Function at 0x100f3d90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x208
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.101f9fcf
add esp, 0xc
mov dword [ebp - 0x224], 0x103
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x10212824
push str.SOFTWARE360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor dword [ebp - 0x20c], 0xcafedead
xor dword [ebp - 0x208], 0xcafedead
xor dword [ebp - 0x204], 0xcafedead
xor dword [ebp - 0x200], 0xcafedead
xor dword [ebp - 0x1fc], 0xcafedead
xor dword [ebp - 0x1f8], 0xcafedead
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f3e49
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 8
call fcn.10003680
add esp, 4
push 0
push 0
push 3
push 0
push 7
push SysReAllocString
push edi
test eax, eax
je 0x100f3e6b
call eax
jmp 0x100f3e71
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, eax
test esi, esi
je 0x100f3e80
push esi
call ebx
cmp edi, 0xffffffff
je 0x100f40c6
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f3e9f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x11
call fcn.10003680
add esp, 4
push 0
push edi
test eax, eax
je 0x100f3eb4
call eax
jmp 0x100f3eba
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x210], eax
test esi, esi
je 0x100f3ec7
push esi
call ebx
mov ebx, dword [ebp - 0x210]
add ebx, 0xf
and ebx, 0xfffffff0
push 0x1025c02a
push ebx
mov dword [ebp - 0x21c], ebx
call fcn.101c85a0
mov esi, eax
push 0x1025c02a
push ebx
mov dword [ebp - 0x214], esi
call fcn.101c85a0
add esp, 0x10
mov ebx, eax
test esi, esi
je 0x100f407f
test ebx, ebx
je 0x100f407c
push dword [ebp - 0x21c]
push 0
push esi
call fcn.101f9fcf
push dword [ebp - 0x21c]
push 0
push ebx
call fcn.101f9fcf
add esp, 0x18
mov dword [ebp - 0x218], 0
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f3f4b
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 9
call fcn.10003680
add esp, 4
push 0
test eax, eax
je 0x100f3f73
lea ecx, [ebp - 0x218]
push ecx
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push edi
call eax
jmp 0x100f3f8d
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x220], eax
test esi, esi
je 0x100f3f9e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x220], 0
je 0x100f402c
mov eax, dword [ebp - 0x210]
cmp dword [ebp - 0x218], eax
jne 0x100f402c
push edi
call fcn.1006c110
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
push ebx
push dword [ebp - 0x214]
call fcn.10056a90
add esp, 0x10
test eax, eax
je 0x100f4066
cmp dword [ebx], 0x55484951
jne 0x100f4001
mov edi, dword [ebp - 0x228]
mov ecx, 0xfe
mov esi, ebx
rep movsd dword es:[edi], dword [esi]
mov esi, 1
jmp 0x100f4003
xor esi, esi
push dword [ebp - 0x214]
call fcn.101f9fe7
push ebx
call fcn.101f9fe7
add esp, 8
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f4042
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x14
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x100f4055
call eax
jmp 0x100f405b
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100f4066
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x214]
call fcn.101f9fe7
push ebx
call fcn.101f9fe7
add esp, 8
jmp 0x100f40c6
push esi
jmp 0x100f4084
test ebx, ebx
je 0x100f408c
push ebx
call fcn.101f9fe7
add esp, 4
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f40a2
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x14
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x100f40b5
call eax
jmp 0x100f40bb
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100f40c6
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8