Function at 0x100fb37
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x340
push 0x1010038
call fcn.010027d1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x350], eax
xor esi, esi
mov dword [ebp - 0x338], esi
push 4
pop edi
mov dword [ebp - 0x33c], edi
mov dword [ebp - 0x340], esi
mov dword [ebp - 0x348], esi
mov dword [ebp - 0x344], esi
mov dword [ebp - 0x34c], esi
lea eax, [ebp - 0x338]
push eax
push 3
pop ebx
push ebx
push esi
push 0x10025c0
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov dword [ebp - 0x334], eax
cmp eax, esi
je 0x100fbd6
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
cmp eax, esi
je 0x100fee2
test byte [eax + 0x1c], 1
je 0x100fee2
cmp byte [eax + 0x19], 2
jb 0x100fee2
push dword [ebp - 0x334]
push 0x100ffd8
push 0xa
jmp 0x100fed2
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x340]
push eax
push esi
push 0x1010014
push dword [ebp - 0x338]
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
call esi
mov dword [ebp - 0x334], eax
test eax, eax
jne 0x100feac
cmp dword [ebp - 0x340], edi
jne 0x100fe9e
cmp dword [ebp - 0x34c], eax
jne 0x100fc5e
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
cmp eax, esi
je 0x100fee2
test byte [eax + 0x1c], 1
je 0x100fee2
cmp byte [eax + 0x19], 4
jb 0x100fee2
push 0x100ffd8
push 0xc
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x100fedd
mov dword [ebp - 0x33c], 0x20a
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x340]
push eax
push 0
push 0x100fff8
push dword [ebp - 0x338]
call esi
mov dword [ebp - 0x334], eax
xor edi, edi
cmp eax, edi
jne 0x100fe64
cmp dword [ebp - 0x340], 1
jne 0x100fe64
mov eax, dword [ebp - 0x33c]
cmp eax, 2
jb 0x100fe64
shr eax, 1
xor ecx, ecx
cmp cx, word [ebp + eax*2 - 0x332]
jne 0x100fe64
mov dword [ebp - 0x33c], 0x105
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x124]
push eax
lea eax, [ebp - 0x340]
push eax
push edi
push 0x100ffe8
push dword [ebp - 0x338]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExA]
mov dword [ebp - 0x334], eax
cmp eax, edi
jne 0x100fe1e
cmp dword [ebp - 0x340], 1
jne 0x100fe1e
mov eax, dword [ebp - 0x33c]
cmp eax, 1
jb 0x100fe1e
cmp byte [ebp + eax - 0x125], 0
jne 0x100fe1e
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
cmp eax, esi
je 0x100fd6d
test byte [eax + 0x1c], 1
je 0x100fd6d
cmp byte [eax + 0x19], 4
jb 0x100fd6d
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x330]
push ecx
push 0x100ffd8
push 0xf
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0100fa99
lea eax, [ebp - 0x330]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x348], eax
cmp eax, edi
jne 0x100fdc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x334], eax
mov eax, dword [0x10150c0]
cmp eax, esi
je 0x100fee2
test byte [eax + 0x1c], 1
je 0x100fee2
cmp byte [eax + 0x19], 2
jb 0x100fee2
push dword [ebp - 0x334]
push 0x100ffd8
push 0x10
jmp 0x100fed2
lea ecx, [ebp - 0x124]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x344], eax
cmp eax, edi
jne 0x100fedd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x334], eax
mov eax, dword [0x10150c0]
cmp eax, esi
je 0x100fee2
test byte [eax + 0x1c], 1
je 0x100fee2
cmp byte [eax + 0x19], 2
jb 0x100fee2
push dword [ebp - 0x334]
push 0x100ffd8
push 0x11
jmp 0x100fed2
cmp dword [ebp - 0x334], edi
jne 0x100fe30
mov dword [ebp - 0x334], 0xd
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
cmp eax, esi
je 0x100fee2
test byte [eax + 0x1c], 1
je 0x100fee2
cmp byte [eax + 0x19], bl
jb 0x100fee2
push dword [ebp - 0x334]
push 0x100ffd8
push 0xe
jmp 0x100fed2
cmp dword [ebp - 0x334], edi
jne 0x100fe76
mov dword [ebp - 0x334], 0xd
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
cmp eax, esi
je 0x100fee2
test byte [eax + 0x1c], 1
je 0x100fee2
cmp byte [eax + 0x19], bl
jb 0x100fee2
push dword [ebp - 0x334]
push 0x100ffd8
push 0xd
jmp 0x100fed2
test eax, eax
jne 0x100feac
mov dword [ebp - 0x334], 0xd
mov eax, dword [0x10150c0]
mov esi, 0x10150c0
cmp eax, esi
je 0x100fee2
test byte [eax + 0x1c], 1
je 0x100fee2
cmp byte [eax + 0x19], bl
jb 0x100fee2
push dword [ebp - 0x334]
push 0x100ffd8
push 0xb
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.01002f89
mov eax, dword [0x10150c0]
cmp dword [ebp - 0x344], 0
je 0x100ff9d
and dword [ebp - 4], 0
cmp eax, esi
je 0x100ff15
test byte [eax + 0x1c], 1
je 0x100ff15
cmp byte [eax + 0x19], 4
jb 0x100ff15
push 0x100ffd8
push 0x12
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
push dword [ebp - 0x350]
call dword [ebp - 0x344]
mov eax, dword [0x10150c0]
cmp eax, esi
je 0x100ff96
test byte [eax + 0x1c], 1
je 0x100ff96
cmp byte [eax + 0x19], 4
jb 0x100ff96
push 0x100ffd8
push 0x13
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010015b6
jmp 0x100ff96
mov dword [ebp - 4], 0xfffffffe
cmp dword [ebp - 0x338], 0
je 0x100ffb2
push dword [ebp - 0x338]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x348], 0
je 0x100ffc7
push dword [ebp - 0x348]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 0x334]
call fcn.0100228c
ret 4