Function at 0x100b8080
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10131d22
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x32e0
call fcn.100e39d0
mov eax, dword [0x10188068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x32c8], eax
cmp byte [eax + 0x38], 0
jne 0x100b8c84
mov byte [eax + 0x38], 1
lea edi, [ebp - 0x288]
mov ecx, 0x20
mov dword [ebp - 0x32c4], 0
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFontLinkSystemLink
mov dword [ebp - 0x32c0], 0
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x19
lea eax, [ebp - 0x32c4]
push eax
push 1
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x288]
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
lea edi, [ebp - 0x200]
rep movsd dword es:[edi], dword [esi]
push 0
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call edi
test eax, eax
jne 0x100b8c84
mov esi, dword [ebp - 0x32c4]
mov dword [ebp - 0x32dc], esi
mov dword [ebp - 0x32f0], esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x32c0]
push eax
push 1
push 0
lea eax, [ebp - 0x200]
push eax
push 0x80000002
call edi
test eax, eax
je 0x100b817c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100b8c84
mov eax, dword [ebp - 0x32c0]
mov dword [ebp - 0x32e0], eax
mov dword [ebp - 0x32e4], eax
push 0x80
lea eax, [ebp - 0x198]
mov byte [ebp - 4], 1
push 0
push eax
call fcn.100fc650
add esp, 0xc
lea eax, [ebp - 0x3288]
push 0x800
push 0
push eax
call fcn.100fc650
add esp, 0xc
lea eax, [ebp - 0x1288]
push 0x800
push 0
push eax
call fcn.100fc650
add esp, 0xc
mov dword [ebp - 0x32ac], 0x400
lea eax, [ebp - 0x32b4]
mov dword [ebp - 0x32b4], 0x7fe
mov dword [ebp - 0x32a8], 0
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x32a8]
push eax
push 0
lea eax, [ebp - 0x32ac]
push eax
lea eax, [ebp - 0x3288]
push eax
push 0
push dword [ebp - 0x32c4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, 1
mov dword [ebp - 0x32b0], edi
cmp eax, 0x103
je 0x100b885d
nop dword [eax + eax]
test eax, eax
jne 0x100b885d
cmp dword [ebp - 0x32a8], 7
jne 0x100b87cf
xor esi, esi
xor edi, edi
mov dword [ebp - 0x32d4], edi
mov dword [ebp - 0x32d0], esi
mov dword [ebp - 0x32cc], esi
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1288]
mov dword [ebp - 0x32b8], eax
cmp word [ebp - 0x1288], si
je 0x100b862d
mov edi, eax
nop word [eax + eax]
push 0x800
lea eax, [ebp - 0xa88]
push 0
push eax
call fcn.100fc650
add esp, 0xc
lea eax, [ebp - 0x1a88]
push 0x800
push 0
push eax
call fcn.100fc650
lea ecx, [ebp - 0x1a88]
add esp, 0xc
mov eax, ecx
mov edx, 0x400
sub edi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x100b82ee
movzx eax, word [edi + ecx]
test ax, ax
je 0x100b82ee
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100b82d0
lea eax, [ecx - 2]
test edx, edx
push 0x2c
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x1a88]
push eax
call fcn.100fb5ec
add esp, 8
test eax, eax
je 0x100b837b
lea edi, [eax + 2]
movzx eax, word [edi]
push eax
call fcn.10116ef9
add esp, 4
test eax, eax
jne 0x100b85f8
movzx eax, word [edi]
push eax
call fcn.10116ef9
add esp, 4
test eax, eax
jne 0x100b852f
lea ecx, [ebp - 0xa88]
mov edx, 0x400
mov eax, ecx
sub edi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x100b836e
movzx eax, word [edi + ecx]
test ax, ax
je 0x100b836e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100b8350
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
jmp 0x100b852a
xor eax, eax
xor edi, edi
push 0x800
mov word [ebp - 0xa88], ax
lea eax, [ebp - 0x2a88]
push edi
push eax
call fcn.100fc650
add esp, 0xc
lea eax, [ebp - 0x2288]
push 0x800
push edi
push eax
call fcn.100fc650
