Function at 0x1000218b
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov eax, 0x1000ce18
call fcn.10007e8c
sub esp, 0x668
mov dword [ebp - 0x20], 0x80000003
lea eax, [ebp - 0x18]
push eax
push 0xf003f
push 0
push 0
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x100021c1
jmp 0x100024cb
and dword [ebp - 0x234], 0
push str.AppEventsSchemes_
lea ecx, [ebp - 0x12c]
call fcn.1000109e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.10001000
mov byte [ebp - 4], 1
mov ecx, 0x10011a70
call fcn.10001396
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0
je 0x100024a4
mov dword [ebp - 0x14], 0x104
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x230]
push eax
mov eax, dword [ebp - 0x234]
dec eax
push eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10002243
jmp 0x100024a4
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x10011a70
call fcn.10001581
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x240]
call fcn.10001581
lea ecx, [ebp - 0x240]
call fcn.10001434
cmp dword [ebp + 8], 0
je 0x1000236c
push 0x100104b0
lea ecx, [ebp - 0x240]
call fcn.100014ae
test eax, eax
jge 0x10002367
lea ecx, [ebp - 0x664]
call fcn.100068c4
mov byte [ebp - 4], 2
mov ecx, 0x100119d0
call fcn.10001bf8
push eax
lea ecx, [ebp - 0x664]
call fcn.100069ba
push 0x100104bc
push 0x10011ab0
lea ecx, [ebp - 0x664]
call fcn.10006993
push 0x10011ab4
lea ecx, [ebp - 0x240]
call fcn.10001581
push 0
push 0
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x664]
call fcn.10006a9b
push 0x100104c4
push 0x100104cc
lea ecx, [ebp - 0x664]
call fcn.10006993
push 0x100104d4
lea ecx, [ebp - 0x240]
call fcn.10001581
push 0
push 0
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x664]
call fcn.10006a9b
push 0x100104d8
push 0x100104e0
lea ecx, [ebp - 0x664]
call fcn.10006993
and dword [ebp - 0x1c], 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x664]
call fcn.10006d88
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x664]
call fcn.10006940
jmp 0x1000249f
push str._classes
lea ecx, [ebp - 0x240]
call fcn.100014ae
cmp eax, 0xffffffff
jle 0x10002386
jmp 0x100021f5
lea eax, [ebp - 0x12c]
push eax
push 0x10011a70
lea eax, [ebp - 0x66c]
push eax
call fcn.10001669
add esp, 0xc
mov dword [ebp - 0x670], eax
mov eax, dword [ebp - 0x670]
mov dword [ebp - 0x674], eax
mov byte [ebp - 4], 3
push dword [ebp - 0x674]
lea ecx, [ebp - 0x240]
call fcn.10001549
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x66c]
call fcn.100010fa
lea eax, [ebp - 0x238]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x240]
call fcn.10001bf8
push eax
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000249f
mov dword [ebp - 0x10], 0x104
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x124]
push eax
push 0
push 0
push 0x10011ab8
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10002493
lea eax, [ebp - 0x124]
push eax
lea ecx, [ebp - 0x240]
call fcn.10001581
lea ecx, [ebp - 0x240]
call fcn.10001434
push str.current
lea ecx, [ebp - 0x240]
call fcn.100014ae
cmp eax, 0xffffffff
jg 0x10002474
push str.landscape
lea ecx, [ebp - 0x240]
call fcn.100014ae
cmp eax, 0xffffffff
jle 0x10002493
lea eax, [ebp - 0x230]
push eax
mov ecx, 0x10011a70
call fcn.10001581
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100024a4
push dword [ebp - 0x238]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100021f5
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and byte [ebp - 4], 0
lea ecx, [ebp - 0x240]
call fcn.100010fa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x12c]
call fcn.100010fa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret