Function at 0x1004171d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1911c
call fcn.10044f70
mov eax, dword [0x10083adc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1900c], eax
mov eax, dword [ebp + 0x18]
push eax
push 0
push esi
mov dword [ebp - 0x19018], 1
mov dword [ebp - 0x19014], eax
call fcn.10007858
add esp, 0xc
push ebx
lea ecx, [ebp - 0x1911c]
call fcn.1000cd01
mov eax, dword [eax]
lea ecx, [ebp - 0x19010]
push ecx
push 0x20019
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea eax, [ebp - 0x19118]
setne byte [ebp - 0x19005]
cmp dword [ebp - 0x1911c], eax
je 0x100417af
push dword [ebp - 0x1911c]
call fcn.100469c3
pop ecx
cmp byte [ebp - 0x19005], 0
je 0x100417cf
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x1900c]
call fcn.100415b9
add esp, 0xc
jmp 0x10041952
lea eax, [ebp - 0x19014]
push eax
push esi
lea eax, [ebp - 0x19018]
push eax
push 0
push dword [ebp - 0x1900c]
push dword [ebp - 0x19010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x19010]
test eax, eax
je 0x10041804
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100417b8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x101570e7], 0
je 0x1004188e
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._tc_Env
push ebx
call edi
test eax, eax
jne 0x10041831
push str.TC_INSTALL
push ebx
call edi
test eax, eax
je 0x1004188e
push str.tC_Sweep
push dword [ebp - 0x1900c]
call fcn.1004c1f9
pop ecx
pop ecx
test eax, eax
je 0x1004188e
push 0x18fff
lea eax, [ebp - 0x19003]
push 0
push eax
mov byte [ebp - 0x19004], 0
call fcn.10044b80
lea eax, [ebp - 0x19004]
push eax
push esi
push 0x101121a8
push 0
call fcn.1003529b
lea eax, [ebp - 0x19004]
mov edx, esi
mov ecx, eax
add esp, 0x1c
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10041884
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10041893
sub eax, edx
cmp eax, 2
jbe 0x100418ef
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100418a6
sub eax, edx
cmp byte [eax + esi - 1], 0xa
jne 0x100418c8
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100418bb
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100418cd
sub eax, edx
cmp byte [eax + esi - 1], 0xd
jne 0x100418ef
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100418e2
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100418f4
mov ecx, dword [ebp + 0x18]
sub eax, edx
sub ecx, eax
je 0x10041935
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10041909
sub eax, edx
mov edi, eax
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10041919
sub eax, ecx
mov ecx, dword [ebp + 0x18]
sub ecx, edi
push ecx
add eax, esi
push 0
push eax
call fcn.10007858
add esp, 0xc
cmp byte [esi], 0
jne 0x1004194c
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x1900c]
call fcn.100415b9
add esp, 0xc
mov eax, dword [ebp - 0x19014]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10044b6f
leave
ret