add esp, 0xc
mov dword [ebp - 0x32d8], 0x400
lea eax, [ebp - 0x32a4]
mov dword [ebp - 0x32a4], 0x7fe
push eax
lea eax, [ebp - 0x2288]
push eax
lea eax, [ebp - 0x32bc]
push eax
push edi
lea eax, [ebp - 0x32d8]
push eax
lea eax, [ebp - 0x2a88]
push eax
push edi
push dword [ebp - 0x32c0]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
je 0x100b84ed
test eax, eax
jne 0x100b84ed
cmp dword [ebp - 0x32bc], 1
jne 0x100b842d
lea eax, [ebp - 0x1a88]
push eax
lea eax, [ebp - 0x2288]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x100b84ad
push 0x800
lea eax, [ebp - 0x2a88]
inc edi
push 0
push eax
call fcn.100fc650
add esp, 0xc
lea eax, [ebp - 0x2288]
push 0x800
push 0
push eax
call fcn.100fc650
add esp, 0xc
mov dword [ebp - 0x32d8], 0x400
lea eax, [ebp - 0x32a4]
mov dword [ebp - 0x32a4], 0x7fe
push eax
lea eax, [ebp - 0x2288]
push eax
lea eax, [ebp - 0x32bc]
push eax
push 0
lea eax, [ebp - 0x32d8]
push eax
lea eax, [ebp - 0x2a88]
push eax
push edi
push dword [ebp - 0x32c0]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x100b8400
jmp 0x100b84ed
lea ecx, [ebp - 0xa88]
mov edx, 0x400
lea edi, [ebp - 0x2a88]
mov eax, ecx
sub edi, eax
lea eax, [edx + 0x7ffffbfe]
test eax, eax
je 0x100b84e0
movzx eax, word [edi + ecx]
test ax, ax
je 0x100b84e0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100b84c2
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0xa88], 0
je 0x100b85f8
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
lea eax, [ebp - 0xa88]
push 0x10168690
push eax
call edi
test eax, eax
je 0x100b8518
xor ecx, ecx
mov word [eax], cx
push 0x10168710
lea eax, [ebp - 0xa88]
push eax
call edi
test eax, eax
je 0x100b852f
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov dword [ebp - 0x3290], 0
lea ecx, [ebp - 0xa88]
mov dword [ebp - 0x328c], 7
mov word [ebp - 0x32a0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8555
sub ecx, edx
lea eax, [ebp - 0xa88]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x32a0]
call fcn.10043b50
mov byte [ebp - 4], 3
cmp dword [ebp - 0x32cc], esi
je 0x100b85d0
movups xmm0, xmmword [ebp - 0x32a0]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x32a0], ax
movq xmm0, qword [ebp - 0x3290]
movq qword [esi + 0x10], xmm0
add esi, 0x18
mov dword [ebp - 0x3290], 0
mov dword [ebp - 0x328c], 7
mov dword [ebp - 0x32d0], esi
jmp 0x100b85e9
lea eax, [ebp - 0x32a0]
push eax
push esi
lea ecx, [ebp - 0x32d4]
call fcn.1006ec00
mov esi, dword [ebp - 0x32d0]
lea ecx, [ebp - 0x32a0]
mov byte [ebp - 4], 2
call fcn.10043ac0
mov edi, dword [ebp - 0x32b8]
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8603
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
add edi, 2
mov dword [ebp - 0x32b8], edi
cmp word [edi], ax
jne 0x100b8290
mov edi, dword [ebp - 0x32d4]
push 0x100
lea eax, [ebp - 0x118]
push 0
push eax
call fcn.100fc650
lea ecx, [ebp - 0x118]
add esp, 0xc
mov esi, ecx
lea eax, [ebp - 0x3288]
sub eax, esi
mov edx, 0x80
mov esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7fffff7e]
test eax, eax
je 0x100b867e
movzx eax, word [esi + ecx]
test ax, ax
je 0x100b867e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100b8660
lea eax, [ecx - 2]
test edx, edx
push 0x80
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x118]
push eax
call fcn.10129641
lea eax, [ebp - 0x118]
push str.Tahoma
push eax
call fcn.10108488
mov esi, dword [ebp - 0x32d0]
add esp, 0x10
test eax, eax
jne 0x100b871c
cmp edi, esi
je 0x100b871c
mov eax, dword [ebp - 0x32d4]
cmp dword [eax + 0x14], 8
jb 0x100b86cc
mov edi, dword [eax]
lea ecx, [ebp - 0x198]
mov edx, 0x40
mov eax, ecx
sub edi, eax
nop dword [eax + eax]
