Function at 0x1000e940
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov dword [ebp - 0x84c], ecx
mov dword [ebp - 4], 3
mov dword [ebp - 8], 0x800
mov ecx, dword [ebp - 0x84c]
call fcn.1000ed30
mov dword [ebp - 0x83c], 3
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x808]
push ecx
lea edx, [ebp - 0x83c]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x838], eax
xor ecx, ecx
cmp dword [ebp - 0x838], 0
sete cl
movzx edx, cl
test edx, edx
je 0x1000eb92
mov dword [ebp - 0x810], 0
jmp 0x1000e9d4
mov eax, dword [ebp - 0x810]
add eax, 1
mov dword [ebp - 0x810], eax
mov ecx, dword [ebp - 0x810]
cmp ecx, dword [ebp - 8]
jae 0x1000ea10
mov edx, dword [ebp - 0x810]
add edx, 0xeb
and edx, 0xff
mov eax, dword [ebp - 0x810]
movsx ecx, byte [ebp + eax - 0x808]
xor ecx, edx
mov edx, dword [ebp - 0x810]
mov byte [ebp + edx - 0x808], cl
jmp 0x1000e9c5
mov dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
cmp eax, dword [ebp - 8]
jae 0x1000eb92
mov ecx, dword [ebp - 0x80c]
lea edx, [ebp + ecx - 0x808]
mov dword [ebp - 0x818], edx
mov eax, dword [ebp - 0x80c]
lea ecx, [ebp + eax - 0x808]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x80c]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp - 0x80c]
lea edx, [ebp + ecx - 0x808]
mov dword [ebp - 0x81c], edx
mov eax, dword [ebp - 0x80c]
lea ecx, [ebp + eax - 0x808]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x80c]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp - 0x80c]
lea edx, [ebp + ecx - 0x808]
mov dword [ebp - 0x820], edx
mov eax, dword [ebp - 0x80c]
lea ecx, [ebp + eax - 0x808]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x80c]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp - 0x80c]
lea edx, [ebp + ecx - 0x808]
mov dword [ebp - 0x814], edx
mov eax, dword [ebp - 0x80c]
lea ecx, [ebp + eax - 0x808]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 0x80c]
lea eax, [edx + eax + 1]
mov dword [ebp - 0x80c], eax
mov ecx, dword [ebp - 0x814]
push ecx
call fcn.1000f990
add esp, 4
mov dword [ebp - 0x848], eax
mov edx, dword [ebp - 0x820]
push edx
call fcn.1000f990
add esp, 4
mov dword [ebp - 0x844], eax
mov eax, dword [ebp - 0x81c]
push eax
call fcn.1000f990
add esp, 4
mov dword [ebp - 0x840], eax
mov ecx, dword [ebp - 0x848]
push ecx
mov edx, dword [ebp - 0x844]
push edx
mov eax, dword [ebp - 0x840]
push eax
mov ecx, dword [ebp - 0x818]
push ecx
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx]
shl eax, 4
mov ecx, dword [ebp - 0x84c]
lea ecx, [ecx + eax + 4]
call fcn.1000eca0
mov edx, dword [ebp - 0x84c]
mov eax, dword [edx]
add eax, 1
mov ecx, dword [ebp - 0x84c]
mov dword [ecx], eax
jmp 0x1000ea1a
mov dword [ebp - 0x824], 0
jmp 0x1000ebad
mov edx, dword [ebp - 0x824]
add edx, 1
mov dword [ebp - 0x824], edx
mov eax, dword [ebp - 0x84c]
mov ecx, dword [ebp - 0x824]
cmp ecx, dword [eax + 0x1e4]
jae 0x1000ec95
mov byte [ebp - 0x825], 0
mov dword [ebp - 0x82c], 0
jmp 0x1000ebe7
mov edx, dword [ebp - 0x82c]
add edx, 1
mov dword [ebp - 0x82c], edx
mov eax, dword [ebp - 0x84c]
mov ecx, dword [ebp - 0x82c]
cmp ecx, dword [eax]
jae 0x1000ec38
mov edx, dword [ebp - 0x824]
imul edx, edx, 0xff
mov eax, dword [ebp - 0x84c]
lea ecx, [eax + edx + 0x1e8]
push ecx
mov edx, dword [ebp - 0x82c]
shl edx, 4
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax + edx + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x1000ec36
mov byte [ebp - 0x825], 1
jmp 0x1000ebd8
movzx edx, byte [ebp - 0x825]
test edx, edx
jne 0x1000ec90
push 0
push 0
push 0
mov eax, dword [ebp - 0x824]
imul eax, eax, 0xff
mov ecx, dword [ebp - 0x84c]
lea edx, [ecx + eax + 0x1e8]
push edx
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax]
shl ecx, 4
mov edx, dword [ebp - 0x84c]
lea ecx, [edx + ecx + 4]
call fcn.1000eca0
mov eax, dword [ebp - 0x84c]
mov ecx, dword [eax]
add ecx, 1
mov edx, dword [ebp - 0x84c]
mov dword [edx], ecx
jmp 0x1000eb9e
mov al, 1
mov esp, ebp
pop ebp
ret 8