Function at 0x1001f7f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x100db690]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x5c]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlWmiGlobalLogger
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x60], 0
call edi
test eax, eax
jne 0x1001fa68
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x60]
push edx
push eax
push eax
mov eax, dword [ebp - 0x5c]
push str.Start
push eax
mov dword [ebp - 0x54], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001fa5e
cmp dword [ebp - 0x60], eax
je 0x1001fa5e
mov ecx, dword [esi]
push 8
push ecx
lea edx, [ebp - 0x50]
push edx
call fcn.1001f7b0
movzx ecx, word [esi + 4]
push 4
push ecx
lea edx, [ebp - 0x3e]
mov eax, 0x2d
push edx
mov word [ebp - 0x40], ax
call fcn.1001f7b0
movzx ecx, word [esi + 6]
push 4
push ecx
lea edx, [ebp - 0x34]
mov eax, 0x2d
push edx
mov word [ebp - 0x36], ax
call fcn.1001f7b0
movzx ecx, byte [esi + 8]
mov edx, ecx
shr edx, 4
and ecx, 0xf
mov eax, 0x2d
mov word [ebp - 0x2c], ax
mov eax, dword [0x100da314]
movzx edx, word [eax + edx*2]
mov word [ebp - 0x2a], dx
movzx ecx, word [eax + ecx*2]
mov word [ebp - 0x28], cx
movzx ecx, byte [esi + 9]
mov edx, ecx
shr edx, 4
movzx edx, word [eax + edx*2]
mov word [ebp - 0x26], dx
and ecx, 0xf
movzx ecx, word [eax + ecx*2]
mov word [ebp - 0x24], cx
movzx ecx, byte [esi + 0xa]
mov edx, 0x2d
mov word [ebp - 0x22], dx
mov edx, ecx
shr edx, 4
movzx edx, word [eax + edx*2]
mov word [ebp - 0x20], dx
and ecx, 0xf
movzx ecx, word [eax + ecx*2]
mov word [ebp - 0x1e], cx
movzx ecx, byte [esi + 0xb]
mov edx, ecx
shr edx, 4
movzx edx, word [eax + edx*2]
mov word [ebp - 0x1c], dx
and ecx, 0xf
movzx ecx, word [eax + ecx*2]
mov word [ebp - 0x1a], cx
movzx ecx, byte [esi + 0xc]
mov edx, ecx
shr edx, 4
movzx edx, word [eax + edx*2]
mov word [ebp - 0x18], dx
and ecx, 0xf
movzx ecx, word [eax + ecx*2]
mov word [ebp - 0x16], cx
movzx ecx, byte [esi + 0xd]
mov edx, ecx
shr edx, 4
movzx edx, word [eax + edx*2]
mov word [ebp - 0x14], dx
and ecx, 0xf
movzx ecx, word [eax + ecx*2]
mov word [ebp - 0x12], cx
movzx ecx, byte [esi + 0xe]
mov edx, ecx
add esp, 0x24
shr edx, 4
movzx edx, word [eax + edx*2]
mov word [ebp - 0x10], dx
and ecx, 0xf
movzx ecx, word [eax + ecx*2]
mov word [ebp - 0xe], cx
movzx ecx, byte [esi + 0xf]
mov edx, ecx
shr edx, 4
movzx edx, word [eax + edx*2]
mov word [ebp - 0xc], dx
and ecx, 0xf
mov ax, word [eax + ecx*2]
lea edx, [ebp - 0x58]
push edx
xor ecx, ecx
push 0x20019
push ecx
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x50]
mov word [ebp - 8], cx
mov ecx, dword [ebp - 0x5c]
push eax
push ecx
call edi
test eax, eax
jne 0x1001fa5e
mov ecx, dword [ebp - 0x58]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x64]
push eax
push 0
push 0
push str.Flags
mov edi, 4
push ecx
mov dword [ebp - 0x54], edi
call esi
mov ecx, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push str.Level
push ecx
mov dword [ebp - 0x54], edi
call esi
cmp dword [ebp - 0x60], 1
jne 0x1001fa54
push str.GlobalLogger
call fcn.1001f730
mov ecx, dword [ebp - 0x74]
mov dword [ecx + 4], edx
mov edx, eax
add esp, 4
or edx, dword [ecx + 4]
mov dword [ecx], eax
je 0x1001fa54
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x6c]
mov dl, byte [ebp - 0x68]
and eax, 0x7fffffff
mov dword [ecx], eax
mov eax, dword [ebp - 0x70]
mov byte [eax], dl
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002e502
mov esp, ebp
pop ebp
ret