Function at 0x100d7fb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb54
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push esi
mov esi, dword [ebp + 0xc]
push edi
push 0x208
push 0
push eax
mov dword [ebp - 0xae4], ecx
mov dword [ebp - 0xb08], ebx
mov dword [ebp - 0xb38], esi
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
mov dword [ebp - 0xae0], 0x104
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
push dword [ebp + 0x10]
lea ecx, [ebp - 0xb04]
mov dword [ebp - 0xb04], 0
push esi
lea edi, [eax + 0x10]
mov dword [ebp - 0xb00], 0
push ebx
mov dword [ebp - 0xaf0], edi
mov dword [ebp - 0xafc], 0xffffffff
call fcn.10058810
or esi, 0xffffffff
test eax, eax
jne 0x100d8bc4
mov eax, dword [ebp - 0xae0]
xor edx, edx
mov ecx, dword [ebp - 0xafc]
mov dword [ebp - 0xadc], eax
mov dword [ebp - 0xae8], edx
cmp ecx, 0xffffffff
je 0x100d80ff
cmp edx, ecx
jb 0x100d80ff
cmp dword [ebp - 0xb04], 0
je 0x100d80ff
mov ebx, edx
sub ebx, ecx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d80b8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x100d80eb
lea ecx, [ebp - 0xae0]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
mov ecx, dword [ebp - 0xb04]
push ebx
push ecx
call eax
jmp 0x100d8223
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
jmp 0x100d8217
cmp dword [ebp - 0xb00], 0
mov ebx, 0x103
mov dword [ebp - 0xafc], 0xffffffff
je 0x100d81ac
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d8131
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x100d8166
lea ecx, [ebp - 0xae0]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0xae8]
mov ecx, dword [ebp - 0xb00]
push ecx
call eax
jmp 0x100d8187
mov ecx, dword [ebp - 0xb00]
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0xae8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x100d8194
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0x103
jne 0x100d8230
mov eax, dword [ebp - 0xadc]
mov edx, dword [ebp - 0xae8]
cmp dword [ebp - 0xb04], 0
je 0x100d8230
mov dword [ebp - 0xafc], edx
mov dword [ebp - 0xae0], eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d81d7
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x100d8207
lea ecx, [ebp - 0xae0]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push dword [ebp - 0xb04]
call eax
jmp 0x100d8223
lea eax, [ebp - 0xae0]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0xb04]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x100d8230
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x100d8bc1
lea eax, [ebp - 0x20c]
push str.CFBFAE00_17A6_11D0_99CB_00C04FD64497
push eax
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
je 0x100d8b94
push 0x10202940
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100d8b94
mov eax, dword [ebp - 0xae4]
lea ecx, [ebp - 0x20c]
push ecx
lea ecx, [eax + 0xbc]
call fcn.100d2aa0
test eax, eax
jne 0x100d8b94
mov dword [ebp - 0xb28], eax
mov dword [ebp - 0xb24], eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0xb1c], eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0xb18], eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0xb14], eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0xb20], 3
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0xb10], eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d8301
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xb10]
call fcn.10003740
push 0x208
lea eax, [ebp - 0x61c]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xaf0]
push str.CLSID_s
push eax
call fcn.10002cb0
push 0x20019
push 0x208
lea eax, [ebp - 0x61c]
mov dword [ebp - 0xae0], 0x208
push eax
push 1
push 0x10202940
push dword [ebp - 0xaf0]
push SysReAllocString
call fcn.10176900
add esp, 0x34
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xaec]
push 0x10202940
mov dword [ebp - 0xaec], eax
call fcn.10023e80
test al, al
jne 0x100d83be
push 0
push 0x10202940
lea ecx, [ebp - 0xaec]
call fcn.10003740
lea eax, [ebp - 0xaec]
push eax
lea eax, [ebp - 0xb2c]
push 0x9c5f
push eax
call fcn.100053d0
add esp, 0xc
lea ecx, [ebp - 0xb14]
push eax
call fcn.10002790
mov edx, dword [ebp - 0xb2c]
or ebx, 0xffffffff
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d8405
