Function at 0x100417d5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1911c
call fcn.10045420
mov eax, dword [0x10084adc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1900c], eax
mov eax, dword [ebp + 0x18]
push eax
push 0
push esi
mov dword [ebp - 0x19018], 1
mov dword [ebp - 0x19014], eax
call fcn.10007858
add esp, 0xc
push ebx
lea ecx, [ebp - 0x1911c]
call fcn.1000cd01
mov eax, dword [eax]
lea ecx, [ebp - 0x19010]
push ecx
push 0x20019
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea eax, [ebp - 0x19118]
setne byte [ebp - 0x19005]
cmp dword [ebp - 0x1911c], eax
je 0x10041867
push dword [ebp - 0x1911c]
call fcn.10046e73
pop ecx
cmp byte [ebp - 0x19005], 0
je 0x10041887
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x1900c]
call fcn.10041671
add esp, 0xc
jmp 0x10041a0a
lea eax, [ebp - 0x19014]
push eax
push esi
lea eax, [ebp - 0x19018]
push eax
push 0
push dword [ebp - 0x1900c]
push dword [ebp - 0x19010]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x19010]
test eax, eax
je 0x100418bc
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10041870
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x101580eb], 0
je 0x10041946
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._tc_Env
push ebx
call edi
test eax, eax
jne 0x100418e9
push str.TC_INSTALL
push ebx
call edi
test eax, eax
je 0x10041946
push str.tC_Sweep
push dword [ebp - 0x1900c]
call fcn.1004c839
pop ecx
pop ecx
test eax, eax
je 0x10041946
push 0x18fff
lea eax, [ebp - 0x19003]
push 0
push eax
mov byte [ebp - 0x19004], 0
call fcn.10045030
lea eax, [ebp - 0x19004]
push eax
push esi
push 0x101131a8
push 0
call fcn.10035421
lea eax, [ebp - 0x19004]
mov edx, esi
mov ecx, eax
add esp, 0x1c
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x1004193c
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004194b
sub eax, edx
cmp eax, 2
jbe 0x100419a7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004195e
sub eax, edx
cmp byte [eax + esi - 1], 0xa
jne 0x10041980
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10041973
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10041985
sub eax, edx
cmp byte [eax + esi - 1], 0xd
jne 0x100419a7
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1004199a
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100419ac
mov ecx, dword [ebp + 0x18]
sub eax, edx
sub ecx, eax
je 0x100419ed
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100419c1
sub eax, edx
mov edi, eax
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x100419d1
sub eax, ecx
mov ecx, dword [ebp + 0x18]
sub ecx, edi
push ecx
add eax, esi
push 0
push eax
call fcn.10007858
add esp, 0xc
cmp byte [esi], 0
jne 0x10041a04
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x1900c]
call fcn.10041671
add esp, 0xc
mov eax, dword [ebp - 0x19014]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004501f
leave
ret