Function at 0x10015428
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1014b5ab
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x2514
call fcn.1003430e
mov eax, dword [0x101fe1c0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x2500], edi
mov dword [ebp - 0x251c], edi
mov dword [ebp - 0x2518], 0
mov dword [ebp - 0x2510], 0
mov dword [ebp - 0x250c], 0
mov dword [ebp - 0x2508], 0
push 0x1015bd5c
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], 1
call fcn.100111ba
push str.SOFTWAREMicrosoftOfficeCommon
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.100111ba
push str.SOFTWAREWow6432NodeMicrosoftOfficeCommon
lea ecx, [ebp - 0xb8]
mov byte [ebp - 4], 3
call fcn.100111ba
mov byte [ebp - 0x24f5], 0
mov byte [ebp - 4], 5
call fcn.10016235
cmp eax, 0x3000
mov dword [ebp - 4], 4
setae al
xorps xmm0, xmm0
mov dword [ebp - 0x88], vtable.RefCounted.0
xor ecx, ecx
mov byte [ebp - 0x24f5], al
movups xmmword [ebp - 0x80], xmm0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x88], vtable.ORegistryKey.0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 7
mov word [ebp - 0x80], cx
mov dword [ebp - 0x68], ecx
mov byte [ebp - 0x64], 1
mov dword [ebp - 0x60], 0x85
mov byte [ebp - 4], 0xc
mov esi, dword [0x10207478]
test al, al
je 0x10015709
test esi, esi
je 0x10015b95
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
sete al
test al, al
jne 0x10015bb9
cmp ecx, 0xff
ja 0x10015be0
xor eax, eax
mov dword [ebp - 0x70], 0
mov word [ebp - 0x80], ax
mov dword [ebp - 0x2504], eax
call fcn.10016574
test al, al
je 0x10015c08
mov ecx, 0x3011f
cmp dword [ebp - 0x18], 7
lea eax, [ebp - 0x2c]
jbe 0x100155a0
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x2504]
push edx
lea edx, [ebp - 0x68]
push edx
push 0
push ecx
push 0
push 0
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x2500], eax
test eax, eax
jne 0x10015c12
lea eax, [ebp - 0x80]
mov ecx, 0x10207460
push eax
lea edx, [ebp - 0x2c]
call fcn.1000a0de
mov eax, dword [ebp - 0x2504]
test eax, eax
je 0x100157b1
mov ecx, dword [ebp - 0x68]
test ecx, ecx
sete al
test al, al
lea eax, [ebp - 0x5c]
jne 0x10015cca
cmp dword [ebp - 0x48], 7
mov dword [ebp - 0x24fc], 3
mov dword [ebp - 0x2514], 0
jbe 0x10015619
mov eax, dword [ebp - 0x5c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x2514]
push edx
push 0
lea edx, [ebp - 0x24fc]
push edx
push 0
push eax
push ecx
call esi
cmp dword [ebp - 0x24fc], 3
jne 0x10015d22
cmp eax, 2
je 0x10015d22
test eax, eax
je 0x10015917
push 0xffffffffffffffff
xor eax, eax
mov dword [ebp - 0x508], 0x2b
push str.ORegistryKey.GetValue_failure:_Cannot_get_the_binary_value___s__in_registry_key__s.
mov word [ebp - 0x200], ax
lea eax, [ebp - 0x300]
push 0x80
push eax
mov dword [ebp - 0x304], 0
mov dword [ebp - 0x180], 0x30303030
call fcn.1003c308
add esp, 0x10
lea eax, [ebp - 0x80]
mov edx, str.ORegistryKey.GetValue_failure:_Cannot_get_the_binary_value___s__in_registry_key__s.
