Function at 0x1001f950
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x1c
mov eax, 0x10024c4f
call fcn.100244ee
mov esi, ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
mov eax, dword [0x100450a0]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
xor ebx, ebx
push eax
push dword [ebp + 8]
inc ebx
mov byte [ebp - 4], bl
call fcn.1001c930
test eax, eax
je 0x10027faa
push 0x10045610
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [ebp - 4], 2
inc dword [esi + 8]
mov ecx, dword [esi + 8]
mov edi, dword [ebp - 0x20]
cmp ecx, dword [0x10045660]
jle 0x10027ed4
mov eax, dword [0x1004560c]
test eax, eax
je 0x1001faa7
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push edi
push eax
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1001faa7
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
push eax
call fcn.1001efe0
mov eax, dword [esi + 8]
cmp eax, dword [0x10045660]
jle 0x1001fa8a
cmp eax, 0x10
jg 0x1001fa8a
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x10027f55
lea ecx, [ebp - 0x20]
push ecx
mov ecx, eax
call fcn.1001ee58
mov edi, eax
xor esi, esi
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], esi
test ebx, ebx
je 0x1001fa65
push 8
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 4
test eax, eax
je 0x1001fadd
push dword [ebp + 0xc]
mov ecx, eax
call fcn.1001ee58
mov esi, eax
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
test edi, edi
je 0x10027f62
test ebx, ebx
je 0x1001fa79
test esi, esi
je 0x10027f62
lea eax, [ebp - 0x28]
push eax
call fcn.100203c3
test eax, eax
je 0x10027f5c
push 0x10045610
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebp - 0x20]
call fcn.1001ef70
mov eax, ebx
call fcn.10024453
ret 8
mov edi, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
mov edx, edi
call fcn.1001d232
test eax, eax
js 0x1001fad6
mov eax, dword [ebp - 0x20]
mov edx, dword [edi]
mov ecx, dword [eax - 0xc]
sub ecx, dword [edx - 0xc]
je 0x10027f1f
test ecx, ecx
jne 0x1001f9de
jmp 0x10027f32
xor ebx, ebx
jmp 0x1001f9de
xor esi, esi
jmp 0x1001fa5f
mov eax, dword [0x10045658]
mov edx, dword [edi - 0xc]
mov eax, dword [eax + ecx*8 - 8]
mov eax, dword [eax]
sub edx, dword [eax - 0xc]
jne 0x10027ef5
push eax
lea ecx, [ebp - 0x20]
call fcn.1003c95b
mov ecx, dword [esi + 8]
mov edx, eax
test edx, edx
jne 0x1001f9af
mov eax, dword [0x10045658]
mov eax, dword [eax + ecx*8 - 4]
test eax, eax
je 0x10027f18
mov ecx, dword [ebp + 0xc]
push eax
call fcn.1001efe0
jmp 0x1001fa8a
xor ebx, ebx
jmp 0x1001fa8a
push edx
lea ecx, [ebp - 0x20]
call fcn.1003c95b
mov ecx, eax
mov eax, dword [ebp - 0x20]
jmp 0x1001fac9
mov ecx, dword [0x1004560c]
test ecx, ecx
je 0x1001f9de
push 0
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegSetValueExW]
jmp 0x1001f9de
xor edi, edi
jmp 0x1001fa23
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
dec dword [eax + 8]
test edi, edi
je 0x10027f86
mov ecx, edi
call fcn.1001ef70
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x1001fa8a
mov ecx, esi
call fcn.1001ef70
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001fa8a
lea ecx, [ebp - 0x20]
call fcn.1001ef70
jmp 0x10027fba
xor eax, eax
jmp 0x1001fa9f