lea eax, [edx + 0x7fffffbe]
test eax, eax
je 0x100b86fe
movzx eax, word [edi + ecx]
test ax, ax
je 0x100b86fe
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100b86e0
lea eax, [ecx - 2]
test edx, edx
push 0x40
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x198]
push eax
call fcn.10129641
add esp, 8
mov edi, dword [ebp - 0x32d4]
cmp edi, esi
je 0x100b87ba
xor eax, eax
mov dword [ebp - 0x3290], 0
lea ecx, [ebp - 0x118]
mov dword [ebp - 0x328c], 7
mov word [ebp - 0x32a0], ax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8750
sub ecx, edx
lea eax, [ebp - 0x118]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x32a0]
call fcn.10043b50
mov ecx, dword [ebp - 0x32c8]
lea eax, [ebp - 0x32a0]
push eax
lea eax, [ebp - 0x32ec]
mov byte [ebp - 4], 4
push eax
call fcn.100bd340
mov ecx, dword [ebp - 0x32ec]
lea eax, [ebp - 0x32d4]
add ecx, 0x20
cmp ecx, eax
je 0x100b87af
push dword [ebp - 0x32e4]
push esi
push edi
call fcn.100bd680
lea ecx, [ebp - 0x32a0]
call fcn.10043ac0
lea ecx, [ebp - 0x32d4]
mov byte [ebp - 4], 1
call fcn.1006e710
mov edi, dword [ebp - 0x32b0]
push 0x800
lea eax, [ebp - 0x3288]
push 0
push eax
call fcn.100fc650
add esp, 0xc
lea eax, [ebp - 0x1288]
push 0x800
push 0
push eax
call fcn.100fc650
add esp, 0xc
mov dword [ebp - 0x32ac], 0x400
lea eax, [ebp - 0x32b4]
mov dword [ebp - 0x32b4], 0x7fe
mov dword [ebp - 0x32a8], 0
push eax
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x32a8]
push eax
push 0
lea eax, [ebp - 0x32ac]
push eax
lea eax, [ebp - 0x3288]
push eax
push edi
push dword [ebp - 0x32c4]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
mov dword [ebp - 0x32b0], edi
cmp eax, 0x103
jne 0x100b8240
lea ecx, [ebp - 0x198]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8866
mov edi, dword [ebp - 0x32c8]
lea eax, [ebp - 0x198]
sub ecx, edx
sar ecx, 1
push ecx
lea esi, [edi + 0x20]
push eax
mov ecx, esi
call fcn.10043b50
push esi
lea eax, [ebp - 0x32ec]
mov ecx, edi
push eax
call fcn.100bd4e0
mov eax, dword [ebp - 0x32ec]
add eax, 0x20
xor esi, esi
mov dword [ebp - 0x32a8], eax
mov dword [ebp - 0x32b0], esi
nop dword [eax]
nop word [eax + eax]
mov edi, dword [esi + 0x1015bd20]
test edi, edi
je 0x100b8aad
cmp word [edi], 0
je 0x100b8aad
push 0x80
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.100fc650
lea ecx, [ebp - 0x98]
add esp, 0xc
mov eax, ecx
mov edx, 0x40
sub edi, eax
nop dword [eax]
lea eax, [edx + 0x7fffffbe]
test eax, eax
je 0x100b891e
movzx eax, word [ecx + edi]
test ax, ax
je 0x100b891e
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100b8900
lea eax, [ecx - 2]
test edx, edx
push 0x40
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x98]
push eax
call fcn.10129641
mov ecx, dword [ebp - 0x32a8]
add esp, 8
mov eax, dword [ecx + 4]
mov edi, dword [ecx]
mov dword [ebp - 0x32ac], eax
cmp edi, eax
je 0x100b89e2
lea ecx, [ebp - 0x98]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8960
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x32b4], ecx
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x100b897f
mov eax, dword [edi]
mov edx, dword [edi + 0x10]
cmp edx, ecx
jne 0x100b89bf
lea ecx, [ebp - 0x98]
test edx, edx
je 0x100b89ce
mov esi, ecx
sub eax, esi
mov dword [ebp - 0x32bc], eax
nop word [eax + eax]
mov ax, word [ecx + eax]
cmp ax, word [ecx]
jne 0x100b89b9
add ecx, 2
sub edx, 1
je 0x100b89ce
mov eax, dword [ebp - 0x32bc]
jmp 0x100b89a0
mov ecx, dword [ebp - 0x32b4]
mov eax, dword [ebp - 0x32ac]
add edi, 0x18
cmp edi, eax
jne 0x100b8975
jmp 0x100b89d4
mov eax, dword [ebp - 0x32ac]
mov esi, dword [ebp - 0x32b0]
cmp edi, eax
jne 0x100b8aad
