Function at 0x100106ec
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2c
mov eax, 0x10014743
call fcn.1001283b
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 5
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 4], 8
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 0xc
test byte [ebp + 0x10], 1
je 0x100107b4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.1001044c
mov esi, eax
cmp dword [ebp - 0x1c], ebx
je 0x10010750
push dword [ebp - 0x20]
call fcn.1000bf2a
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
xor edi, edi
inc edi
cmp esi, ebx
je 0x100107b7
mov dword [ebp - 0x1c], edi
cmp word [esi], bx
je 0x100107a5
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
mov dword [ebp - 4], 0x11
mov ebx, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000ca64
mov eax, ebx
jmp 0x10010c55
push esi
call fcn.1000bf2a
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
jmp 0x100107b7
xor edi, edi
inc edi
cmp dword [0x10018128], ebx
je 0x10010c20
test byte [ebp + 0x10], 0xe
je 0x10010c20
cmp dword [ebp + 0x14], ebx
je 0x1001080e
push dword [ebp + 8]
call fcn.100103e6
test eax, eax
jne 0x1001080e
mov ebx, dword [ebp - 0x20]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
mov dword [ebp - 4], 0x1b
jmp 0x10010792
test byte [ebp + 0x10], 2
je 0x1001095b
mov eax, dword [0x10018124]
mov dword [ebp + 0xc], ebx
cmp eax, 0xffffffff
je 0x10010921
mov dword [ebp + 0xc], edi
mov esi, eax
cmp dword [ebp - 0x2c], ebx
je 0x1001083f
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x30], esi
cmp esi, ebx
je 0x10010849
mov dword [ebp - 0x2c], edi
mov cl, 1
mov dword [ebp - 4], 0xc
test byte [ebp - 0x10], 1
je 0x1001086a
and dword [ebp - 0x10], 0xfffffffe
mov byte [ebp - 4], 0xc
mov eax, dword [ebp + 0x14]
cmp dword [eax], ebx
je 0x1001086a
mov dword [eax + 4], edi
cmp cl, bl
je 0x1001095b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
xor esi, esi
push dword [ebp - 0x30]
call edi
test eax, eax
jne 0x100108e2
cmp dword [ebp - 0x18], 1
jne 0x100108e2
push 0x10002538
push dword [ebp - 0x14]
call fcn.1000c00e
pop ecx
pop ecx
mov esi, eax
cmp dword [ebp - 0x1c], ebx
je 0x100108b8
push dword [ebp - 0x20]
call fcn.1000bf2a
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x100108df
xor eax, eax
mov dword [ebp - 0x1c], 1
mov word [esi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x30]
call edi
mov dword [ebp - 0x1c], ebx
xor esi, esi
inc esi
cmp dword [ebp + 0xc], ebx
je 0x100108ea
mov dword [ebp - 0x2c], ebx
cmp esi, ebx
je 0x1001095b
mov ebx, dword [ebp - 0x20]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
mov dword [ebp - 4], 0x22
jmp 0x10010792
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x30]
call fcn.1000cabe
mov byte [ebp - 4], 0x1c
push dword [eax]
mov dword [ebp - 0x10], edi
push 0x20019
push ebx
push 0x10004200
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10010849
xor cl, cl
jmp 0x1001084b
test byte [ebp + 0x10], 4
mov edi, 0x80000002
je 0x10010ab8
mov eax, dword [0x10018120]
mov dword [ebp + 0xc], ebx
cmp eax, 0xffffffff
je 0x10010a81
mov dword [ebp + 0xc], 1
mov esi, eax
cmp dword [ebp - 0x24], ebx
je 0x10010995
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], esi
cmp esi, ebx
je 0x100109a3
mov dword [ebp - 0x24], 1
mov cl, 1
mov dword [ebp - 4], 0xc
test byte [ebp - 0x10], 2
je 0x100109c8
and dword [ebp - 0x10], 0xfffffffd
mov byte [ebp - 4], 0xc
mov eax, dword [ebp + 0x14]
cmp dword [eax], ebx
je 0x100109c8
mov dword [eax + 4], 1
cmp cl, bl
je 0x10010ab8
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
xor esi, esi
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10010a42
cmp dword [ebp - 0x18], 1
jne 0x10010a42
push 0x10002538
push dword [ebp - 0x14]
call fcn.1000c00e
pop ecx
pop ecx
mov esi, eax
cmp dword [ebp - 0x1c], ebx
je 0x10010a14
push dword [ebp - 0x20]
call fcn.1000bf2a
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x10010a3f
xor eax, eax
mov dword [ebp - 0x1c], 1
mov word [esi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], ebx
xor esi, esi
inc esi
cmp dword [ebp + 0xc], ebx
je 0x10010a4a
mov dword [ebp - 0x24], ebx
cmp esi, ebx
je 0x10010ab8
mov ebx, dword [ebp - 0x20]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
mov dword [ebp - 4], 0x29
jmp 0x10010792
lea eax, [ebp + 0x14]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000cabe
mov byte [ebp - 4], 0x23
push dword [eax]
or dword [ebp - 0x10], 2
push 0x20019
push ebx
push 0x10004200
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100109a3
xor cl, cl
jmp 0x100109a5
test byte [ebp + 0x10], 8
je 0x10010bec
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp - 0x38]
call fcn.1000cabe
mov byte [ebp - 4], 0x2a
push dword [eax]
or dword [ebp - 0x10], 4
push 0x20019
push ebx
push 0x10004258
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10010b14
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10010b14
xor edi, edi
inc edi
cmp dword [ebp - 0x18], edi
jne 0x10010b17
mov cl, 1
jmp 0x10010b19
xor edi, edi
inc edi
xor cl, cl
mov dword [ebp - 4], 0xc
test byte [ebp - 0x10], 4
je 0x10010b38
and dword [ebp - 0x10], 0xfffffffb
mov byte [ebp - 4], 0xc
mov eax, dword [ebp + 0x10]
cmp dword [eax], ebx
je 0x10010b38
mov dword [eax + 4], edi
cmp cl, bl
je 0x10010bec
push 0x10002538
push dword [ebp - 0x14]
call fcn.1000c00e
pop ecx
pop ecx
mov esi, eax
cmp dword [ebp - 0x1c], ebx
je 0x10010b62
push dword [ebp - 0x20]
call fcn.1000bf2a
pop ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x10010bbc
mov dword [ebp - 0x1c], edi
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push ebx
push ebx
push dword [ebp + 8]
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x20]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
mov dword [ebp - 4], 0x35
jmp 0x10010792
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
mov dword [ebp - 4], 0x30
jmp 0x10010792
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000ca64
xor eax, eax
jmp 0x10010c55
mov esi, dword [ebp - 0x20]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x20]
call fcn.10011a47
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x38]
call fcn.1000ca64
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.1000ca64
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1000ca64
mov eax, esi
call fcn.10012913
ret 0x10