Function at 0x100b53d5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x101dc354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, ecx
push edi
test eax, eax
je 0x100d76e8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov edi, ecx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20], ecx
test edx, edx
je 0x100d772d
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ecx
push edx
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test byte [ebp + 8], 1
mov esi, eax
je 0x100b5475
cmp esi, 2
jne 0x100b5470
mov edi, dword [ebp - 0x14]
test esi, esi
jle 0x100b544a
movzx esi, si
or esi, 0x80070000
test edi, edi
je 0x100b545d
cmp dword [ebp - 0x10], 0
je 0x100b545d
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100b88c0
leave
ret 0xc
cmp esi, 3
je 0x100b543a
test esi, esi
jne 0x100d7704
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax]
test ecx, ecx
jne 0x100d7735
lea eax, [ebp - 8]
push eax
push ecx
lea eax, [ebp - 0xc]
push eax
push ecx
push ebx
push esi
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test byte [ebp + 8], 1
mov esi, eax
je 0x100b54ac
cmp esi, 2
je 0x100b5520
test esi, esi
jne 0x100d77eb
mov eax, edi
cmp dword [ebp - 0xc], 1
jne 0x100d7806
xor esi, esi
test eax, eax
jne 0x100b5503
mov edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
shr edi, 1
add edi, 2
mov edx, edi
call fcn.100a70d5
mov esi, eax
test esi, esi
js 0x100d7815
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x100d781d
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ecx]
mov word [eax + edi*2 - 4], dx
mov eax, dword [ecx]
xor ecx, ecx
mov word [eax + edi*2 - 2], cx
mov edi, dword [ebp - 0x14]
jmp 0x100b544a
mov esi, 0x80070002
jmp 0x100b5518
push 0x10009c50
mov edx, 0x13b
mov ecx, 0x10009bfc
call fcn.100e970f
mov edx, dword [ebp - 0x14]
jmp 0x100b5400
jle 0x100d770f
movzx esi, si
or esi, 0x80070000
mov edi, dword [ebp - 0x14]
push edi
push 0x10009c20
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b544a
mov dword [ebp - 0x10], esi
jmp 0x100b5480
lea edx, [ebp - 0x1c]
call fcn.100b2a83
mov esi, eax
test esi, esi
jns 0x100d7769
push 0x1002f5ac
jmp 0x100d7754
mov esi, 0x8007000d
push 0x1002f674
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x10
jmp 0x100b5518
mov edi, dword [ebp - 0x1c]
lea eax, [edi*2 - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
lea eax, [ebp - 0xc]
push eax
push 0
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x100d779b
inc eax
jmp 0x100b54b6
cmp esi, 0xea
je 0x100d77fe
test byte [ebp + 8], 1
je 0x100d77b2
cmp esi, 2
je 0x100b5520
test esi, esi
jle 0x100d77bf
movzx esi, si
or esi, 0x80070000
push ebx
push 0x1002f5d0
jmp 0x100d77d6
movzx esi, ax
or esi, 0x80070000
push ebx
push 0x10009c5c
push 1
push esi
push 0x4000000
call fcn.100ab973
add esp, 0x14
jmp 0x100b5518
jle 0x100d77f6
movzx esi, si
or esi, 0x80070000
push ebx
push 0x1002f628
jmp 0x100d77d6
mov eax, dword [ebp - 0x20]
jmp 0x100b54b6
cmp dword [ebp - 0xc], 2
je 0x100b54c0
jmp 0x100d774a
push ebx
push 0x1002f69c
jmp 0x100d77d6
jg 0x100d77c7
mov esi, eax
jmp 0x100d77d0