Function at 0x100f5bb2
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xf8
mov eax, 0x10139abb
call fcn.1011094a
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x9c], eax
mov esi, 0x1014a0f1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0x18], ebx
push 0x202
mov dword [ebp - 0x98], 0x100
mov dword [ebp - 0x94], 0x100
call fcn.10063887
pop ecx
push dword [ebp - 0x94]
mov edi, eax
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0xa8], edi
call fcn.10063887
pop ecx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0xa0], eax
push ecx
push eax
mov dword [ebp - 0xac], eax
lea eax, [ebp - 0x18]
push eax
push ebx
lea eax, [ebp - 0x98]
push eax
mov eax, dword [ebp - 0x9c]
push edi
push dword [ebp - 0xb8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
mov dword [ebp - 0xa4], edi
test edi, edi
jne 0x100f5ebd
mov ecx, dword [ebp - 0xbc]
xor edx, edx
mov eax, dword [ebp - 0x98]
push ecx
mov word [ecx + eax*2], dx
lea ecx, [ebp - 0x60]
call fcn.10063887
push esi
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 1
call fcn.10063887
lea eax, [ebp - 0x90]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.10063887
cmp dword [ebp - 0x18], 4
pop ecx
pop ecx
jne 0x100f5cf5
mov edi, dword [ebp - 0xa0]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xa4], esp
push dword [edi]
call fcn.10063887
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 3
call fcn.10063887
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.10063887
jmp 0x100f5df5
cmp dword [ebp - 0x18], 7
jne 0x100f5e3e
push 6
pop ecx
xor eax, eax
mov dword [ebp - 0xa4], ebx
lea edi, [ebp - 0x78]
rep stosd dword es:[edi], eax
push 6
lea ecx, [ebp - 0x78]
call fcn.10082bd8
mov edi, dword [ebp - 0xa0]
mov byte [ebp - 4], 4
cmp word [edi], bx
je 0x100f5db2
push edi
lea ecx, [ebp - 0x48]
call fcn.10063887
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 5
call fcn.10063887
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10063887
pop ecx
pop ecx
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0xb0], esp
push eax
call fcn.10063887
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], 7
call fcn.10083002
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.10063887
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
lea ecx, [ebp - 0x30]
lea edi, [edi + eax*2]
add edi, 2
inc dword [ebp - 0xa4]
call fcn.1001524d
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 4
call fcn.10015273
jmp 0x100f5d23
sub esp, 0x18
lea eax, [ebp - 0x78]
mov ecx, esp
mov dword [ebp - 0xb0], esp
push eax
call fcn.10082938
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 8
call fcn.10063887
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.10063887
lea ecx, [ebp - 0x78]
call fcn.10082ec8
mov edi, dword [ebp - 0xa0]
lea ecx, [ebp - 0x90]
call fcn.1001524d
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.10015273
mov eax, dword [ebp - 0xbc]
test eax, eax
je 0x100f5e22
push eax
call fcn.101109bc
pop ecx
mov dword [ebp - 0xa8], ebx
test edi, edi
je 0x100f5e33
push edi
call fcn.101109bc
pop ecx
mov dword [ebp - 0xac], ebx
inc dword [ebp - 0xb8]
jmp 0x100f5bf2
cmp dword [ebp - 0x18], 1
jne 0x100f5def
mov edi, dword [ebp - 0xa0]
lea ecx, [ebp - 0x48]
push edi
call fcn.10063887
push esi
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 9
call fcn.10063887
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xa
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.10063887
pop ecx
pop ecx
sub esp, 0x18
lea eax, [ebp - 0x30]
mov ecx, esp
mov dword [ebp - 0xb0], esp
push eax
call fcn.10063887
mov ecx, dword [ebp - 0xb4]
lea eax, [ebp - 0x90]
push eax
mov byte [ebp - 4], 0xb
call fcn.10063887
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.10063887
lea ecx, [ebp - 0x30]
call fcn.1001524d
lea ecx, [ebp - 0x48]
call fcn.10015273
jmp 0x100f5df5
cmp edi, 0x103
je 0x100f602c
xor ebx, ebx
lea ecx, [ebp - 0x78]
push str.ImsAuthInfo_Registry_Key_Read_Error
inc ebx
call fcn.10063887
or dword [ebp - 0x9c], 0xffffffff
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xc
push eax
sub esp, 0x18
mov eax, esp
mov dword [ebp - 0xb0], eax
push edi
push eax
call fcn.10063887
pop ecx
pop ecx
push 0x2c2
push 0x1bd
call fcn.1007af33
add esp, 0x28
mov edi, 0x101e2a68
push edi
call sub.MSVCP140.dll__Mtx_lock
pop ecx
push eax
call fcn.10063887
pop ecx
push esi
lea ecx, [ebp - 0x30]
call fcn.10063887
push esi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0xd
call fcn.10063887
mov esi, str.RegistryUtils
mov byte [ebp - 4], 0xe
push esi
lea ecx, [ebp - 0x60]
call fcn.10063887
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.100e1c13
add esp, 0xc
mov dword [ebp - 0x9c], eax
lea ecx, [ebp - 0x60]
call fcn.1001524d
lea ecx, [ebp - 0x48]
call fcn.1001524d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.1001524d
cmp dword [ebp - 0x9c], 0
je 0x100f601d
push 0x1014a0f1
lea ecx, [ebp - 0x30]
call fcn.10063887
push 0x1014a0f1
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0x10
call fcn.10063887
push esi
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0x11
call fcn.10063887
lea eax, [ebp - 0x30]
mov byte [ebp - 4], 0x12
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.100e1c13
add esp, 0xc
mov esi, dword [eax]
push dword [ebp - 0xa4]
push str.GetAllKeyValuesForKeyHandle
mov ecx, dword [esi + 0x24]
push str._s:_Registry_read_failed_with_error:__ld
push 0x1014a0f1
push eax
call dword [0x1014488c]
call dword [esi + 0x24]
add esp, 0x14
lea ecx, [ebp - 0x60]
call fcn.1001524d
lea ecx, [ebp - 0x48]
call fcn.1001524d
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 0xc
call fcn.1001524d
push edi
call sub.MSVCP140.dll__Mtx_unlock
pop ecx
lea ecx, [ebp - 0x78]
call fcn.1001524d
mov eax, dword [ebp - 0xbc]
test eax, eax
je 0x100f603d
push eax
call fcn.101109bc
pop ecx
mov eax, dword [ebp - 0xa0]
test eax, eax
je 0x100f61b3
push eax
call fcn.101109bc
pop ecx
jmp 0x100f61b3
mov eax, ebx
call fcn.10110897
ret