Function at 0x10005189
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057632
mov eax, dword fs:[0]
push eax
sub esp, 0x4d0
mov eax, dword [0x10092018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x4dc], eax
xor eax, eax
cmp byte [0x10096498], 0x64
mov dword [ebp - 0x4cc], esi
mov dword [ebp - 0x4d4], ebx
jne 0x10005213
push 0x80
push eax
lea eax, [ebp - 0x90]
push eax
call fcn.10026e84
add esp, 0xc
lea eax, [ebp - 0x90]
push 0x40
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [ebp - 0x90]
push eax
call fcn.1003e4c8
xor eax, eax
test ebx, ebx
jne 0x1000523d
lea ecx, [ebp - 0x4a8]
mov esi, 0x80004003
push ecx
push 0xa
mov edx, str._hr0x_08x__CInterceptorFactory::CreateInstance___failed_due_to_invalid_arg
mov dword [ebp - 0x4a8], esi
pop ecx
call fcn.1003e4c8
mov eax, esi
jmp 0x100058e1
lea ecx, [ebp - 0x4a1]
mov dword [ebx], eax
call fcn.1000b96a
push 0x208
xor ecx, ecx
lea eax, [ebp - 0x298]
push ecx
push eax
call fcn.10026e84
add esp, 0xc
lea ecx, [ebp - 0x4d0]
lea eax, [edi + 4]
mov dword [ebp - 0x4d8], eax
push ecx
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
mov dword [ebp - 0x4a8], esi
test esi, esi
jns 0x100052a5
lea eax, [ebp - 0x4a8]
push eax
call fcn.1003e4c8
xor eax, eax
mov dword [ebp - 4], eax
cmp byte [ebp - 0x4a1], al
je 0x10005236
call dword [0x1009648c]
jmp 0x10005236
push dword [ebp - 0x4d0]
or esi, 0xffffffff
lea eax, [ebp - 0x4a0]
push str.SOFTWAREClassesCLSID_sInProcServer32
push esi
mov edi, 0x104
push edi
push eax
call fcn.1003e4c8
add esp, 0x14
push dword [ebp - 0x4d0]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
push ecx
mov dword [ebp - 0x4c4], eax
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
lea eax, [ebp - 0x4a0]
push eax
push 0x80000002
call fcn.1003e4c8
test eax, eax
je 0x10005354
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], esi
push eax
call fcn.1003e4c8
cmp dword [ebp - 0x4c4], 0
je 0x10005341
push dword [ebp - 0x4c4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 1
cmp byte [ebp - 0x4a1], 0
jmp 0x1000529b
lea eax, [ebp - 0x4b4]
mov dword [ebp - 0x4b4], edi
push eax
lea eax, [ebp - 0x298]
push eax
push ecx
lea ecx, [ebp - 0x4c4]
call fcn.1003e4c8
test eax, eax
je 0x100053bd
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], esi
push eax
call fcn.1003e4c8
cmp dword [ebp - 0x4c4], 0
je 0x100053b4
push dword [ebp - 0x4c4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 2
jmp 0x10005348
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x4ac]
call fcn.10005b8e
mov edi, dword [ebp - 0x4ac]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
cmp word [eax], cx
je 0x10005874
sub eax, edi
sar eax, 1
cmp eax, esi
je 0x10005874
lea ecx, [ebp - 0x298]
lea eax, [ecx + eax*2]
push 0x10068c2c
push eax
call fcn.1003e4c8
pop ecx
pop ecx
test eax, eax
jne 0x1000546e
lea eax, [ebp - 0x298]
mov edi, 0x80004005
push eax
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], edi
push eax
call fcn.1003e4c8
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
mov dword [ebp - 4], 5
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1000544d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x4c4], 0
je 0x10005462
push dword [ebp - 0x4c4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 6
jmp 0x100058d0
mov edi, dword [ebp - 0x4c4]
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x4c8]
mov dword [ebp - 0x4b4], 4
push eax
lea eax, [ebp - 0x4a8]
xor ecx, ecx
push eax
push ecx
push str.FullyVirtualize
push edi
mov dword [ebp - 0x4c8], ecx
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x100054ee
cmp dword [ebp - 0x4a8], 4
jne 0x100054ee
test eax, eax
jne 0x100054ee
cmp dword [ebp - 0x4c8], eax
jbe 0x100054ee
lea eax, [ebp - 0x298]
push eax
call fcn.1003e4c8
push str.JitV.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x100054ee
push str.EnableFullVirtualization
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x100054ee
call eax
push 1
lea eax, [ebp - 0x298]
push eax
call dword [sym.imp.ole32.dll_CoLoadLibrary]
test eax, eax
jne 0x10005578
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], ebx
push eax
call fcn.1003e4c8
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
mov dword [ebp - 4], 7
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10005550
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x1000555b
push edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 8
cmp byte [ebp - 0x4a1], 0
je 0x10005571
call dword [0x1009648c]
mov eax, ebx