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xaec]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d8422
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x100d8430
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d8430
mov esi, dword [ebp - 0xb14]
lea eax, [ebp - 0x20c]
sub ecx, edx
mov dword [ebp - 0xadc], eax
sar ecx, 1
mov edi, eax
push ecx
mov ebx, dword [esi - 0xc]
sub edi, esi
push eax
sar edi, 1
mov dword [ebp - 0xb30], ebx
call fcn.101e6fd0
mov ecx, dword [esi - 8]
add ebx, eax
mov edx, 1
mov dword [ebp - 0xb34], eax
sub edx, dword [esi - 4]
sub ecx, ebx
add esp, 8
or ecx, edx
jge 0x100d8495
push ebx
lea ecx, [ebp - 0xb14]
call fcn.10003310
mov esi, dword [ebp - 0xb14]
mov ecx, dword [ebp - 0xb30]
cmp edi, ecx
ja 0x100d84a8
lea eax, [esi + edi*2]
mov dword [ebp - 0xadc], eax
mov eax, dword [ebp - 0xb34]
add eax, eax
push eax
push dword [ebp - 0xadc]
push eax
lea eax, [esi + ecx*2]
push eax
call fcn.10004510
xor eax, eax
mov dword [esi - 0xc], ebx
mov word [esi + ebx*2], ax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xaf0]
push str.CLSID_sInprocServer32
push eax
call fcn.10002cb0
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
mov edi, dword [ebp - 0xaf0]
lea eax, [ebp - 0x414]
push 0x20019
push 0x208
push eax
push 1
push 0x10202940
push edi
push SysReAllocString
mov dword [ebp - 0xae0], 0x208
call fcn.10176900
lea ecx, [ebp - 0x414]
add esp, 0x44
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d8534
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xb18]
call fcn.10003740
mov ebx, dword [ebp - 0xb38]
test ebx, ebx
jne 0x100d8564
xor eax, eax
jmp 0x100d857f
mov eax, ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100d8570
sub eax, edx
sar eax, 1
push eax
push ebx
lea ecx, [ebp - 0xb1c]
call fcn.10003740
mov eax, dword [ebp - 0xb08]
push 0x20019
push 0xffffffffffffffff
push ecx
mov dword [ebp - 0xb24], eax
mov esi, esp
mov dword [ebp - 0xb54], 0
mov dword [ebp - 0xb50], 0
mov dword [ebp - 0xb4c], 0
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10023e80
test al, al
jne 0x100d860e
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d85f0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003740
push ecx
mov ecx, esp
push ebx
call fcn.10002490
push dword [ebp - 0xb08]
lea eax, [ebp - 0xb54]
push eax
lea eax, [ebp - 0xb0c]
push eax
call fcn.100da240
mov ecx, dword [ebp - 0xae4]
add esp, 0x1c
push dword [ebp - 0xb0c]
call fcn.100d06f0
test eax, eax
jne 0x100d8b5e
push 0x208
push eax
lea eax, [ebp - 0xa2c]
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x824]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x104
lea eax, [ebp - 0xa2c]
push eax
push 0x104
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.10057610
add esp, 0x2c
push 1
push 0
push ecx
mov esi, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
push 0x10202940
mov dword [esi], eax
call fcn.10023e80
test al, al
jne 0x100d86ce
push 0
push 0x10202940
mov ecx, esi
call fcn.10003740
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov esi, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
push 0x10202940
mov dword [esi], eax
call fcn.10023e80
test al, al
jne 0x100d8706
push 0
push 0x10202940
mov ecx, esi
call fcn.10003740
push ecx
mov esi, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
push 0x10202940
mov dword [esi], eax
call fcn.10023e80
test al, al
jne 0x100d8738
push 0
push 0x10202940
mov ecx, esi
call fcn.10003740
push ecx
mov esi, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
push 0x10202940
mov dword [esi], eax
call fcn.10023e80
test al, al
jne 0x100d876a
push 0
push 0x10202940
mov ecx, esi
call fcn.10003740
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xadc]
push 0x2807
mov dword [ebp - 0xadc], eax
call fcn.10023e80
test al, al
jne 0x100d87c0
mov ecx, 0x2807
lea edx, [ecx + 2]
jmp 0x100d87a0
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d87a0
sub ecx, edx
sar ecx, 1
push ecx
push 0x2807
lea ecx, [ebp - 0xadc]
call fcn.10003740
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0xaf4]
push 0x10202940
mov dword [ebp - 0xaf4], eax
call fcn.10023e80
test al, al
jne 0x100d87fb
push 0
push 0x10202940
lea ecx, [ebp - 0xaf4]
call fcn.10003740
lea eax, [ebp - 0xaf4]
push eax
lea eax, [ebp - 0xb3c]
push 0x9c60
