Function at 0x100013e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10002e70
mov eax, dword fs:[0]
push eax
sub esp, 0x1c8
mov eax, dword [0x10005004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [0x1000501c]
mov edx, dword [0x10005020]
cmp ecx, edx
je 0x10001430
push ecx
call fcn.100011c0
mov eax, dword [0x1000501c]
add esp, 4
mov dword [0x10005020], eax
lea eax, [ebp - 0x1ac]
push eax
push 0x20019
push 0
push str.HardwareDeviceMapSerialComm
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov dword [ebp - 0x1d4], edi
test edi, edi
jne 0x100016c2
xor esi, esi
mov dword [ebp - 0x1a8], 0x64
mov dword [ebp - 0x1a4], 0x64
nop dword [eax]
nop dword [eax + eax]
lea eax, [ebp - 0x1a8]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0
push 0
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1a0]
push eax
push esi
push dword [ebp - 0x1ac]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
mov dword [ebp - 0x1d0], esi
test eax, eax
jne 0x10001691
push dword [ebp - 0x1a8]
call fcn.100023db
mov ecx, dword [ebp - 0x1a8]
add esp, 4
mov edi, eax
lea eax, [ebp - 0xd8]
mov dword [ebp - 0x1cc], edi
push 0
push 0
push ecx
push edi
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov esi, edi
mov dword [ebp - 0x1b8], 0
xorps xmm0, xmm0
mov dword [ebp - 0x1b4], 0
movups xmmword [ebp - 0x1c8], xmm0
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x10001513
sub esi, ecx
cmp esi, 0x7fffffff
ja 0x100016ea
mov dword [ebp - 0x1b4], 0xf
cmp esi, 0x10
jae 0x10001550
push esi
lea eax, [ebp - 0x1c8]
mov dword [ebp - 0x1b8], esi
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
jmp 0x100015eb
mov edi, esi
or edi, 0xf
cmp edi, 0x7fffffff
jbe 0x1000156c
mov ecx, 0x80000000
mov edi, 0x7fffffff
add ecx, 0x23
jmp 0x1000158c
cmp edi, 0x16
mov eax, 0x16
cmovb edi, eax
lea eax, [edi + 1]
cmp eax, 0x1000
jb 0x100015aa
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x100016ef
push ecx
call fcn.100023ab
mov ecx, eax
add esp, 4
test ecx, ecx
je 0x100016e4
lea eax, [ecx + 0x23]
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x100015bb
test eax, eax
je 0x100015b9
push eax
call fcn.100023ab
add esp, 4
jmp 0x100015bb
xor eax, eax
push esi
mov dword [ebp - 0x1b4], edi
mov edi, dword [ebp - 0x1cc]
push edi
push eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1b8], esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 0x1b0]
mov byte [eax + esi], 0
add esp, 0xc
mov dword [ebp - 4], 0
mov eax, dword [0x10005020]
cmp eax, dword [0x10005024]
je 0x1000162e
movups xmm0, xmmword [ebp - 0x1c8]
mov ecx, 0xf
mov byte [ebp - 0x1c8], 0
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0x1b8]
movq qword [eax + 0x10], xmm0
add dword [0x10005020], 0x18
jmp 0x10001646
lea ecx, [ebp - 0x1c8]
push ecx
push eax
mov ecx, 0x1000501c
call fcn.10001e00
mov ecx, dword [ebp - 0x1b4]
mov dword [ebp - 4], 0xffffffff
cmp ecx, 0x10
jb 0x1000167d
mov edx, dword [ebp - 0x1c8]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10001673
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100016e4
push ecx
push edx
call fcn.10002060
add esp, 8
push edi
call fcn.100023e4
mov esi, dword [ebp - 0x1d0]
add esp, 4
jmp 0x10001460
mov dword [ebp - 0x1a8], 0x64
mov dword [ebp - 0x1a4], 0x64
cmp eax, 0x103
jne 0x10001480
push dword [ebp - 0x1ac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x1d4]
xor eax, eax
test edi, edi
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10002052
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.100013d0
call fcn.10001330
int3