Function at 0x101e4e5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x240
mov eax, 0x10404b1
call fcn.01001615
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x220], ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x23c], eax
mov dword [ebp - 0x24c], ecx
mov dword [ebp - 0x238], ebx
push esi
lea ecx, [ebp - 0x238]
push ecx
push eax
mov dword [ebp - 4], ebx
call fcn.0101e307
cmp eax, 0x80040d61
mov dword [ebp - 0x228], eax
jne 0x101e820
mov dword [ebp - 0x22c], ebx
lea eax, [ebp - 0x22c]
push eax
push 0x1002254
push 0x15
push ebx
push 0x101894c
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
mov dword [ebp - 0x228], eax
jl 0x101e7ce
mov dword [ebp - 0x230], ebx
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax]
lea edx, [ebp - 0x230]
push edx
push eax
mov byte [ebp - 4], 2
call dword [ecx + 0x1c]
cmp eax, ebx
mov dword [ebp - 0x228], eax
jl 0x101e779
lea eax, [ebp - 0x234]
push eax
push 1
push ebx
push 0x100af48
push reloc.OLEAUT32.dll_SysReAllocString
mov word [ebp - 0x14], bx
mov dword [ebp - 0x248], 0x104
mov dword [ebp - 0x244], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
call fcn.0100b113
cmp eax, ebx
mov dword [ebp - 0x228], eax
jl 0x101e74a
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x244]
push eax
mov edi, 0x1018980
push edi
push 0x101895c
push dword [ebp - 0x234]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push eax
call fcn.0100b113
cmp eax, ebx
mov dword [ebp - 0x228], eax
jl 0x101e701
lea eax, [ebp - 0x21c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
cmp eax, ebx
je 0x101e677
cmp eax, 0x50
je 0x101e677
cmp eax, 0xb7
je 0x101e677
push ebx
lea ecx, [ebp - 0x224]
mov dword [ebp - 0x228], 0x80070003
call fcn.0101e28a
push 0x7d4
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov byte [ebp - 4], 5
call fcn.0100f6ba
push 0xffffffffffffffff
push dword [esi + 0xc]
lea ecx, [ebp - 0x21c]
push ecx
jmp 0x101e72a
mov dword [ebp - 0x240], ebx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
lea edx, [ebp - 0x240]
push edx
push dword [ebp - 0x24c]
mov byte [ebp - 4], 3
push dword [ebp - 0x220]
push dword [ebp - 0x23c]
push eax
call dword [ecx + 0x28]
cmp eax, ebx
mov dword [ebp - 0x228], eax
jge 0x101e6eb
push ebx
lea ecx, [ebp - 0x224]
call fcn.0101e28a
push 0x7d3
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov byte [ebp - 4], 4
call fcn.0100f6ba
push dword [ebp - 0x23c]
mov ecx, esi
call fcn.0101e1e3
lea ecx, [ebp - 0x224]
call fcn.0100e0c2
mov eax, dword [ebp - 0x240]
cmp eax, ebx
mov byte [ebp - 4], 2
je 0x101e73c
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101e73c
push ebx
lea ecx, [ebp - 0x224]
call fcn.0101e28a
push 0x7d5
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov byte [ebp - 4], 6
call fcn.0100f6ba
push 0xffffffffffffffff
push dword [esi + 0xc]
push edi
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [ebp - 0x224]
call fcn.0100e0c2
push dword [ebp - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101e7b8
push ebx
lea ecx, [ebp - 0x224]
call fcn.0101e28a
push 0x7d7
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov byte [ebp - 4], 7
call fcn.0100f6ba
push 0xffffffffffffffff
push dword [esi + 0xc]
push 0x101e854
jmp 0x101e7a6
push ebx
lea ecx, [ebp - 0x224]
call fcn.0101e28a
push 0x7d0
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov byte [ebp - 4], 8
call fcn.0100f6ba
push 0xffffffffffffffff
push dword [esi + 0xc]
push 0x101e84c
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
lea ecx, [ebp - 0x224]
call fcn.0100e0c2
mov eax, dword [ebp - 0x230]
cmp eax, ebx
mov byte [ebp - 4], 1
je 0x101e80d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x101e80d
push ebx
lea ecx, [ebp - 0x224]
call fcn.0101e28a
push 0x7d0
lea eax, [ebp - 0x224]
push eax
mov ecx, esi
mov byte [ebp - 4], 9
call fcn.0100f6ba
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [esi + 0xc]
mov ecx, esi
push 0x101e844
call dword [eax + 0x10]
lea ecx, [ebp - 0x224]
call fcn.0100e0c2
mov eax, dword [ebp - 0x22c]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x101e820
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x238]
or dword [ebp - 4], 0xffffffff
cmp eax, ebx
je 0x101e834
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x228]
call fcn.01001652
ret 0x10