xor eax, eax
mov dword [ebp - 0x3290], 0
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x328c], 7
mov word [ebp - 0x32a0], ax
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100b8a10
sub ecx, edx
lea eax, [ebp - 0x98]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x32a0]
call fcn.10043b50
mov byte [ebp - 4], 5
mov edi, dword [ebp - 0x32a8]
mov eax, dword [edi + 4]
cmp dword [edi + 8], eax
je 0x100b8a8d
movups xmm0, xmmword [ebp - 0x32a0]
lea ecx, [ebp - 0x32a0]
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x3290]
movq qword [eax + 0x10], xmm0
xor eax, eax
add dword [edi + 4], 0x18
mov dword [ebp - 0x3290], 0
mov dword [ebp - 0x328c], 7
mov word [ebp - 0x32a0], ax
mov byte [ebp - 4], 1
call fcn.10043ac0
jmp 0x100b8ab3
lea ecx, [ebp - 0x32a0]
push ecx
push eax
mov ecx, edi
call fcn.1006ec00
lea ecx, [ebp - 0x32a0]
mov byte [ebp - 4], 1
call fcn.10043ac0
jmp 0x100b8ab3
mov edi, dword [ebp - 0x32a8]
add esi, 4
mov dword [ebp - 0x32b0], esi
cmp esi, 0x10
jb 0x100b88c0
mov eax, dword [edi]
mov esi, dword [ebp - 0x32dc]
cmp eax, dword [edi + 4]
je 0x100b8c73
mov ecx, dword [ebp - 0x32c8]
mov eax, dword [ecx + 4]
mov edi, dword [eax]
mov dword [ebp - 0x32b4], edi
cmp edi, eax
je 0x100b8c73
nop
cmp dword [ecx + 0x34], 8
lea eax, [ecx + 0x20]
mov ecx, eax
jb 0x100b8afd
mov ecx, dword [eax]
cmp dword [edi + 0x1c], 8
lea eax, [edi + 8]
jb 0x100b8b08
mov eax, dword [eax]
push ecx
push eax
call fcn.10108488
add esp, 8
test eax, eax
je 0x100b8c56
mov eax, dword [ebp - 0x32a8]
mov esi, dword [eax]
mov dword [ebp - 0x32bc], esi
cmp esi, dword [eax + 4]
je 0x100b8c56
lea edx, [edi + 0x20]
mov dword [ebp - 0x32b8], edx
nop word [eax + eax]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x32b0], esi
jb 0x100b8b54
mov eax, dword [esi]
mov dword [ebp - 0x32b0], eax
mov ecx, dword [edx]
mov eax, dword [edi + 0x24]
mov dword [ebp - 0x32a4], ecx
cmp ecx, eax
je 0x100b8c1a
mov esi, dword [ebp - 0x32b0]
mov edi, ecx
nop
mov ecx, esi
lea edx, [ecx + 2]
mov dword [ebp - 0x32b0], edx
nop dword [eax + eax]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x100b8b80
sub ecx, dword [ebp - 0x32b0]
sar ecx, 1
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x32a4], edi
jb 0x100b8ba7
mov edx, dword [edi]
mov dword [ebp - 0x32a4], edx
mov edx, dword [edi + 0x10]
mov dword [ebp - 0x32ac], edx
cmp edx, ecx
jne 0x100b8bed
cmp dword [ebp - 0x32ac], 0
mov edx, esi
jbe 0x100b8bf8
mov ecx, dword [ebp - 0x32a4]
sub ecx, esi
mov dword [ebp - 0x32a4], ecx
nop dword [eax]
mov cx, word [ecx + edx]
cmp cx, word [edx]
jne 0x100b8bed
add edx, 2
sub dword [ebp - 0x32ac], 1
je 0x100b8bf8
mov ecx, dword [ebp - 0x32a4]
jmp 0x100b8bd0
add edi, 0x18
cmp edi, eax
jne 0x100b8b70
mov esi, dword [ebp - 0x32bc]
mov edx, dword [ebp - 0x32b8]
mov dword [ebp - 0x32a4], edi
mov ecx, dword [ebp - 0x32a4]
mov edi, dword [ebp - 0x32b4]
cmp ecx, eax
jne 0x100b8c3e
mov eax, dword [edx + 4]
push esi
cmp dword [edx + 8], eax
je 0x100b8c33
mov ecx, eax
call fcn.10045090
add dword [edi + 0x24], 0x18
lea edx, [edi + 0x20]
jmp 0x100b8c3e
push eax
mov ecx, edx
call fcn.1004d440
lea edx, [edi + 0x20]
mov eax, dword [ebp - 0x32a8]
add esi, 0x18
mov dword [ebp - 0x32bc], esi
cmp esi, dword [eax + 4]
jne 0x100b8b40
mov ecx, dword [ebp - 0x32c8]
mov edi, dword [edi]
mov dword [ebp - 0x32b4], edi
cmp edi, dword [ecx + 4]
jne 0x100b8af0
mov esi, dword [ebp - 0x32dc]
push dword [ebp - 0x32e0]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push esi
call edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100e278d
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret