Function at 0x101b2a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
push esi
push edi
xor edi, edi
push 0x1034c00
push edi
push edi
push 0x1011800
mov dword [ebp - 4], 0x80004005
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x40], 8
call dword [sym.imp.ntdll.dll_EtwEventRegister]
test eax, eax
je 0x101b300
mov dword [0x1034c00], edi
mov dword [0x1034c04], edi
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov ebx, dword [sym.imp.ntdll.dll_EtwEventWrite]
mov edx, ecx
or edx, eax
je 0x101b4cc
mov esi, 0x10118f0
push esi
push eax
push ecx
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101b356
lea eax, [ebp - 0x64]
push eax
push 1
push esi
push dword [0x1034c04]
mov dword [ebp - 0x64], 0x1011ccc
push dword [0x1034c00]
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], 0x14
mov dword [ebp - 0x58], edi
call ebx
mov eax, dword [0x1034c00]
mov ecx, dword [0x1034c04]
mov edx, eax
or edx, ecx
je 0x101b4cc
push 0x10118a0
push ecx
push eax
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101b4cc
xor eax, eax
inc eax
xor esi, esi
xor edi, edi
cmp dword [ebp + 8], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], eax
jle 0x101b456
mov ecx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
and dword [ebp - 0x30], 0
lea eax, [eax + ecx*4]
lea ecx, [ebp - 0x30]
push ecx
push 0x7fffffff
push dword [eax]
mov dword [ebp - 0x48], eax
call fcn.01019088
test eax, eax
jl 0x101b550
mov eax, dword [ebp - 0x30]
inc eax
inc eax
add edi, eax
lea eax, [edi + 2]
cmp eax, dword [ebp - 0xc]
jb 0x101b424
lea eax, [edi + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword fs:[0x18]
push dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
test esi, esi
je 0x101b40f
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlReAllocateHeap]
mov dword [ebp - 0x44], eax
test eax, eax
jne 0x101b40a
push esi
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov esi, dword [ebp - 0x44]
jmp 0x101b41c
push 8
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x101b55c
mov eax, dword [ebp - 0x48]
push dword [eax]
push dword [ebp - 0xc]
push esi
call fcn.01018fb6
push 0x1011cc8
push dword [ebp - 0xc]
push esi
call fcn.01018fb6
add edi, 4
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
jl 0x101b396
test esi, esi
jne 0x101b484
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0xe
pop edi
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
je 0x101b55c
push 0x1011cb8
push edi
push esi
call fcn.01018f3a
and dword [ebp - 0x80], 0
and dword [ebp - 0x78], 0
lea eax, [ebp - 0x84]
push eax
push 1
push 0x10118a0
push dword [0x1034c04]
mov dword [ebp - 0x84], esi
push dword [0x1034c00]
mov dword [ebp - 0x7c], edi
call ebx
test esi, esi
je 0x101b4ca
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 8], esi
mov dword [ebp - 8], esi
jle 0x101b5d2
mov dword [ebp - 0xc], 2
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov esi, dword [eax + ecx*4]
lea eax, [ebp - 0x3c]
push eax
push 0x7fffffff
push esi
mov dword [ebp - 0x3c], edi
call fcn.0101904c
test eax, eax
jl 0x101b66d
cmp dword [ebp - 0x3c], 2
jne 0x101b66d
movzx eax, word [esi]
cmp ax, 0x2d
je 0x101b522
cmp ax, 0x2f
jne 0x101b66d
movzx eax, word [esi + 2]
push eax
call dword [sym.imp.msvcrt.dll_towupper]
movzx eax, ax
sub eax, 0x43
pop ecx
je 0x101b595
dec eax
je 0x101b58c
sub eax, 9
je 0x101b568
sub eax, 6
jne 0x101b66d
mov dword [ebp - 0x24], 1
jmp 0x101b5bd
mov dword [ebp - 4], 0x57
jmp 0x101bc42
mov dword [ebp - 4], 8
jmp 0x101bbca
cmp dword [ebp - 0x1c], edi
jne 0x101b66d
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
jle 0x101b66d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + ecx*4 + 4]
mov dword [ebp - 0x1c], eax
jmp 0x101b5b7
mov dword [ebp - 0x2c], 1
jmp 0x101b5bd
cmp dword [ebp - 0x18], edi
jne 0x101b66d
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 0xc]
jle 0x101b66d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov eax, dword [eax + ecx*4 + 4]
mov dword [ebp - 0x18], eax
inc dword [ebp - 8]
inc dword [ebp - 0xc]
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
inc dword [ebp - 0xc]
cmp eax, dword [ebp + 8]
jl 0x101b4e2
xor esi, esi
inc esi
push edi
push esi
push 0x1011c90
call fcn.0101d001
test eax, eax
je 0x101bbc3
push edi
push esi
push 0x1011c68
call fcn.0101d001
test eax, eax
je 0x101bbc3
push edi
push esi
push 0x1011c34
call fcn.0101d001
test eax, eax
je 0x101bbc3
call fcn.0101cdcd
test eax, eax
je 0x101b679
mov eax, dword [0x1034c00]
mov ecx, dword [0x1034c04]
mov edx, eax
or edx, ecx
je 0x101b64b
mov esi, 0x1011920
push esi
push ecx
push eax
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101b64b
push edi
push edi
push esi
push dword [0x1034c04]
push dword [0x1034c00]
call ebx
push 0x10117c4
call fcn.0101c921
push edi
push 0x10117d8
call fcn.0101d78b
call fcn.010190fb
mov dword [ebp - 4], edi
jmp 0x101bc42
mov dword [ebp - 4], 0x57
jmp 0x101bbca
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0x4c], edi
call fcn.0101d3a6
test eax, eax
jne 0x101b6ca
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc42
mov esi, 0x1011810
push esi
push eax
push ecx
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bc42
push edi
push edi
push esi
push dword [0x1034c04]
push dword [0x1034c00]
call ebx
jmp 0x101bc42
push 3
push 0x300
push 6
push edi
push 0x10117d8
call fcn.01021b32
mov dword [ebp - 0x10], eax
cmp eax, edi
jne 0x101b717
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011820
push esi
push eax
push ecx
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bc26
push edi
push edi
jmp 0x101bc17
cmp dword [ebp - 0x2c], edi
je 0x101b742
push eax
call fcn.01020fc1
test eax, eax
jne 0x101b742
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011830
jmp 0x101b6ff
cmp dword [ebp - 0x24], edi
je 0x101b74f
mov dword [ebp - 4], edi
jmp 0x101bc26
mov esi, 0x1034c20
mov ecx, esi
call fcn.0101b178
test eax, eax
jne 0x101b77b
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011890
jmp 0x101b6ff
push edi
push 0x28
push 0x101ad0a
call dword [sym.imp.KERNEL32.dll_EnumUILanguagesW]
cmp dword [0x1034bf0], 3
jbe 0x101b87b
lea eax, [ebp - 0x20]
push eax
push 0x1034bf4
call fcn.01018555
test eax, eax
je 0x101b8a2
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x1c]
push 0x1034bfc
call fcn.0101871a
test eax, eax
je 0x101b8a2
mov edx, dword [0x1034bfc]
test edx, edx
je 0x101b8a2
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x20], eax
jne 0x101b815
mov esi, dword [0x1034bf4]
lea ecx, [eax + eax]
mov edi, edx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x101b7f1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x101b810
push edx
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
and dword [0x1034bfc], 0
mov esi, 0x1034c20
push 0x1034bf8
xor edi, edi
call fcn.010186ff
mov ecx, esi
call fcn.0101b178
test eax, eax
je 0x101b75f
mov eax, dword [0x1034bf4]
cmp eax, edi
je 0x101b849
push eax
mov ecx, esi
call fcn.0101ac8d
test eax, eax
je 0x101b75f
mov eax, dword [0x1034bfc]
cmp eax, edi
je 0x101b862
push eax
mov ecx, esi
call fcn.0101ac8d
test eax, eax
je 0x101b75f
mov eax, dword [0x1034bf8]
cmp eax, edi
je 0x101b87b
push eax
mov ecx, esi
call fcn.0101ac8d
test eax, eax
je 0x101b75f
mov ecx, esi
call fcn.0101b1d3
test eax, eax
jne 0x101b8d6
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011890
jmp 0x101b8bc
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011840
push esi
push eax
push ecx
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bc26
push 0
push 0
jmp 0x101bc17
push dword [ebp - 0x10]
call fcn.0101a168
test eax, eax
je 0x101b886
mov ecx, esi
call fcn.0101b178
test eax, eax
je 0x101b886
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebp - 0x50]
mov dword [0x1034c0c], eax
mov eax, dword [ebp - 0x54]
mov dword [0x1034c08], eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x38]
push eax
xor edi, edi
push edi
push 0x40
push 0x1011c10
push 0x1011778
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x101b93b
mov dword [ebp - 0x38], 0x28e44000
mov dword [ebp - 0x34], 0x580
mov eax, dword [ebp - 0x34]
cmp dword [0x1034c0c], eax
ja 0x101b961
jb 0x101b953
mov ecx, dword [0x1034c08]
cmp ecx, dword [ebp - 0x38]
jae 0x101b961
mov dword [0x1034c08], edi
mov dword [0x1034c0c], edi
jmp 0x101b970
mov ecx, dword [ebp - 0x38]
sub dword [0x1034c08], ecx
sbb dword [0x1034c0c], eax
mov esi, dword [ebp - 0x10]
mov eax, dword [esi + 0x20]
cmp eax, edi
je 0x101b9b5
mov eax, dword [eax + 0x14]
mov dword [0x1034c1c], eax
cmp dword [eax + 0x20], edi
je 0x101b9b5
mov eax, dword [eax + 0x20]
