Function at 0x10093b9a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x88
mov eax, 0x1017d459
call fcn.1015f0f4
mov dword [ebp - 0x80], ecx
xor ecx, ecx
lea eax, [ebp - 0x68]
push eax
mov edi, 0x20019
mov ebx, ecx
mov dword [ebp - 0x74], ebx
push edi
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x78], ecx
push ecx
cmp byte [ebp + 8], cl
je 0x10093bdc
push 0x10012b10
jmp 0x10093be1
push 0x10012b68
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x10093caa
cmp dword [ebp - 0x68], ebx
je 0x10093c04
push dword [ebp - 0x68]
call esi
push 0x2018
call fcn.1014b6df
pop ecx
mov dword [ebp - 0x88], eax
and dword [ebp - 4], 0
test eax, eax
je 0x10093c50
lea eax, [ebp - 0x90]
push 0x17a
push eax
call fcn.1014b6df
pop ecx
pop ecx
xor ecx, ecx
inc ecx
mov ebx, ecx
mov byte [ebp - 4], cl
mov ecx, dword [eax]
mov dword [ebp - 0x74], ebx
call fcn.100b7787
mov ecx, dword [ebp - 0x88]
push eax
call fcn.1014b6df
jmp 0x10093c52
xor eax, eax
mov dword [ebp - 0x70], eax
test eax, eax
je 0x10093c63
xor ecx, ecx
add eax, 4
inc ecx
lock xadd dword [eax], ecx
lea eax, [ebp - 0x70]
push eax
push 0x10012de8
push 0x29a
push 0x100126e4
mov dword [ebp - 4], 3
call fcn.1014b6df
jmp 0x10093c84
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 2
call fcn.10053649
or dword [ebp - 4], 0xffffffff
test bl, 1
je 0x10093caa
and ebx, 0xfffffffe
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x74], ebx
call fcn.10053649
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0x80]
add eax, 0x10
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x10093cc9
cmp dword [ebp - 0x7c], 0
jne 0x10093d7c
cmp dword [ebp - 0x68], 0
je 0x10093cd4
push dword [ebp - 0x68]
call esi
push 0x2018
call fcn.1014b6df
pop ecx
mov dword [ebp - 0x90], eax
mov dword [ebp - 4], 4
test eax, eax
je 0x10093d22
lea eax, [ebp - 0x84]
push 0x17a
push eax
call fcn.1014b6df
pop ecx
pop ecx
mov ecx, dword [eax]
or ebx, 2
mov byte [ebp - 4], 5
mov dword [ebp - 0x74], ebx
call fcn.100b7787
mov ecx, dword [ebp - 0x90]
push eax
call fcn.1014b6df
jmp 0x10093d24
xor eax, eax
mov dword [ebp - 0x70], eax
test eax, eax
je 0x10093d35
xor ecx, ecx
add eax, 4
inc ecx
lock xadd dword [eax], ecx
lea eax, [ebp - 0x70]
push eax
push 0x10012de8
push 0x2a2
push 0x100126e4
mov dword [ebp - 4], 7
call fcn.1014b6df
jmp 0x10093d56
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 6
call fcn.10053649
or dword [ebp - 4], 0xffffffff
test bl, 2
je 0x10093d7c
and ebx, 0xfffffffd
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x74], ebx
call fcn.10053649
push 0x52
lea eax, [ebp - 0x64]
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x28
push dword [ebp - 0x7c]
lea eax, [ebp - 0x64]
push 0x29
push eax
call fcn.1014b6df
push dword [ebp - 0x7c]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
and dword [ebp - 0x7c], 0
lea eax, [ebp - 0x6c]
push eax
push edi
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10093dd5
push dword [ebp - 0x68]
call esi
cmp dword [ebp - 0x6c], 0
je 0x10093ff0
jmp 0x10093feb
cmp dword [ebp - 0x68], 0
je 0x10093de4
push dword [ebp - 0x68]
call esi
and dword [ebp - 0x68], 0
push 4
pop edi
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x80]
push dword [eax + 0xc]
lea eax, [ebp - 0x8c]
push eax
push 0
push 0x10012e50
push dword [ebp - 0x6c]
mov dword [ebp - 0x78], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10093e20
cmp dword [ebp - 0x8c], edi
jne 0x10093e20
cmp dword [ebp - 0x78], edi
je 0x10093ecb
push dword [ebp - 0x6c]
call esi
push 0x2018
call fcn.1014b6df
mov edi, eax
pop ecx
mov dword [ebp - 0x94], edi
mov dword [ebp - 4], 8
test edi, edi
je 0x10093e71
lea eax, [ebp - 0x84]
push 0x17b
push eax
call fcn.1014b6df
pop ecx
pop ecx
mov ecx, dword [eax]
or ebx, 4
mov byte [ebp - 4], 9
mov dword [ebp - 0x74], ebx
call fcn.100b7787
push eax
mov ecx, edi
call fcn.1014b6df
jmp 0x10093e73
xor eax, eax
mov dword [ebp - 0x70], eax
test eax, eax
je 0x10093e84
xor ecx, ecx
add eax, 4
inc ecx
lock xadd dword [eax], ecx
lea eax, [ebp - 0x70]
push eax
push 0x10012de8
push 0x2c1
push 0x100126e4
mov dword [ebp - 4], 0xb
call fcn.1014b6df
jmp 0x10093ea5
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 0xa
call fcn.10053649
or dword [ebp - 4], 0xffffffff
test bl, 4
je 0x10093ecb
and ebx, 0xfffffffb
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x74], ebx
call fcn.10053649
lea eax, [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x80]
mov eax, dword [eax + 0xc]
add eax, 0xc4
push eax
lea eax, [ebp - 0x8c]
push eax
push 0
push 0x10012e88
push dword [ebp - 0x6c]
mov dword [ebp - 0x78], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10093f13
cmp dword [ebp - 0x8c], 3
jne 0x10093f13
cmp dword [ebp - 0x78], 0x80
je 0x10093fc2
push dword [ebp - 0x6c]
call esi
push 0x2018
call fcn.1014b6df
mov edi, eax
pop ecx
mov dword [ebp - 0x84], edi
mov dword [ebp - 4], 0xc
test edi, edi
je 0x10093f64
lea eax, [ebp - 0x94]
push 0x17b
push eax
call fcn.1014b6df
pop ecx
pop ecx
mov ecx, dword [eax]
or ebx, 8
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x74], ebx
call fcn.100b7787
push eax
mov ecx, edi
call fcn.1014b6df
jmp 0x10093f66
xor eax, eax
mov dword [ebp - 0x88], eax
test eax, eax
je 0x10093f7b
xor ecx, ecx
add eax, 4
inc ecx
lock xadd dword [eax], ecx
inc ecx
lea eax, [ebp - 0x88]
push eax
push 0x10012de8
push 0x2cb
push 0x100126e4
mov dword [ebp - 4], 0xf
call fcn.1014b6df
jmp 0x10093f9f
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 0xe
call fcn.10053649
or dword [ebp - 4], 0xffffffff
test bl, 8
je 0x10093fc2
lea ecx, [ebp - 0x94]
call fcn.10053649
mov ebx, dword [ebp - 0x80]
mov eax, dword [ebx + 0xc]
push 0x40
add eax, 4
push 0
push eax
call sub.MSVCR100.dll_memset
mov eax, dword [ebx + 0xc]
push 0x80
add eax, 0x44
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0x18
push dword [ebp - 0x6c]
call esi
call fcn.1015f177
ret 4