Function at 0x1007c140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100fb910
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x1013c014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x1014ea10
mov dword [ebp - 0x20], 0x1014ea10
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x1014ea30], 0
mov ebx, 0x1014ea30
mov dword [ebp - 0x1c], ebx
jne 0x1007c198
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x1014ea30], eax
jmp 0x1007c19d
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], 0
mov esi, dword [0x1014e914]
mov eax, dword [0x1014e9d0]
mov dword [0x1014e9d4], eax
cmp dword [esi], 0
je 0x1007c3ca
nop dword [eax]
cmp dword [esi + 4], 1
jne 0x1007c1d9
push str.SearchTrack
push dword [esi]
call fcn.100dc721
add esp, 8
test eax, eax
je 0x1007c1e6
add esi, 0x60
cmp dword [esi], 0
jne 0x1007c1c0
jmp 0x1007c3ca
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
cmp word [esi + 0x38], 3
jne 0x1007c202
cmp dword [esi + 0x40], 1
mov byte [ebp - 0xd], 1
je 0x1007c206
mov byte [ebp - 0xd], 0
push 0x10158d3c
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
cmp byte [ebp - 0xd], 0
je 0x1007c3ca
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
push 0x20019
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
push dword [0x1014e928]
push SysReAllocString
call fcn.10013210
mov esi, dword [ebp - 0x2c]
test eax, eax
jne 0x1007c33d
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0
push eax
push 0
push str.ItemRanks
push esi
call edi
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x1007c33d
mov eax, 0xaaaaaaab
mul ecx
shr edx, 3
lea eax, [edx + edx*2]
shl eax, 2
sub ecx, eax
jne 0x1007c33d
push 0x1014e9d0
push edx
mov ecx, 0x1014e9d0
call fcn.10083530
lea eax, [ebp - 0x14]
push eax
push dword [0x1014e9d0]
lea eax, [ebp - 0x18]
push eax
push 0
push str.ItemRanks
push esi
call edi
mov esi, dword [0x1014e9d0]
cmp dword [esi], 0x434c5348
jne 0x1007c337
cmp dword [esi + 4], 1
jne 0x1007c337
mov edi, dword [0x1014e9d4]
mov eax, 0x2aaaaaab
mov ecx, edi
sub ecx, esi
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x100
jbe 0x1007c33d
add esi, 0xc
mov ecx, edi
sub ecx, esi
mov eax, 0x2aaaaaab
imul ecx
push 0x1007bfd0
sar edx, 1
mov ecx, esi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, edi
push eax
call fcn.10084190
add esp, 8
mov ecx, 0x1014e9d0
push 0x1014e9d0
push 0x100
call fcn.10083530
jmp 0x1007c33d
mov dword [0x1014e9d4], esi
mov eax, dword [0x1014e9d4]
cmp dword [0x1014e9d0], eax
jne 0x1007c389
xor ecx, ecx
mov dword [ebp - 0x38], 0x434c5348
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x30], ecx
cmp dword [0x1014e9d8], eax
je 0x1007c37a
movq xmm0, qword [ebp - 0x38]
movq qword [eax], xmm0
mov dword [eax + 8], ecx
add dword [0x1014e9d4], 0xc
jmp 0x1007c389
lea edx, [ebp - 0x38]
mov ecx, 0x1014e9d0
push edx
push eax
call fcn.10083690
mov ecx, dword [0x1014e9d0]
mov eax, 0x2aaaaaab
mov esi, dword [0x1014e9d4]
add ecx, 0xc
push dword [ebp - 0x18]
sub esi, ecx
imul esi
sar edx, 1
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x1014e9d4]
push eax
call fcn.10084cd0
mov eax, dword [ebp - 0x2c]
add esp, 8
test eax, eax
je 0x1007c3ca
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x1014e940], 1
test ebx, ebx
je 0x1007c3db
mov dword [ebx], 0
push 0x1014ea10
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret