Function at 0x100f6690
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x11ad127c]
xor eax, ebp
mov dword [ebp - 4], eax
and byte [0x11d2068c], 0xf8
lea eax, [ebp - 0x108]
and dword [0x11d213a4], 0xfffffffe
xorps xmm0, xmm0
push 0x1046bfa0
push 0x1046bfb0
push 0x1046bfe0
push eax
movaps xmmword [0x11d20670], xmm0
mov dword [0x11d20680], 0
mov dword [0x11d20684], 0
mov dword [0x11d20688], 1
mov dword [0x11d20a90], 0
mov dword [0x11d2129c], 0
mov dword [0x11d213c4], 0
mov dword [0x11d213d0], 0
mov byte [0x11d213d4], 0
mov byte [0x11d21bd5], 0
mov dword [0x11d21bd8], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x118], 4
call fcn.100086a0
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push 0x201
push 0
lea eax, [ebp - 0x108]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100f67bb
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0
push 0x1046bff0
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 0x110]
xor edx, edx
push dword [ebp - 0x114]
test eax, eax
cmovne ecx, edx
mov dword [ebp - 0x110], ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], 0
push esi
push 0x400
push 0x11d21bdc
setne byte [0x11d213c0]
mov dword [0x11d21bf4], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
push 0x200
push 0
push 0x11d217d5
call fcn.10425c00
add esp, 0xc
push 0x200
push 0x11d217d5
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x200
push 0
push 0x11d219d5
call fcn.10425c00
add esp, 0xc
mov dword [ebp - 0x110], 0x200
mov byte [ebp - 0x109], 0
push 0x10468f70
push 0x10468f90
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x100f686c
mov byte [0x11d21bd5], al
mov eax, 0x11d20670
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1045066c
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
xor ecx, ecx
mov edx, 2
mul edx
push ebx
push edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10450898
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x100f692f
mov ecx, dword [ebp - 0x110]
test ecx, ecx
je 0x100f68ae
xor eax, eax
mov edi, ebx
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
push ebx
lea eax, [ebp - 0x110]
push eax
call esi
test eax, eax
je 0x100f68ce
push ebx
call fcn.10450877
add esp, 4
mov byte [0x11d21bd5], 0
jmp 0x100f693a
mov edi, dword [ebp - 0x110]
push edi
push 0
push 0x11d219d5
call fcn.10425c00
mov esi, ebx
add esp, 0xc
lea ecx, [esi + 2]
nop dword [eax]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x100f68f0
push edi
sub esi, ecx
push ebx
push 0x11d219d5
sar esi, 1
call fcn.1043afce
add esp, 0xc
cmp eax, esi
jne 0x100f6926
push 0x11d219d5
mov byte [ebp - 0x109], 1
call fcn.1043a9cb
add esp, 4
push ebx
call fcn.10450877
add esp, 4
mov al, byte [ebp - 0x109]
mov byte [0x11d21bd5], al
mov ecx, dword [ebp - 4]
mov eax, 0x11d20670
pop edi
pop ebx
xor ecx, ebp
pop esi
call fcn.1045066c
mov esp, ebp
pop ebp
ret