Function at 0x18812fe6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
xor eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov word [ecx], ax
mov eax, dword [ebp + 0xc]
push 9
xor ebx, ebx
pop ecx
mov byte [eax], bl
xor eax, eax
mov word [ebp - 0x6c], ax
lea edi, [ebp - 0x6a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 8]
push eax
push 1
push ebx
mov edi, str.SoftwareRealtime_SoftUltraMon
push edi
push 0x80000002
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
jne 0x18813120
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push str.PreviousVersion
push dword [ebp - 8]
mov dword [ebp - 0x20], 0x28
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x18813099
cmp eax, 2
je 0x18813099
cmp eax, 5
je 0x18813099
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], str...UMSettings.cpp
mov dword [ebp - 0x14], 0xb89
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop ecx
mov dword [ebp - 0xc], eax
push 0x18836bec
lea eax, [ebp - 0x44]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x44]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.1881d33f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x6c], bx
je 0x18813311
lea eax, [ebp - 0x6c]
push eax
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 2
jl 0x188130de
push 2
push 0x188353b4
push 2
lea eax, [ebp - 0x6c]
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
sete byte [ebp - 1]
mov eax, dword [ebp + 0xc]
mov cl, byte [ebp - 1]
mov byte [eax], cl
lea eax, [ebp - 8]
push eax
push 8
push ebx
push edi
push 0x80000001
mov dword [ebp - 8], ebx
call esi
cmp eax, ebx
je 0x18813148
cmp eax, 2
je 0x18813311
cmp eax, 5
je 0x18813148
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], str...UMSettings.cpp
mov dword [ebp - 0x14], 0xba4
jmp 0x18813074
cmp eax, 2
je 0x188130a2
cmp eax, 5
je 0x188130a2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], str...UMSettings.cpp
mov dword [ebp - 0x14], 0xb8f
jmp 0x18813074
cmp eax, 2
je 0x18813311
cmp eax, ebx
jne 0x188132fc
cmp byte [ebp - 1], bl
jne 0x188132fc
lea eax, [ebp + 0xc]
push eax
push 1
push ebx
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 8]
mov dword [ebp + 0xc], ebx
call esi
mov esi, eax
cmp esi, ebx
je 0x1881319e
cmp esi, 2
je 0x1881319e
cmp esi, 5
je 0x1881319e
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], str...UMSettings.cpp
mov dword [ebp - 0x14], 0xbb0
mov dword [ebp - 0x10], esi
jmp 0x18813077
cmp dword [ebp + 0xc], ebx
je 0x188131af
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0xc], ebx
cmp esi, 2
jne 0x188132f3
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x6c], ax
mov word [ebp - 0x274], ax
lea eax, [ebp - 0x272]
push ebx
push eax
call fcn.18819090
xor eax, eax
push esi
mov word [ebp - 0x47c], ax
lea eax, [ebp - 0x47a]
push ebx
push eax
call fcn.18819090
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0x18
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x274]
push eax
xor edi, edi
mov dword [ebp - 0x20], ebx
push ebx
jmp 0x188132a7
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x274]
push str._u._u._u
push eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call fcn.1881b1ad
add esp, 0x14
cmp eax, 3
jne 0x18813296
movzx eax, byte [ebp - 0x30]
shl ax, 8
movzx ecx, ax
movzx eax, byte [ebp - 0x2c]
or ecx, eax
movzx eax, byte [ebp - 0x28]
shl ax, 8
movzx eax, ax
shl ecx, 0x10
or ecx, eax
mov eax, 0x3040100
cmp ecx, eax
je 0x18813296
sub eax, ecx
cmp eax, ebx
jle 0x18813296
mov edx, 0x3040100
sub edx, dword [ebp - 0x20]
cmp eax, edx
jge 0x18813296
lea eax, [ebp - 0x274]
mov dword [ebp - 0x20], ecx
push eax
mov eax, 0x208
lea ecx, [ebp - 0x47c]
call fcn.188014a8
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x274]
inc edi
push eax
push edi
push dword [ebp - 8]
mov dword [ebp - 0x24], 0x104
call esi
cmp eax, ebx
je 0x18813212
cmp eax, 0x103
je 0x188132d8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], str...UMSettings.cpp
mov dword [ebp - 0x14], 0xbdd
jmp 0x18813074
cmp word [ebp - 0x47c], bx
je 0x188132f3
lea eax, [ebp - 0x47c]
push eax
push 0x28
pop eax
lea ecx, [ebp - 0x6c]
call fcn.188014a8
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x6c], bx
je 0x18813311
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push eax
push 0x14
pop esi
call fcn.1880c781
pop edi
pop esi
pop ebx
leave
ret 8