Function at 0x1001f1ab
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x444
mov eax, 0x10028d4f
call fcn.10026615
mov eax, dword [ebp + 8]
mov esi, 0x206
mov dword [ebp - 0x448], eax
xor ebx, ebx
mov dword [ebp - 0x444], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x43c], eax
mov dword [ebp - 0x440], eax
xor eax, eax
push esi
mov word [ebp - 0x424], ax
lea eax, [ebp - 0x422]
push ebx
push eax
call sub.MSVCR120.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x21a]
push ebx
push eax
call sub.MSVCR120.dll_memset
add esp, 0x18
mov dword [ebp - 0x430], 0x104
lea eax, [ebp - 0x428]
xorps xmm0, xmm0
movsd qword [ebp - 0x438], xmm0
push eax
push 0x20019
push ebx
push 0x1002df94
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001f40d
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x430]
mov dword [ebp - 0x42c], ebx
push eax
lea eax, [ebp - 0x21c]
push eax
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
jne 0x1001f305
mov edi, dword [sym.imp.MSVCR120.dll_wcscpy_s]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.MSVCR120.dll__wtof]
fstp qword [ebp - 0x450]
movsd xmm0, qword [ebp - 0x450]
comisd xmm0, xmmword [0x1002e0f0]
pop ecx
jbe 0x1001f2cf
comisd xmm0, xmmword [ebp - 0x438]
jbe 0x1001f2cf
lea eax, [ebp - 0x21c]
movsd qword [ebp - 0x438], xmm0
push eax
lea eax, [ebp - 0x424]
push 0x104
push eax
call edi
add esp, 0xc
mov eax, dword [ebp - 0x42c]
lea ecx, [ebp - 0x430]
push ebx
push ebx
push ebx
push ebx
push ecx
lea ecx, [ebp - 0x21c]
inc eax
push ecx
push eax
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
test esi, esi
je 0x1001f27f
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 0x103
jne 0x1001f40d
mov edi, dword [sym.imp.MSVCR120.dll_wcslen]
push str.ClientUserInterface
call edi
mov esi, eax
mov dword [esp], str.SoftwareMicrosoftSoftGrid_
call edi
add esi, 0x105
mov dword [ebp - 0x42c], ebx
add esi, eax
mov dword [ebp - 4], ebx
xor ecx, ecx
mov dword [ebp - 0x434], esi
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1001d8de
mov edi, eax
mov dword [ebp - 0x42c], edi
pop ecx
pop ecx
test edi, edi
je 0x1001f40d
push esi
push ebx
push edi
call fcn.1001d8de
push str.SoftwareMicrosoftSoftGrid_
push esi
push edi
call dword [sym.imp.MSVCR120.dll_wcscpy_s]
lea eax, [ebp - 0x424]
push eax
push esi
mov esi, dword [sym.imp.MSVCR120.dll_wcscat_s]
push edi
call esi
push str.ClientUserInterface
push dword [ebp - 0x434]
push edi
call esi
add esp, 0x30
lea eax, [ebp - 0x428]
push eax
push 0x20019
push ebx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001f406
push dword [ebp - 0x448]
push str.LaunchCommand
push dword [ebp - 0x428]
call fcn.1001f440
add esp, 0xc
push dword [ebp - 0x43c]
push str.DDELaunchCommand
push dword [ebp - 0x428]
call fcn.1001f440
add esp, 0xc
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.MSVCR120.dll_void___cdecl_operator_delete___void__
pop ecx
call fcn.10026567
ret