push eax
call fcn.100053d0
add esp, 0xc
mov ebx, dword [eax]
lea eax, [ebp - 0xb54]
push 0
push 0xffffffffffffffff
push 4
push eax
push 0
push 2
call fcn.100dbb10
mov esi, dword [ebp - 0xadc]
add esp, 4
mov ecx, dword [ebp - 0xae4]
push eax
mov eax, dword [ebp - 0xb14]
push eax
push esi
push ebx
push eax
call fcn.100cd930
mov edx, dword [ebp - 0xb3c]
or ebx, 0xffffffff
mov dword [ebp - 0xb28], eax
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d8873
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xaf4]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d8890
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d88a7
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0xae4]
lea ecx, [ebp - 0xb28]
push ecx
mov eax, dword [ebx + 0xd0]
cmp dword [ebx + 0xd4], eax
je 0x100d88d2
mov ecx, eax
call fcn.100d56d0
add dword [ebx + 0xd0], 0x1c
jmp 0x100d88de
push eax
lea ecx, [ebx + 0xcc]
call fcn.100d53f0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebx + 0xbc]
call fcn.100d2a40
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, 0x1025b480
mov dword [ebp - 0xadc], eax
lea eax, [ebp - 0x61c]
push 1
push eax
lea eax, [ebp - 0xb48]
push eax
call fcn.10002ad0
mov ecx, dword [ebp - 0xae4]
mov ebx, dword [eax]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xb44]
push eax
call fcn.100d7060
push 1
mov ecx, 0x1025b480
mov esi, dword [eax]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xb40]
push eax
call fcn.10002ad0
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp - 0xa2c]
push ecx
push ebx
push esi
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xadc]
push str.Type:R9Clsid:_sPath:_sMd5:_sPlgdes:_sComp:_sFiledes:_s
push eax
call fcn.10002cb0
mov edx, dword [ebp - 0xb40]
or ebx, 0xffffffff
add esp, 0x20
add edx, 0xfffffff0
mov eax, ebx
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d89a3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb44]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d89c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0xb48]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d89dd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
xor eax, eax
mov dword [ebp - 0xa7c], 0
push eax
push 0x10202940
lea ecx, [ebp - 0xa8c]
mov dword [ebp - 0xa78], 7
mov word [ebp - 0xa8c], ax
call fcn.100070c0
xor eax, eax
mov dword [ebp - 0xa64], 0
push eax
push 0x10202940
lea ecx, [ebp - 0xa74]
mov dword [ebp - 0xa60], 7
mov word [ebp - 0xa74], ax
call fcn.100070c0
xor eax, eax
mov dword [ebp - 0xa4c], 0
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0xa48], 7
mov word [ebp - 0xa5c], ax
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d8a60
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0xa5c]
call fcn.100070c0
mov esi, dword [ebp - 0xadc]
xor eax, eax
mov ecx, esi
mov dword [ebp - 0xa34], 0
mov dword [ebp - 0xa30], 7
mov word [ebp - 0xa44], ax
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100d8ab0
sub ecx, edx
sar ecx, 1
push ecx
push esi
lea ecx, [ebp - 0xa44]
call fcn.100070c0
push 0
lea eax, [ebp - 0xa44]
push eax
lea eax, [ebp - 0xa8c]
push eax
lea eax, [ebp - 0xa74]
push eax
lea ecx, [ebp - 0xad8]
call fcn.100a6630
mov ecx, dword [ebp - 0xae4]
push eax
lea eax, [ebp - 0xa5c]
push eax
lea ecx, [ecx + 0x300]
call fcn.100d5920
mov ecx, eax
call fcn.100d5840
lea ecx, [ebp - 0xad8]
call fcn.10021420
lea ecx, [ebp - 0xa44]
call fcn.10005250
lea ecx, [ebp - 0xa5c]
call fcn.10005250
lea ecx, [ebp - 0xa74]
call fcn.10005250
lea ecx, [ebp - 0xa8c]
call fcn.10005250
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d8b61
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100d8b61
or ebx, 0xffffffff
mov edx, dword [ebp - 0xb0c]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d8b7e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0xb54]
call fcn.1002a3c0
lea ecx, [ebp - 0xb28]
call fcn.100d57d0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.msvcrt.dll_memset
mov edx, dword [ebp - 0xae8]
mov eax, 0x104
add esp, 0xc
mov dword [ebp - 0xae0], eax
inc edx
jmp 0x100d807a
or esi, 0xffffffff
lea ecx, [ebp - 0xb04]
call fcn.10008220
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x100d8be4
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 0xc