lea ecx, [ebp - 0xd0]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0x53
call fcn.100168b0
mov dword [ebp - 0x2518], 2
mov byte [ebp - 4], 0xd
lea eax, [ebp - 0xd0]
cmp dword [ebp - 0xbc], 7
jbe 0x100156d2
mov eax, dword [ebp - 0xd0]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x504]
push 0x100
push eax
call fcn.1003c308
add esp, 0x10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xd0]
call fcn.100093c1
push 0x101ebb90
lea eax, [ebp - 0x508]
push eax
call fcn.100357e4
xor eax, eax
mov dword [ebp - 0x70], 0
mov word [ebp - 0x80], ax
test esi, esi
je 0x10015c45
cmp dword [ebp - 0x1c], 0xff
ja 0x10015c6d
mov dword [ebp - 0x2504], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x2504]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x10015c95
cmp dword [ebp - 0x2504], 1
mov ecx, 0x20119
mov eax, 0x20019
cmove eax, ecx
cmp dword [ebp - 0x18], 7
lea ecx, [ebp - 0x2c]
jbe 0x1001576d
mov ecx, dword [ebp - 0x2c]
lea edx, [ebp - 0x68]
push edx
push eax
push 0
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10015cc3
lea eax, [ebp - 0x80]
mov ecx, 0x10207460
push eax
lea edx, [ebp - 0x2c]
call fcn.1000a0de
mov eax, 1
jmp 0x100155e1
mov eax, dword [ebp - 0x250c]
sub eax, dword [ebp - 0x2510]
je 0x10015d22
lea ecx, [ebp - 0x88]
call fcn.10015fbc
mov dword [ebp - 4], 4
lea edx, [ebp - 0x2510]
mov ecx, edi
call fcn.1001609a
or dword [ebp - 0x2518], 1
mov byte [ebp - 4], 3
mov eax, dword [ebp - 0xa4]
cmp eax, 7
jbe 0x10015813
mov ecx, dword [ebp - 0xb8]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2500], eax
mov dword [ebp - 0x24fc], ecx
cmp eax, 0x1000
jae 0x10015f4c
push ecx
call fcn.1003bf94
add esp, 4
xor eax, eax
mov byte [ebp - 4], 2
mov word [ebp - 0xb8], ax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xa8], 0
mov dword [ebp - 0xa4], 7
cmp eax, 7
jbe 0x10015866
mov ecx, dword [ebp - 0x2c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2500], eax
mov dword [ebp - 0x24fc], ecx
cmp eax, 0x1000
jae 0x10015f68
push ecx
call fcn.1003bf94
add esp, 4
xor eax, eax
mov byte [ebp - 4], 1
mov word [ebp - 0x2c], ax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
cmp eax, 7
jbe 0x100158b0
mov ecx, dword [ebp - 0x5c]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x2500], eax
mov dword [ebp - 0x24fc], ecx
cmp eax, 0x1000
jae 0x10015f84
push ecx
call fcn.1003bf94
add esp, 4
xor eax, eax
mov dword [ebp - 0x4c], 0
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x2510]
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], ax
test ecx, ecx
je 0x100158f9
mov eax, dword [ebp - 0x2508]
sub eax, ecx
mov dword [ebp - 0x24fc], ecx
mov dword [ebp - 0x2500], eax
cmp eax, 0x1000
jae 0x10015fa0
push ecx
call fcn.1003bf94
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10033218
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x250c]
mov eax, edx
mov ecx, dword [ebp - 0x2510]
sub eax, ecx
mov dword [ebp - 0x2504], eax
mov eax, dword [ebp - 0x2514]
cmp eax, dword [ebp - 0x2504]
ja 0x10015a21
jb 0x10015cef
sub edx, ecx
mov eax, 0
cmove ecx, eax
cmp dword [ebp - 0x48], 7
lea eax, [ebp - 0x5c]
jbe 0x1001595b
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x2514]
push edx
push ecx
lea ecx, [ebp - 0x24fc]
push ecx
push 0
push eax
push dword [ebp - 0x68]
call esi
test eax, eax
je 0x1001579f
push 0xffffffffffffffff
xor eax, eax
mov dword [ebp - 0x894], 0x2b
push str.ORegistryKey.GetValue_failure:_Cannot_get_the_binary_value___s__in_registry_key__s.
mov word [ebp - 0x58c], ax
lea eax, [ebp - 0x68c]
push 0x80
push eax
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x50c], 0x30303030
call fcn.1003c308
add esp, 0x10
lea eax, [ebp - 0x80]
mov edx, str.ORegistryKey.GetValue_failure:_Cannot_get_the_binary_value___s__in_registry_key__s.
lea ecx, [ebp - 0x44]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0x53
call fcn.100168b0
mov dword [ebp - 0x2518], 4
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x44]
cmp dword [ebp - 0x30], 7
jbe 0x100159ed
mov eax, dword [ebp - 0x44]
push 0xffffffffffffffff
push eax
lea eax, [ebp - 0x890]
push 0x100
push eax
call fcn.1003c308
add esp, 0x10
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x44]
call fcn.100093c1
push 0x101ebb90
lea eax, [ebp - 0x894]
push eax
call fcn.100357e4
mov eax, dword [ebp - 0x2508]
sub eax, ecx
mov ecx, dword [ebp - 0x2514]
cmp ecx, eax
jbe 0x10015cf4
push ecx
push ecx
lea ecx, [ebp - 0x2510]
call fcn.100169f1
mov edx, dword [ebp - 0x250c]
mov ecx, dword [ebp - 0x2510]
jmp 0x10015945
sub esp, 8
lea ecx, [ebp - 0xc20]
push 0x30303030
call fcn.10059039
push 0x101ebb90
lea eax, [ebp - 0xc20]
push eax
call fcn.100357e4
push str.ORegistryKey.CreateSubKey_failure:_Empty_key_name_string.
