Function at 0x1000d2a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, ecx
mov eax, dword [0x1007d00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [edx + 0x14], 7
mov eax, edx
jbe 0x1000d2bf
mov eax, dword [edx]
xor ecx, ecx
mov dword [ebp - 0x38], edx
mov dword [edx + 0x10], ecx
mov word [eax], cx
lea ebx, [ebp - 0x28]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], 7
mov word [ebx], cx
sub esp, 0x10
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov eax, 0x11
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], str.SOFTWAREClasses_
mov ecx, ebx
call fcn.1000c550
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 7
jbe 0x1000d30a
mov esi, dword [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x1000d49b
lea edi, [ecx + eax]
mov dword [ebp - 0x18], edi
cmp edx, 7
jbe 0x1000d32a
mov ebx, dword [ebp - 0x28]
lea ecx, [ebx + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [ebx + edi*2], 0
xor ebx, ebx
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x14], 7
jbe 0x1000d350
mov eax, dword [ebp - 0x28]
jmp 0x1000d353
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x2c]
push edx
push ebx
push ecx
push 0xffff
push ebx
push eax
push 0x80000002
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
jne 0x1000d42f
mov eax, dword [ebp - 0x2c]
lea ecx, [eax - 1]
cmp ecx, 1
ja 0x1000d50b
cmp eax, 1
setne byte [ebp - 0x31]
mov eax, dword [ebp - 0x30]
inc eax
mov edx, eax
shr edx, 1
mov edi, dword [ebp - 0x38]
mov ecx, dword [edi + 0x10]
mov esi, edx
mov dword [ebp - 0x3c], edx
sub edx, ecx
jbe 0x1000d4d2
mov esi, dword [edi + 0x14]
mov ebx, esi
sub ebx, ecx
cmp ebx, edx
jae 0x1000d44b
mov ecx, edi
push edx
call fcn.1000c8d0
add esp, 4
mov ebx, edi
xor ecx, ecx
mov al, byte [ebp - 0x31]
mov cl, al
cmp dword [ebx + 0x14], 7
mov eax, ebx
jbe 0x1000d3d4
mov eax, dword [ebx]
add ecx, ecx
add ecx, 2
cmp dword [ebp - 0x14], 7
jbe 0x1000d3e4
mov edx, dword [ebp - 0x28]
jmp 0x1000d3e7
lea edx, [ebp - 0x28]
xor esi, esi
lea edi, [ebp - 0x30]
push edi
push eax
push esi
push ecx
push esi
push edx
push 0x80000002
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
jne 0x1000d4f1
mov eax, dword [ebp - 0x30]
inc eax
shr eax, 1
lea ecx, [eax - 1]
mov edx, ecx
sub edx, dword [ebx + 0x10]
ja 0x1000d512
cmp dword [ebx + 0x14], 7
mov edx, ebx
jbe 0x1000d423
mov edx, dword [ebx]
mov dword [ebx + 0x10], ecx
mov word [edx + eax*2 - 2], 0
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jae 0x1000d484
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002f5c0
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov ebx, dword [ebp - 0x3c]
mov dword [edi + 0x10], ebx
mov ebx, edi
cmp esi, 7
mov esi, edi
jbe 0x1000d45c
mov esi, dword [ebx]
test edx, edx
je 0x1000d476
lea edx, [esi + ecx*2]
add ecx, ecx
and eax, 0xfffffffe
sub eax, ecx
push eax
push 0
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov word [esi + eax*2], 0
jmp 0x1000d3c3
mov eax, dword [ebp - 0x28]
inc ecx
test ecx, 0x7ffff800
jne 0x1000d4bd
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x1000d437
sub esp, 0x10
mov cl, byte [ebp - 0x2c]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.1000c550
jmp 0x1000d340
mov ecx, eax
add ecx, 0xfffffffc
mov eax, dword [eax - 4]
sub ecx, eax
cmp ecx, 0x20
jb 0x1000d490
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
cmp dword [edi + 0x14], 7
jbe 0x1000d4dd
mov eax, dword [ebp - 0x38]
mov edi, dword [eax]
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [ebx + 0x10], ecx
mov word [edi + ecx*2], 0
jmp 0x1000d3c3
cmp dword [ebx + 0x14], 7
jbe 0x1000d4fc
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x10], 0
mov word [ebx], 0
xor ebx, ebx
jmp 0x1000d42f
mov ecx, ebx
call fcn.1000c880
jmp 0x1000d42d