov eax, esi
push eax
call fcn.100152f6
pop ecx
pop ecx
test eax, eax
je 0x10014a72
xor ecx, ecx
mov word [eax], cx
push 0x2f
push esi
call fcn.100152f6
pop ecx
pop ecx
test eax, eax
je 0x10014a85
xor ecx, ecx
mov word [eax], cx
push 0x25
push esi
call fcn.100152f6
pop ecx
pop ecx
test eax, eax
je 0x10014a98
xor ecx, ecx
mov word [eax], cx
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x10014a9d
sub ecx, edx
sar ecx, 1
jmp 0x10014ac3
push 0x20
pop eax
cmp ax, word [esi + ecx*2]
jne 0x10014ace
xor eax, eax
mov word [esi + ecx*2], ax
mov ecx, dword [ebp - 0x218]
sub ecx, 1
mov dword [ebp - 0x218], ecx
jne 0x10014aae
mov eax, dword [ebp - 0x220]
test eax, eax
je 0x10014aef
push 0xffffffffffffffff
push esi
push dword [ebp + 8]
push eax
call fcn.100152f6
xor ebx, ebx
add esp, 0x10
cmp eax, 0x50
setne bl
mov eax, ebx
jmp 0x10014af5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001eea4
leave
ret 4