Function at 0x10009454
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0xc8
mov edi, ecx
mov eax, dword [ebp + 0x14]
mov ecx, dword [0x10067010]
xor ecx, ebp
mov dword [esp + 0xc0], ecx
mov dword [eax], 1
xor esi, esi
lea ebx, [esp + 0xb0]
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
sub esp, 0x1c
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x1005c370]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], str.SoftwareAppDataLowSoftwareMicrosoftEdgeIEToEdge
mov dword [esp], SysStringLen
mov ecx, ebx
call fcn.1000466c
lea ecx, [edi + 0x24]
mov eax, dword [ebx]
sub esp, 0x1c
mov dword [esp + 0x18], esi
movaps xmm0, xmmword [0x1005c370]
movups xmmword [esp + 8], xmm0
mov dword [esp], eax
mov dword [esp + 4], str.TaskLastRunTime
mov dword [esp + 0x28], ecx
call fcn.1000466c
push str.LocalIeToEdgeBhoMutex
call fcn.1000ed03
add esp, 4
mov dword [esp + 4], edi
mov dword [edi + 0x30], eax
xor ebx, ebx
dec ebx
test eax, eax
je 0x10009823
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1000956b
push 2
call fcn.1000f515
add esp, 4
test al, al
je 0x10009823
lea esi, [esp + 0x20]
mov ecx, esi
push 2
push 0x9f
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f55e
mov ecx, esi
call fcn.10002a70
push 0x2d
push str.Failed_to_acquire_last_run_mutex_at_startup:
push eax
call fcn.10006876
add esp, 0xc
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, edi
push eax
call fcn.10001dd0
mov ecx, esi
call fcn.1000f8ba
jmp 0x10009823
mov eax, dword [esp + 4]
mov eax, dword [eax + 0x34]
mov esi, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x14], eax
cmp esi, eax
je 0x10009797
xor ebx, ebx
mov edi, esi
mov dword [esp + 8], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1000959d
mov eax, dword [esi]
mov dword [esp + 0xbc], 0xffffffff
mov dword [esp + 0x20], 8
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0xc4]
push ecx
push ebx
push eax
mov eax, dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [esp + 0xbc]
cmp ecx, 0xb
mov edx, 0
mov ebx, 0xd
cmove ebx, edx
test eax, eax
cmovne ebx, eax
cmp ebx, 2
je 0x10009651
cmp byte [esi + 0x18], 0
jne 0x10009651
test eax, eax
jne 0x1000979d
cmp ecx, 0xb
jne 0x1000979d
call fcn.1000ecc5
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
sub eax, ecx
sbb edx, edi
mov ecx, dword [esi + 0x10]
mov ebx, 0xdc3cba00
add ecx, ebx
mov ebx, dword [esi + 0x14]
adc ebx, 0xffffffff
cmp eax, ecx
sbb edx, ebx
jae 0x100096c8
mov ecx, dword [esp + 4]
push esi
push edi
push dword [esp + 0x18]
call fcn.10009850
xor ebx, ebx
mov edi, dword [esp + 8]
jmp 0x10009787
cmp byte [esi + 0xb], 0
mov eax, esi
jns 0x1000965b
mov eax, dword [esi]
xor ecx, ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x20], ecx
push 8
lea edx, [esp + 0x24]
push edx
push 0xb
push ecx
push eax
mov eax, dword [esp + 0x20]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1000979b
push 0
call fcn.1000f515
add esp, 4
test al, al
mov ebx, 0
je 0x10009735
lea edi, [esp + 0x20]
mov ecx, edi
push 0
push 0xae
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f55e
mov ecx, edi
call fcn.10002a70
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x1000970c
mov ecx, dword [esi + 4]
mov edx, dword [esi]
jmp 0x10009711
push 0
call fcn.1000f515
add esp, 4
test al, al
mov ebx, 0
je 0x1000976e
lea edi, [esp + 0x20]
mov ecx, edi
push 0
push 0xb9
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f55e
mov ecx, edi
call fcn.10002a70
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x10009739
mov ecx, dword [esi + 4]
mov edx, dword [esi]
jmp 0x1000973e
and ecx, 0x7f
mov edx, esi
push ecx
push edx
push eax
call fcn.10006876
add esp, 0xc
push 0xf
push str._initial_run:_0
push eax
call fcn.10006876
add esp, 0xc
lea ecx, [esp + 0x20]
call fcn.1000f8ba
push ebx
push ebx
jmp 0x10009775
and ecx, 0x7f
mov edx, esi
push ecx
push edx
push eax
call fcn.10006876
add esp, 0xc
push 0xe
push str._initial_run:
push eax
call fcn.10006876
add esp, 0xc
mov ecx, eax
push 0xea60
call fcn.10001dd0
lea ecx, [esp + 0x20]
call fcn.1000f8ba
push 0
push 0xea60
mov edi, dword [esp + 0x10]
push edi
mov eax, dword [esp + 0x10]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetTimer]
add esi, 0x30
add edi, 0x30
cmp esi, dword [esp + 0x14]
jne 0x10009587
xor ebx, ebx
jmp 0x10009816
mov ebx, eax
push 2
call fcn.1000f515
add esp, 4
test al, al
je 0x10009813
lea edi, [esp + 0x20]
mov ecx, edi
push 2
push 0xc1
push str....._third_partyie_to_edge_bho_repeating_task_scheduler.cc
call fcn.1000f55e
mov ecx, edi
call fcn.10002a70
push 0x19
push str.Failed_to_read_write_the
push eax
call fcn.10006876
add esp, 0xc
movzx ecx, byte [esi + 0xb]
test cl, cl
jns 0x100097e8
mov ecx, dword [esi + 4]
mov esi, dword [esi]
jmp 0x100097eb
and ecx, 0x7f
push ecx
push esi
push eax
call fcn.10006876
add esp, 0xc
push str._registry_value:
push eax
call fcn.1000347a
add esp, 8
mov ecx, eax
push ebx
call fcn.10001bc0
mov ecx, edi
call fcn.1000f8ba
xor ebx, ebx
dec ebx
mov eax, dword [esp + 4]
push dword [eax + 0x30]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0xb0]
test eax, eax
je 0x10009835
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc0]
xor ecx, ebp
call fcn.1002c1aa
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10