Function at 0x100518b5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e77b3
mov eax, dword fs:[0]
push eax
mov eax, 0x12c0
call fcn.100c7ed0
mov eax, dword [0x1012c510]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1290], eax
lea eax, [ebp - 0x1278]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SoftwareAskToolbarMacro
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10051b72
cmp dword [ebp - 0x1278], ebx
je 0x10051b72
push 0x206
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call fcn.100c1480
add esp, 0xc
lea eax, [ebp - 0x12b0]
push eax
lea eax, [ebp - 0x12a4]
push eax
lea eax, [ebp - 0x1298]
push eax
lea eax, [ebp - 0x129c]
push eax
lea eax, [ebp - 0x127c]
push eax
lea eax, [ebp - 0x12a0]
push eax
lea eax, [ebp - 0x12a8]
push eax
lea eax, [ebp - 0x128c]
push eax
push ebx
lea eax, [ebp - 0x1288]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 0x1278]
mov dword [ebp - 0x1288], 0x104
mov dword [ebp - 0x128c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x127c], ebx
je 0x10051b66
mov esi, 0x400
push ebx
lea ecx, [ebp - 0x1238]
mov dword [ebp - 0x1280], esi
mov dword [ebp - 0x1284], esi
mov dword [ebp - 0x1220], 0xf
call fcn.1000d2f6
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1274], ebx
cmp dword [ebp - 0x127c], ebx
jbe 0x10051b58
xor eax, eax
mov word [ebp - 0x121c], ax
mov word [ebp - 0xa1c], ax
lea eax, [ebp - 0x1284]
push eax
lea eax, [ebp - 0x121c]
push eax
lea eax, [ebp - 0x1294]
push eax
push ebx
lea eax, [ebp - 0x1280]
push eax
lea eax, [ebp - 0xa1c]
push eax
push dword [ebp - 0x1274]
mov dword [ebp - 0x1284], esi
push dword [ebp - 0x1278]
mov dword [ebp - 0x1280], esi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, ebx
jne 0x10051b40
cmp dword [ebp - 0x1294], 1
jne 0x10051b40
cmp word [ebp - 0xa1c], bx
je 0x10051b40
lea eax, [ebp - 0x1238]
call fcn.1005261f
lea edi, [ebp - 0xa1c]
lea ecx, [ebp - 0x12cc]
call fcn.1004ea53
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x1238]
mov byte [ebp - 4], 1
call fcn.1000d11b
push ebx
push 1
lea ecx, [ebp - 0x12cc]
call fcn.1000d1ca
push ebx
lea ecx, [ebp - 0x1270]
mov dword [ebp - 0x1258], 0xf
call fcn.1000d2f6
lea esi, [ebp - 0x1254]
call fcn.10014bcd
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x1238]
push eax
lea ecx, [ebp - 0x1270]
mov byte [ebp - 4], 2
call fcn.1000d11b
lea eax, [ebp - 0x121c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
cmp eax, 0x3fffffff
jle 0x10051af0
xor eax, eax
jmp 0x10051b0c
lea esi, [eax + eax]
mov eax, esi
call fcn.100c7f80
mov eax, esp
push 3
push esi
lea ecx, [ebp - 0x121c]
push ecx
push eax
call fcn.100161b6
push eax
lea ecx, [ebp - 0x1254]
call fcn.1000d1ad
lea eax, [ebp - 0x1270]
push eax
push dword [ebp - 0x1290]
call fcn.10053189
xor edi, edi
lea esi, [ebp - 0x1270]
inc edi
mov byte [ebp - 4], bl
call fcn.1004228d
mov esi, 0x400
inc dword [ebp - 0x1274]
mov eax, dword [ebp - 0x1274]
cmp eax, dword [ebp - 0x127c]
jb 0x100519ec
push ebx
push 1
lea ecx, [ebp - 0x1238]
call fcn.1000d1ca
push dword [ebp - 0x1278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
lea esp, [ebp - 0x12dc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100bfae1
leave
ret