Function at 0x10001d39
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 4
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.100107a2
mov dword [ebp - 8], eax
call fcn.1001085f
cmp dword [ebp - 8], 0
push 0x10
mov dword [ebp - 0xc], eax
pop ebx
jne 0x10001db9
mov eax, ebx
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x10001d88
push 0x8d
push 8
mov eax, edi
mov edx, 0x10029bfc
call fcn.100117e3
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001d8d
sub eax, edx
lea esi, [eax + 1]
call fcn.10012679
mov edx, eax
mov dword [ebp - 8], edx
test edx, edx
je 0x10001f7c
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10001daf
cmp dword [ebp - 0xc], 0
jne 0x10001e10
mov eax, ebx
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x10001ddf
push 0x97
push 8
mov eax, edi
mov edx, 0x10029e20
call fcn.100117e3
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001de4
sub eax, edx
lea esi, [eax + 1]
call fcn.10012679
mov edx, eax
mov dword [ebp - 0xc], edx
test edx, edx
je 0x10001f70
mov eax, edi
sub edx, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10001e06
push 0x30
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10001e2c
push 0x7f
push 0x2f
mov edx, 0x10029338
call fcn.100117e3
lea ecx, [ebp - 0x10]
push ecx
push 0x201
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10001e86
mov eax, ebx
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x10001e65
push 0x91
push 0xb
mov edx, 0x10029560
call fcn.100117e3
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x18]
push ecx
push 0
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.1001091c
xor dword [ebp - 4], eax
mov eax, ebx
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x10001eae
push 0x98
push 0xa
mov eax, edi
mov edx, 0x10029240
call fcn.100117e3
push dword [ebp - 4]
mov esi, dword [sym.imp.USER32.dll_CharUpperA]
push dword [ebp - 0xc]
call esi
push eax
push dword [ebp - 8]
call esi
push eax
push edi
push 0x104
mov esi, 0x1002b440
push esi
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x18
push 0x28
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x10001efa
push 0x93
push 0x25
mov edx, 0x1002924c
call fcn.100117e3
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10001eff
sub eax, edx
xor esi, esi
cmp byte [0x1002b440], 0
mov ebx, eax
je 0x10001f4b
lea edi, [esi + 0x1002b440]
movsx ax, byte [edi]
movzx eax, ax
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.SHLWAPI.dll_StrChrIA]
test eax, eax
jne 0x10001f41
push ebx
lea eax, [esi + 0x1002b441]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
xor esi, esi
inc esi
cmp byte [esi + 0x1002b440], 0
jne 0x10001f15
cmp dword [0x1002b548], 0
je 0x10001f70
call fcn.10001ce1
test eax, eax
je 0x10001f70
call fcn.100052df
cmp dword [0x1002b730], 0
jne 0x10001f70
call fcn.10005664
mov esi, dword [ebp - 8]
test esi, esi
je 0x10001f7c
call fcn.1001272d
mov esi, dword [ebp - 0xc]
test esi, esi
je 0x10001f88
call fcn.1001272d
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
leave
ret