push ecx
push 0x30303030
lea ecx, [ebp - 0xfac]
call fcn.10058d2f
push 0x101ebb90
lea eax, [ebp - 0xfac]
push eax
call fcn.100357e4
lea eax, [ebp - 0x2c]
push eax
sub esp, 8
lea ecx, [ebp - 0x1338]
push 0x30303030
call fcn.10058e40
push 0x101ebb90
lea eax, [ebp - 0x1338]
push eax
call fcn.100357e4
mov ecx, 0x3001f
jmp 0x10015594
lea ecx, [ebp - 0x2500]
push ecx
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push ecx
push eax
push ecx
push 0x30303030
lea ecx, [ebp - 0x16c4]
call fcn.100583d7
push 0x101ebb90
lea eax, [ebp - 0x16c4]
push eax
call fcn.100357e4
push str.ORegistryKey.Open_failure:_Parent_key_is_NULL
push 0x3a
push 0x30303030
lea ecx, [ebp - 0x1a50]
call fcn.1006259a
push 0x101ebb90
lea eax, [ebp - 0x1a50]
push eax
call fcn.100357e4
lea eax, [ebp - 0x2c]
push eax
sub esp, 8
lea ecx, [ebp - 0x1ddc]
push 0x30303030
call fcn.1006277b
push 0x101ebb90
lea eax, [ebp - 0x1ddc]
push eax
call fcn.100357e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push str.error_calling_IsWow64Process__
push eax
push ecx
push 0x30303030
lea ecx, [ebp - 0x2168]
call fcn.100582ec
push 0x101ebb90
lea eax, [ebp - 0x2168]
push eax
call fcn.100357e4
xor eax, eax
jmp 0x100155e1
push eax
sub esp, 8
lea ecx, [ebp - 0x24f4]
push 0x30303030
call fcn.100626d9
push 0x101ebb90
lea eax, [ebp - 0x24f4]
push eax
call fcn.100357e4
lea edx, [eax + ecx]
jmp 0x10015d17
sub ecx, dword [ebp - 0x2504]
push ecx
push 0
push edx
lea esi, [edx + ecx]
call fcn.10035153
mov ecx, dword [ebp - 0x2510]
mov edx, esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
mov dword [ebp - 0x250c], edx
jmp 0x10015945
lea ecx, [ebp - 0xe4]
call fcn.1002e8c4
mov byte [ebp - 4], 0xf
call fcn.10131644
test ax, ax
je 0x10015d98
cmp byte [ebp - 0x24f5], 0
lea eax, [ebp - 0xb8]
je 0x10015d64
sub esp, 8
push 1
push ecx
push eax
lea eax, [ebp - 0xe4]
mov ecx, 0x10207458
push eax
call fcn.10027fc4
jmp 0x10015d7e
push ecx
push 1
push 0
push eax
lea eax, [ebp - 0xe4]
mov ecx, 0x10207458
push eax
call fcn.10028f3d
movzx eax, al
test eax, eax
je 0x10015d98
lea eax, [ebp - 0x2510]
push eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0xe4]
call fcn.100165f0
cmp byte [ebp - 0x24f5], 0
je 0x10015e02
mov eax, dword [ebp - 0x250c]
sub eax, dword [ebp - 0x2510]
jne 0x10015dec
lea eax, [ebp - 0x3c]
push eax
call fcn.1006ab2f
push ecx
lea ecx, [ebp - 0x94]
movups xmm0, xmmword [eax]
lea eax, [ebp - 0x10c]
push eax
movups xmmword [ebp - 0x10c], xmm0
call fcn.1013bc69
push eax
lea ecx, [ebp - 0x2510]
call fcn.100aba03
lea ecx, [ebp - 0x94]
call fcn.1002c1d2
lea eax, [ebp - 0x2510]
push eax
lea eax, [ebp - 0x5c]
push eax
lea ecx, [ebp - 0x88]
call fcn.101304c9
lea ecx, [ebp - 0xe4]
call fcn.10015fbc
jmp 0x100157b1
lea edx, [ebp - 0x2500]
lea ecx, [ebp - 0x24fc]
call fcn.100179ed
mov ecx, dword [ebp - 0x24fc]
jmp 0x1001580a
lea edx, [ebp - 0x2500]
lea ecx, [ebp - 0x24fc]
call fcn.100179ed
mov ecx, dword [ebp - 0x24fc]
jmp 0x1001585d
lea edx, [ebp - 0x2500]
lea ecx, [ebp - 0x24fc]
call fcn.100179ed
mov ecx, dword [ebp - 0x24fc]
jmp 0x100158a7
lea edx, [ebp - 0x2500]
lea ecx, [ebp - 0x24fc]
call fcn.100179ed
mov ecx, dword [ebp - 0x24fc]
jmp 0x100158f0