Function at 0x100b418
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x101d950
call fcn.0101caf8
sub esp, 0x690
mov eax, dword [0x1023fb4]
push ebx
mov dword [ebp - 0x10], eax
mov eax, 0x80000002
xor ebx, ebx
push esi
mov dword [ebp - 0x68c], eax
mov dword [ebp - 0x688], 0x80000001
mov dword [ebp - 0x684], ebx
lea esi, [ebp - 0x68c]
push 0x20019
push reloc.MFC42u.DLL_CWinApp::CWinApp
push eax
lea ecx, [ebp - 0x674]
mov dword [ebp - 0x674], ebx
call fcn.0100985e
test eax, eax
jne 0x100b4a7
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x678]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x674]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x100b49c
cmp dword [ebp - 0x678], ebx
ja 0x100b651
lea ecx, [ebp - 0x674]
call fcn.0100650c
lea ecx, [ebp - 0x674]
call fcn.0100650c
add esi, 4
mov eax, dword [esi]
cmp eax, ebx
jne 0x100b44f
lea eax, [ebp - 0x68c]
mov dword [ebp - 0x68c], 7
mov dword [ebp - 0x688], 0x18
mov dword [ebp - 0x684], ebx
mov dword [ebp - 0x678], ebx
mov dword [ebp - 0x680], eax
push edi
mov eax, dword [ebp - 0x680]
mov eax, dword [eax]
cmp eax, ebx
je 0x100b6ad
push ebx
push eax
lea eax, [ebp - 0x420]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jl 0x100b69a
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x674]
call fcn.0101c18c
push 0x5c
lea ecx, [ebp - 0x674]
mov dword [ebp - 4], ebx
call fcn.0101c384
mov edi, eax
cmp edi, 0xffffffff
je 0x100b68b
push 0x1002328
lea ecx, [ebp - 0x694]
call fcn.0101c18c
mov esi, eax
push edi
lea eax, [ebp - 0x690]
push eax
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 1
call fcn.0101c27c
push esi
push eax
lea eax, [ebp - 0x698]
push eax
mov byte [ebp - 4], 2
call fcn.0101c3cc
push eax
lea ecx, [ebp - 0x674]
mov byte [ebp - 4], 3
call fcn.0101c1f8
lea ecx, [ebp - 0x698]
mov byte [ebp - 4], 2
call fcn.0101c168
lea ecx, [ebp - 0x690]
mov byte [ebp - 4], 1
call fcn.0101c168
lea ecx, [ebp - 0x694]
mov byte [ebp - 4], bl
call fcn.0101c168
lea eax, [ebp - 0x674]
push eax
lea ecx, [ebp - 0x67c]
call fcn.0101c24c
push 0x100231c
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 4
call fcn.0101c18c
push eax
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], 5
call fcn.0101c3f0
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 4
call fcn.0101c168
lea eax, [ebp - 0x670]
push eax
push dword [ebp - 0x67c]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100b67d
test byte [ebp - 0x670], 2
je 0x100b634
lea eax, [ebp - 0x644]
push 0x1002304
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x100b63d
test byte [ebp - 0x670], 0x10
je 0x100b66c
lea eax, [ebp - 0x670]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x100b613
jmp 0x100b676
lea ecx, [ebp - 0x674]
call fcn.0100650c
lea ecx, [ebp - 0x674]
call fcn.0100650c
xor eax, eax
inc eax
jmp 0x100b6b4
mov dword [ebp - 0x678], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x67c]
mov byte [ebp - 4], bl
call fcn.0101c168
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.0101c168
add dword [ebp - 0x680], 4
cmp dword [ebp - 0x678], ebx
je 0x100b4e8
mov eax, dword [ebp - 0x678]
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0101bddf
leave
ret