jmp 0x100058e1
push 0x10068e48
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
jne 0x100055e7
call dword [sym.imp.kernel32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
lea eax, [ebp - 0x4a8]
push eax
mov dword [ebp - 0x4a8], ebx
call fcn.1003e4c8
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
mov dword [ebp - 4], 9
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x100055d0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x100055db
push edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 0xa
jmp 0x10005562
xor ecx, ecx
mov dword [ebp - 0x4b8], ecx
lea ecx, [ebp - 0x4b8]
push ecx
push 0x1005b358
push dword [ebp - 0x4d8]
call eax
mov dword [ebp - 0x4a8], eax
test eax, eax
jns 0x10005683
lea eax, [ebp - 0x4a8]
mov edx, str._hr0x_08x__CInterceptorFactory::CreateInstance___failed_DllGetClassObject__
push eax
call fcn.1003e4c8
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x4b8]
test eax, eax
je 0x10005635
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
mov dword [ebp - 4], 0xc
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10005657
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x10005662
push edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 0xd
cmp byte [ebp - 0x4a1], 0
je 0x10005678
call dword [0x1009648c]
mov eax, dword [ebp - 0x4a8]
jmp 0x100058e1
xor eax, eax
lea edx, [ebp - 0x4b0]
push edx
mov dword [ebp - 0x4b0], eax
mov edx, 0x1005b348
mov eax, dword [ebp - 0x4b8]
push edx
push dword [ebp - 0x4dc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x4a8], eax
test eax, eax
jns 0x10005727
lea eax, [ebp - 0x4a8]
push eax
call fcn.1003e4c8
mov dword [ebp - 4], 0xe
mov eax, dword [ebp - 0x4b0]
test eax, eax
je 0x100056d7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0xf
mov eax, dword [ebp - 0x4b8]
test eax, eax
je 0x100056ee
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
mov dword [ebp - 4], 0x10
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x10005710
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x1000571b
push edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 0x11
jmp 0x10005669
cmp dword [ebp - 0x4c8], 0
jbe 0x1000574f
mov eax, dword [ebp - 0x4b0]
push ebx
push dword [ebp - 0x4cc]
mov ecx, dword [eax]
push eax
call dword [ecx]
mov ebx, eax
mov dword [ebp - 0x4a8], ebx
jmp 0x100057ef
mov edx, dword [ebp - 0x4cc]
xor eax, eax
mov ecx, eax
mov eax, dword [edx + ecx*4]
mov edi, 0x1005b348
cmp eax, dword [edi + ecx*4]
mov edi, dword [ebp - 0x4c4]
jne 0x100057b0
inc ecx
cmp ecx, 4
jne 0x10005759
mov eax, dword [ebp - 0x4b0]
mov edx, 0x1005b348
push ebx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx]
mov ebx, eax
mov dword [ebp - 0x4a8], ebx
test ebx, ebx
js 0x10005801
call fcn.10005997
push ecx
mov ecx, dword [ebp - 0x4d4]
push dword [ecx]
mov ecx, eax
call fcn.10005afc
test al, al
jne 0x100057ef
call fcn.1003e4c8
jmp 0x100057ef
xor eax, eax
lea ebx, [ebp - 0x4b4]
mov dword [ebp - 0x4b4], eax
mov eax, dword [ebp - 0x4b0]
push ebx
push edx
push eax
mov ecx, dword [eax]
call dword [ecx]
mov ebx, eax
mov dword [ebp - 0x4a8], ebx
test ebx, ebx
js 0x10005801
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ebp - 0x4b4]
push ecx
mov ecx, dword [ebp - 0x4cc]
call fcn.10004c49
test ebx, ebx
js 0x10005801
lea eax, [ebp - 0x4a8]
push eax
call fcn.1003e4c8
jmp 0x1000580d
lea eax, [ebp - 0x4a8]
push eax
call fcn.1003e4c8
mov dword [ebp - 4], 0x12
mov eax, dword [ebp - 0x4b0]
test eax, eax
je 0x10005824
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [ebp - 4], 0x13
mov eax, dword [ebp - 0x4b8]
test eax, eax
je 0x1000583b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
mov dword [ebp - 4], 0x14
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x1000585d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x10005868
push edi
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 0x15
jmp 0x10005562
lea eax, [ebp - 0x298]
mov edi, 0x80070002
push eax
lea eax, [ebp - 0x4a8]
mov dword [ebp - 0x4a8], edi
push eax
call fcn.1003e4c8
mov edx, dword [ebp - 0x4ac]
add edx, 0xfffffff0
mov dword [ebp - 4], 3
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x100058b4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x4c4], 0
je 0x100058c9
push dword [ebp - 0x4c4]
call dword [sym.imp.advapi32.dll_RegCloseKey]
mov dword [ebp - 4], 4
cmp byte [ebp - 0x4a1], 0
je 0x100058df
call dword [0x1009648c]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10025283
leave
ret 0x10