Function at 0x10011f89
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push edi
xor edi, edi
mov dword [ecx + 0x9c], edi
cmp dword [str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer], edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
mov ebx, 0x1001a104
je 0x10012045
push esi
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebx]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1001202d
mov esi, dword [ebx + 4]
jmp 0x10012027
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10012017
cmp dword [ebp - 0xc], 4
jne 0x10012017
cmp dword [ebp - 8], edi
mov eax, dword [ebp - 0x10]
mov ecx, dword [esi + 4]
je 0x1001200f
or dword [eax + 0x9c], ecx
jmp 0x10012017
not ecx
and dword [eax + 0x9c], ecx
mov dword [ebp - 8], edi
mov dword [ebp - 0x14], 4
mov dword [ebp - 0xc], edi
add esi, 8
mov eax, dword [esi]
cmp eax, edi
jne 0x10011fdb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 8
cmp dword [ebx], edi
mov dword [ebp - 4], edi
jne 0x10011fbe
pop esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
inc eax
pop ebx
leave
ret

Function at 0x1001280a
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, 0x100142c3
call fcn.100039d0
sub esp, 0x110
mov eax, dword [0x1001a7a4]
xor eax, dword [ebp + 4]
push esi
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 0x18]
push ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
test esi, esi
jne 0x100128c5
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, 0xff
jmp 0x1001288e
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10001e07
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
call fcn.1001280a
mov ecx, dword [ebp - 0x1c]
mov esi, eax
test esi, esi
setne byte [ebp - 0x11]
or dword [ebp - 4], 0xffffffff
add ecx, 0xfffffff0
call fcn.100011a0
cmp byte [ebp - 0x11], 0
jne 0x100128a3
push ebx
lea eax, [ebp - 0x11c]
push eax
push 0
push dword [ebp - 0x18]
call edi
mov esi, eax
test esi, esi
je 0x10012852
cmp esi, 0x103
pop edi
pop ebx
je 0x100128b5
cmp esi, 0x3f2
jne 0x100128c5
mov eax, dword [ebp + 0xc]
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
mov eax, esi
pop esi
call fcn.1000398c
leave
ret 8

Function at 0x10012ce9
Capabilities:
Get thread local storage value

Disassembly:
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x10012d06
mov ecx, dword [esp + 4]
cmp ecx, dword [eax + 8]
jge 0x10012d06
mov eax, dword [eax + 0xc]
mov eax, dword [eax + ecx*4]
jmp 0x10012d08
xor eax, eax
ret 4