Function at 0x180f3a32
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x181d000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push 0
push eax
mov edi, edx
mov ebx, ecx
call fcn.18132f50
add esp, 0xc
mov dword [ebp - 0x114], esi
lea eax, [ebp - 0x114]
xor esi, esi
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push 0x10002
push str.BuildLabEx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x12c], esi
mov dword [ebp - 0x11c], esi
lea edx, [ecx + 1]
mov dword [ebp - 0x118], 0xf
mov al, byte [ecx]
inc ecx
test al, al
jne 0x180f3ab3
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x12c]
call fcn.1801e6a8
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x180f3aec
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
push 0x110
lea eax, [ebp - 0x244]
mov dword [ebp - 0x248], 0x114
push 0
push eax
call fcn.18132f50
add esp, 0xc
test esi, esi
je 0x180f3da8
lea eax, [ebp - 0x248]
mov ecx, esi
push eax
call dword [0x181623e8]
call esi
test eax, eax
js 0x180f3da8
push 0
push dword [ebp - 0x240]
lea ecx, [ebp - 0x290]
call fcn.180d137d
push 0
push dword [ebp - 0x244]
lea ecx, [ebp - 0x2a8]
mov esi, eax
call fcn.180d137d
add esp, 0x10
mov ecx, eax
push 1
push 0x181a6c60
call fcn.180261a5
xor ecx, ecx
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x250], ecx
mov dword [ebp - 0x24c], ecx
lea ecx, [ebp - 0x260]
push eax
call fcn.18014b32
push esi
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0x114]
lea ecx, [ebp - 0x278]
call fcn.18033b47
lea eax, [ebp - 0x278]
cmp ebx, eax
je 0x180f3bbe
mov ecx, ebx
call fcn.18014aad
lea eax, [ebp - 0x278]
mov ecx, ebx
push eax
call fcn.18014b32
lea ecx, [ebp - 0x278]
call fcn.18014aad
mov eax, dword [ebp - 0x24c]
cmp eax, 0x10
jb 0x180f3c18
mov ecx, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x114], ecx
cmp eax, 0x1000
jb 0x180f3c0f
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.18007b72
mov eax, dword [ebp - 0x130]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x114]
push eax
push ecx
call fcn.1811e7d6
pop ecx
pop ecx
and dword [ebp - 0x250], 0
lea ecx, [ebp - 0x2a8]
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], 0
call fcn.18014aad
lea ecx, [ebp - 0x290]
call fcn.18014aad
push 0
push dword [ebp - 0x23c]
lea ecx, [ebp - 0x2a8]
call fcn.180d137d
push 0x181a6c60
mov edx, ebx
lea ecx, [ebp - 0x290]
mov esi, eax
call fcn.180d9126
add esp, 0xc
lea ecx, [ebp - 0x278]
push esi
push eax
push dword [ebp - 0x114]
call fcn.18033b47
lea eax, [ebp - 0x278]
cmp edi, eax
je 0x180f3ca2
mov ecx, edi
call fcn.18014aad
lea eax, [ebp - 0x278]
mov ecx, edi
push eax
call fcn.18014b32
lea ecx, [ebp - 0x278]
call fcn.18014aad
lea ecx, [ebp - 0x290]
call fcn.18014aad
lea ecx, [ebp - 0x2a8]
call fcn.18014aad
push 0x181a6c60
mov edx, ebx
lea ecx, [ebp - 0x290]
call fcn.180d9126
cmp dword [ebp - 0x118], 0x10
pop ecx
lea ecx, [ebp - 0x12c]
jb 0x180f3ceb
mov ecx, dword [ebp - 0x12c]
push dword [ebp - 0x11c]
push ecx
mov ecx, eax
call fcn.180261a5
xor ebx, ebx
lea ecx, [ebp - 0x260]
push eax
mov dword [ebp - 0x260], ebx
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], ebx
call fcn.18014b32
lea eax, [ebp - 0x260]
cmp edi, eax
je 0x180f3d38
mov ecx, edi
call fcn.18014aad
lea eax, [ebp - 0x260]
mov ecx, edi
push eax
call fcn.18014b32
mov eax, dword [ebp - 0x24c]
cmp eax, 0x10
jb 0x180f3d87
mov ecx, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x130], ecx
cmp eax, 0x1000
jb 0x180f3d7e
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.18007b72
mov eax, dword [ebp - 0x114]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x130]
push eax
push ecx
call fcn.1811e7d6
pop ecx
pop ecx
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x250], ebx
mov dword [ebp - 0x24c], 0xf
mov byte [ebp - 0x260], bl
call fcn.18014aad
mov eax, dword [ebp - 0x118]
cmp eax, 0x10
jb 0x180f3df7
mov ecx, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x130], ecx
cmp eax, 0x1000
jb 0x180f3dee
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.18007b72
mov eax, dword [ebp - 0x114]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x130]
push eax
push ecx
call fcn.1811e7d6
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1811e2a8
leave
ret