mov eax, dword [eax + 0xc]
cmp eax, edi
je 0x101b9b5
mov ecx, dword [eax + 0x14]
cmp ecx, dword [0x1034c0c]
jb 0x101b9b5
ja 0x101b9a9
mov eax, dword [eax + 0x10]
cmp eax, dword [0x1034c08]
jb 0x101b9b5
mov dword [0x1034c08], edi
mov dword [0x1034c0c], edi
lea eax, [ebp - 0x54]
push eax
call fcn.0101821a
call fcn.010183dd
call fcn.0101d754
mov dword [0x1034c18], eax
cmp dword [ebp - 0x18], edi
je 0x101ba00
push dword [ebp - 0x18]
push dword [esi + 0x1c]
call fcn.0101adbb
test eax, eax
jne 0x101ba14
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011850
jmp 0x101b6ff
push 0x256
push 0x1031010
push dword [esi + 0x1c]
call fcn.0101aece
jmp 0x101b9dd
push dword [esi + 0x1c]
call fcn.01023fdc
push dword [esi + 0x1c]
call fcn.010238bd
push dword [esi + 0x1c]
call fcn.0102235b
test eax, eax
jne 0x101ba4f
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011860
jmp 0x101b6ff
push 0xc
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x14], eax
xor esi, esi
push dword [esi + 0x1031004]
push dword [ebp - 0x14]
call fcn.01026d11
mov edi, 0x1011bf4
test eax, eax
je 0x101ba86
add esi, 4
cmp esi, 0xc
jb 0x101ba65
jmp 0x101bac8
push dword [ebp - 0x14]
call fcn.01026ee2
mov eax, dword [0x1034c00]
mov ecx, dword [0x1034c04]
and dword [ebp - 0x14], 0
mov edx, eax
or edx, ecx
je 0x101bb21
mov esi, 0x1011930
push esi
push ecx
push eax
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bac8
push 0
push 0
push esi
push dword [0x1034c04]
push dword [0x1034c00]
call ebx
mov eax, dword [0x1034c00]
mov ecx, dword [0x1034c04]
mov edx, eax
or edx, ecx
je 0x101bb21
mov esi, 0x10118c0
push esi
push ecx
push eax
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bb21
and dword [ebp - 0xa0], 0
and dword [ebp - 0x98], 0
lea eax, [ebp - 0xa4]
push eax
push 1
push esi
push dword [0x1034c04]
mov dword [ebp - 0xa4], edi
push dword [0x1034c00]
mov dword [ebp - 0x9c], 0x1c
call ebx
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x10]
call fcn.01020b9e
test eax, eax
jne 0x101bb4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
test eax, eax
jne 0x101bbca
mov dword [ebp - 4], 0x80004005
jmp 0x101bbca
mov eax, dword [0x1034c00]
mov ecx, dword [0x1034c04]
mov edx, eax
or edx, ecx
je 0x101bb96
mov esi, 0x10118d0
push esi
push ecx
push eax
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bb96
and dword [ebp - 0x70], 0
and dword [ebp - 0x68], 0
lea eax, [ebp - 0x74]
push eax
push 1
push esi
push dword [0x1034c04]
mov dword [ebp - 0x74], edi
push dword [0x1034c00]
mov dword [ebp - 0x6c], 0x1c
call ebx
push dword [ebp - 0x10]
call fcn.01017fad
test eax, eax
jne 0x101bbbd
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011880
jmp 0x101b8bc
and dword [ebp - 4], 0
jmp 0x101bc26
mov dword [ebp - 4], 5
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bc26
mov esi, 0x1011870
push esi
push eax
push ecx
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bc26
and dword [ebp - 0x90], 0
and dword [ebp - 0x88], 0
lea eax, [ebp - 4]
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x8c], 4
push 1
push esi
push dword [0x1034c04]
push dword [0x1034c00]
call ebx
cmp dword [ebp - 0x10], 0
je 0x101bc34
push dword [ebp - 0x10]
call fcn.01020c2f
cmp dword [ebp - 0x14], 0
je 0x101bc42
push dword [ebp - 0x14]
call fcn.01026ee2
mov eax, dword [0x1034bf4]
xor edi, edi
cmp eax, edi
je 0x101bc61
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [0x1034bfc]
cmp eax, edi
je 0x101bc7e
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [0x1034bf8]
cmp eax, edi
je 0x101bc9b
push eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, dword [0x1034c00]
mov eax, dword [0x1034c04]
mov edx, ecx
or edx, eax
je 0x101bd1b
mov esi, 0x1011900
push esi
push eax
push ecx
call dword [sym.imp.ntdll.dll_EtwEventEnabled]
test al, al
je 0x101bcf6
lea eax, [ebp - 0xb4]
push eax
push 1
push esi
push dword [0x1034c04]
mov dword [ebp - 0xb4], 0x1011ccc
push dword [0x1034c00]
mov dword [ebp - 0xb0], edi
mov dword [ebp - 0xac], 0x14
mov dword [ebp - 0xa8], edi
call ebx
mov eax, dword [0x1034c00]
mov ecx, dword [0x1034c04]
mov edx, eax
or edx, ecx
je 0x101bd1b
push ecx
push eax
call dword [sym.imp.ntdll.dll_EtwEventUnregister]
mov dword [0x1034c00], edi
mov dword [0x1034c04], edi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret