Function at 0x100c1ef
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x102171c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
push dword [eax + 0x3f644]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x208], 0x200
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
xor ebx, ebx
push ebx
push 2
push 0x1001b3c
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
call esi
cmp eax, ebx
jle 0x100c25e
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c2af
mov ecx, dword [ebp - 0x20c]
push 0x100
lea eax, [ecx + 0x400]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0100c06f
mov edi, eax
cmp edi, ebx
jge 0x100c2d6
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0xc
jmp 0x100c4ed
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0xd
jmp 0x100c4ed
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b98
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c30d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c370
xor eax, eax
cmp ax, word [ebp - 0x204]
je 0x100c33d
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x20c]
push 0x100
add eax, 0xa08
push eax
call fcn.0100a660
jmp 0x100c395
mov edi, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push 0x1001b20
push 0xe
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100935e
jmp 0x100c395
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c395
test byte [eax + 0x1c], 4
je 0x100c395
push edi
push 0x1001b20
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
cmp edi, ebx
jl 0x100c752
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b54
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c3d4
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c41f
mov ecx, dword [ebp - 0x20c]
push 0x100
push ecx
lea eax, [ebp - 0x204]
push eax
call fcn.0100c06f
mov edi, eax
cmp edi, ebx
jge 0x100c446
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0x10
jmp 0x100c4ed
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0x11
jmp 0x100c4ed
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b68
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c47d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c4cb
mov ecx, dword [ebp - 0x20c]
push 0x100
lea eax, [ecx + 0x200]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0100c06f
mov edi, eax
cmp edi, ebx
jge 0x100c4fd
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0x12
jmp 0x100c4ed
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010086a5
jmp 0x100c752
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001bcc
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], 0x200
call esi
cmp eax, ebx
jle 0x100c534
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c5d7
mov eax, dword [ebp - 0x20c]
mov eax, dword [eax + 0xa00]
cmp eax, ebx
je 0x100c561
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
mov eax, dword [ebp - 0x20c]
mov dword [eax + 0xa00], ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x204]
push eax
mov dword [ebp - 0x214], ebx
call fcn.0100bcf1
mov dword [ebp - 0x218], eax
cmp eax, ebx
je 0x100c5d7
mov eax, dword [ebp - 0x214]
push 0xa
add eax, 2
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcstol]
add esp, 0xc
cmp eax, ebx
mov dword [ebp - 0x214], eax
jle 0x100c5d7
push ebx
push 0x16
call fcn.01008e1a
push eax
push 0x16
call fcn.01008a42
push eax
movzx eax, word [ebp - 0x214]
push 1
push eax
push dword [ebp - 0x218]
call dword [sym.imp.USER32.dll_LoadImageW]
mov ecx, dword [ebp - 0x20c]
mov dword [ecx + 0xa00], eax
mov eax, dword [ebp - 0x20c]
cmp dword [eax + 0xa00], ebx
jne 0x100c616
mov edi, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push 0x1001b20
push 0x14
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100935e
cmp edi, ebx
jl 0x100c752
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001b80
push ebx
push dword [ebp - 0x210]
mov edi, 0x200
mov dword [ebp - 0x208], edi
call esi
cmp eax, ebx
jle 0x100c658
and eax, 0xffff
or eax, 0x80070000
cmp eax, ebx
jl 0x100c750
xor eax, eax
cmp ax, word [ebp - 0x204]
je 0x100c725
lea eax, [ebp - 0x204]
push eax
mov eax, dword [ebp - 0x20c]
push 0x100
add eax, 0x800
push eax
call fcn.0100a660
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push 2
push 0x1001bb4
push ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x208], edi
call esi
cmp eax, ebx
jle 0x100c6bd
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, ebx
jl 0x100c706
mov ecx, dword [ebp - 0x20c]
push 0x100
lea eax, [ecx + 0x600]
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.0100c06f
mov edi, eax
cmp edi, ebx
jge 0x100c752
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0x15
jmp 0x100c4ed
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push edi
push 0x1001b20
push 0x16
jmp 0x100c4ed
mov edi, 0x80004005
mov eax, dword [section..data]
cmp eax, section..data
je 0x100c752
test byte [eax + 0x1c], 4
je 0x100c752
push 0x1001b20
push 0x17
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100935e
jmp 0x100c752
xor edi, edi
mov eax, dword [ebp - 0x20c]
push dword [eax + 0x3f644]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0101a14f
leave
ret 4