Function at 0x10009078
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x10065040]
xor ecx, ebp
mov dword [esp + 0xc0], ecx
mov dword [eax], 1
xor esi, esi
lea ebx, [esp + 0xb0]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
sub esp, 0x1c
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x1005b180]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
mov ecx, ebx
call fcn.100041ba
lea ecx, [edi + 0x24]
mov eax, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x1005b180]
movups xmmword [esp + 8], xmm0
mov dword [esp], eax
mov dword [esp + 4], str.TaskLastRunTime
mov dword [esp + 0x24], ecx
call fcn.100041ba
push str.LocalIeToEdgeBhoMutex
call fcn.1000ebbd
add esp, 4
mov dword [esp + 4], edi
mov dword [edi + 0x30], eax
xor ebx, ebx
dec ebx
test eax, eax
je 0x100091b4
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10009188
push 2
call fcn.1000f47d
add esp, 4
test al, al
je 0x100091b4
lea esi, [esp + 0x20]
mov ecx, esi
push 2
push 0x9f
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f4c6
mov ecx, esi
call fcn.10002640
push 0x2d
push str.Failed_to_acquire_last_run_mutex_at_startup:
push eax
call fcn.100063da
add esp, 0xc
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
push eax
call fcn.10001c20
mov ecx, esi
call fcn.1000f822
jmp 0x100091b4
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x34]
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
je 0x100091a5
xor ebx, ebx
mov edi, esi
jmp 0x10009312
xor ebx, ebx
mov eax, dword [esp + 4]
push dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x100091c6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.1002aa2a
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
mov ebx, eax
push 2
call fcn.1000f47d
add esp, 4
test al, al
je 0x10009253
lea edi, [esp + 0x20]
mov ecx, edi
push 2
push 0xc1
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f4c6
mov ecx, edi
call fcn.10002640
push 0x19
push str.Failed_to_read_write_the
push eax
call fcn.100063da
add esp, 0xc
movsx ecx, byte [esi + 0xb]
test ecx, ecx
jns 0x1000922b
mov ecx, dword [esi + 4]
mov esi, dword [esi]
push ecx
push esi
push eax
call fcn.100063da
add esp, 0xc
push str._registry_value:
push eax
call fcn.1000302e
add esp, 8
mov ecx, eax
push ebx
call fcn.10001a10
mov ecx, edi
call fcn.1000f822
xor ebx, ebx
dec ebx
jmp 0x100091a7
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x10009265
mov eax, dword [esi]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ecx
push 8
lea edx, [esp + 0x24]
push edx
push 0xb
push ecx
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x100091e0
push 0
call fcn.1000f47d
add esp, 4
test al, al
mov ebx, 0
je 0x100092f2
lea ecx, [esp + 0x20]
push 0
push 0xae
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f4c6
lea ecx, [esp + 0x20]
call fcn.10002640
movsx ecx, byte [esi + 0xb]
mov edx, esi
test ecx, ecx
jns 0x100092ce
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
push edx
push eax
call fcn.100063da
add esp, 0xc
push 0xf
push str._initial_run:_0
push eax
call fcn.100063da
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.1000f822
push ebx
push ebx
push edi
mov eax, dword [esp + 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetTimer]
add esi, 0x30
add edi, 0x30
cmp esi, dword [esp + 0x14]
je 0x100091a5
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x10009324
mov eax, dword [esi]
mov dword [esp + 0xbc], 0xffffffff
mov dword [esp + 0x20], 8
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0xc4]
push ecx
push ebx
push eax
mov eax, dword [esp + 0x1c]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0xbc]
cmp ecx, 0xb
mov edx, 0
mov ebx, 0xd
cmove ebx, edx
test eax, eax
cmovne ebx, eax
cmp ebx, 2
je 0x1000925b
cmp byte [esi + 0x18], 1
je 0x1000925b
test eax, eax
jne 0x100091e2
cmp ecx, 0xb
jne 0x100091e2
call fcn.1000eb7f
mov ecx, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
sub eax, ecx
mov dword [esp + 0xc], ebx
sbb edx, ebx
mov ecx, dword [esi + 0x10]
mov ebx, 0xdc3cba00
add ecx, ebx
mov ebx, dword [esi + 0x14]
adc ebx, 0xffffffff
cmp eax, ecx
sbb edx, ebx
jae 0x100093df
mov ecx, dword [esp + 4]
push esi
push dword [esp + 0x10]
push dword [esp + 0x18]
call fcn.1000945c
xor ebx, ebx
jmp 0x10009302
push 0
call fcn.1000f47d
add esp, 4
test al, al
mov ebx, 0
je 0x1000944f
lea ecx, [esp + 0x20]
push 0
push 0xb9
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f4c6
lea ecx, [esp + 0x20]
call fcn.10002640
movsx ecx, byte [esi + 0xb]
mov edx, esi
test ecx, ecx
jns 0x1000941f
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push ecx
push edx
push eax
call fcn.100063da
add esp, 0xc
push 0xe
push str._initial_run:
push eax
call fcn.100063da
add esp, 0xc
mov ecx, eax
push 0xea60
call fcn.10001c20
lea ecx, [esp + 0x20]
call fcn.1000f822
push 0
push 0xea60
jmp 0x100092f4