Function at 0x1000f3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x30
mov esi, ecx
mov eax, dword [0x1009a00c]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [edx + 0x14], 8
mov eax, edx
jb 0x1000f3ef
mov eax, dword [edx]
xor ecx, ecx
mov dword [ebp - 0x38], edx
mov dword [edx + 0x10], ecx
mov word [eax], cx
lea ebx, [ebp - 0x28]
mov dword [ebx + 0x10], ecx
mov dword [ebx + 0x14], 7
mov word [ebx], cx
sub esp, 0x10
mov al, byte [ebp - 0x2c]
mov byte [esp + 4], al
mov eax, 0x11
mov dword [esp + 0xc], eax
mov dword [esp], eax
mov dword [esp + 8], str.SOFTWAREClasses_
mov ecx, ebx
call fcn.1000d180
mov eax, dword [esi + 0x10]
cmp dword [esi + 0x14], 8
jb 0x1000f43a
mov esi, dword [esi]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x1000f5c9
lea edi, [ecx + eax]
mov dword [ebp - 0x18], edi
cmp edx, 8
jb 0x1000f45a
mov ebx, dword [ebp - 0x28]
lea ecx, [ebx + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [ebx + edi*2], 0
xor ebx, ebx
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x14], 8
jb 0x1000f480
mov eax, dword [ebp - 0x28]
jmp 0x1000f483
lea eax, [ebp - 0x28]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x2c]
push edx
push ebx
push ecx
push 0xffff
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1000f55f
mov eax, dword [ebp - 0x2c]
lea ecx, [eax - 3]
cmp ecx, 0xfffffffe
jb 0x1000f635
cmp eax, 1
setne byte [ebp - 0x31]
mov eax, dword [ebp - 0x30]
inc eax
mov edx, eax
shr edx, 1
mov edi, dword [ebp - 0x38]
mov ecx, dword [edi + 0x10]
mov esi, edx
mov dword [ebp - 0x3c], edx
sub edx, ecx
jbe 0x1000f5fc
mov esi, dword [edi + 0x14]
mov ebx, esi
sub ebx, ecx
cmp ebx, edx
jae 0x1000f57b
mov ecx, edi
push edx
call fcn.1000c210
add esp, 4
mov ebx, edi
xor ecx, ecx
mov al, byte [ebp - 0x31]
mov cl, al
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x1000f504
mov eax, dword [ebx]
add ecx, ecx
add ecx, 2
cmp dword [ebp - 0x14], 8
jb 0x1000f514
mov edx, dword [ebp - 0x28]
jmp 0x1000f517
lea edx, [ebp - 0x28]
xor esi, esi
lea edi, [ebp - 0x30]
push edi
push eax
push esi
push ecx
push esi
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1000f61b
mov eax, dword [ebp - 0x30]
inc eax
shr eax, 1
lea ecx, [eax - 1]
mov edx, ecx
sub edx, dword [ebx + 0x10]
ja 0x1000f63c
cmp dword [ebx + 0x14], 8
mov edx, ebx
jb 0x1000f553
mov edx, dword [ebx]
mov dword [ebx + 0x10], ecx
mov word [edx + eax*2 - 2], 0
mov bl, 1
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jae 0x1000f5b2
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100468e0
mov eax, ebx
add esp, 0x30
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, dword [ebp - 0x3c]
mov dword [edi + 0x10], edx
mov edx, edi
cmp esi, 8
mov ebx, edi
jb 0x1000f58c
mov edx, dword [ebx]
mov esi, edx
lea edx, [edx + ecx*2]
and eax, 0xfffffffe
add ecx, ecx
sub eax, ecx
push eax
push 0
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x3c]
mov word [esi + eax*2], 0
jmp 0x1000f4f3
mov eax, dword [ebp - 0x28]
inc ecx
test ecx, 0x7ffff800
jne 0x1000f5eb
push eax
call sym.mozglue.dll__aligned_free
add esp, 4
jmp 0x1000f567
sub esp, 0x10
mov cl, byte [ebp - 0x2c]
mov byte [esp + 4], cl
mov dword [esp + 0xc], eax
mov dword [esp + 8], esi
mov dword [esp], eax
lea ecx, [ebp - 0x28]
call fcn.1000d180
jmp 0x1000f470
mov ecx, dword [eax - 4]
add eax, 0xfffffffc
sub eax, ecx
cmp eax, 0x20
jae 0x1000f648
mov eax, ecx
jmp 0x1000f5be
cmp dword [edi + 0x14], 8
jb 0x1000f607
mov eax, dword [ebp - 0x38]
mov edi, dword [eax]
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [ebx + 0x10], ecx
mov word [edi + ecx*2], 0
jmp 0x1000f4f3
cmp dword [ebx + 0x14], 8
jb 0x1000f626
mov eax, dword [ebp - 0x38]
mov ebx, dword [eax]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x10], 0
mov word [ebx], 0
xor ebx, ebx
jmp 0x1000f55f
mov ecx, ebx
call fcn.1000c1c0
jmp 0x1000f55d
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3