Function at 0x10014d90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x90
mov eax, 0x10083fac
call fcn.1006cda6
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov edi, 0x1008ad00
mov dword [ebp - 4], ebx
push edi
lea esi, [ebp - 0x2c]
mov dword [ebp - 0x74], ebx
call fcn.10001236
push 0x20019
push 0x10093a80
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.100110b4
test eax, eax
je 0x10014dfe
push ebx
push 1
call fcn.10001673
cmp dword [ebp - 0x6c], ebx
je 0x10014df6
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1001505e
push edi
lea esi, [ebp - 0x64]
call fcn.10001236
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
mov edi, str.CurrentVersion
push edi
mov byte [ebp - 4], 2
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10014e54
push ebx
push 1
lea esi, [ebp - 0x64]
call fcn.10001673
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.10001673
cmp dword [ebp - 0x6c], ebx
je 0x10014e4c
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
pop eax
jmp 0x1001505e
mov esi, dword [ebp - 0x74]
shr esi, 1
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
mov dword [ebp - 0x78], esi
neg ecx
or ecx, eax
push ecx
call fcn.100690b4
pop ecx
mov dword [ebp - 0x70], eax
push edi
lea ecx, [ebp - 0x6c]
push ecx
lea esi, [ebp - 0x78]
mov edi, eax
mov byte [ebp - 4], 3
call fcn.100136f0
push edi
test eax, eax
je 0x10014e96
call fcn.1006994c
pop ecx
jmp 0x10014e28
lea eax, [ebp - 0x2c]
push eax
call fcn.1000164e
cmp dword [ebp - 0x6c], ebx
je 0x10014eb0
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x6c], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x9c]
push str.SOFTWAREMozillaMozilla_Firefox_
push eax
mov dword [ebp - 0x68], ebx
call fcn.10010aed
push str.Main
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 4
call fcn.10010b38
add esp, 0x18
xor edi, edi
push ebx
inc edi
push edi
lea esi, [ebp - 0x9c]
mov byte [ebp - 4], 6
call fcn.10001673
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10014efe
lea eax, [ebp - 0x44]
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea eax, [ebp - 0x6c]
call fcn.100110b4
test eax, eax
je 0x10014f51
push ebx
push edi
lea esi, [ebp - 0x48]
call fcn.10001673
push dword [ebp - 0x70]
call fcn.1006994c
pop ecx
push ebx
push edi
lea esi, [ebp - 0x64]
call fcn.10001673
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.10001673
cmp dword [ebp - 0x6c], ebx
je 0x10014f4a
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
jmp 0x10014e4e
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x80]
push eax
push ebx
push str.Install_Directory
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10014fa9
push ebx
push edi
lea esi, [ebp - 0x48]
call fcn.10001673
push dword [ebp - 0x70]
call fcn.1006994c
pop ecx
push ebx
push edi
lea esi, [ebp - 0x64]
call fcn.10001673
push ebx
push edi
lea esi, [ebp - 0x2c]
call fcn.10001673
cmp dword [ebp - 0x6c], ebx
je 0x10014fa2
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 5
jmp 0x10014e4e
mov esi, dword [ebp - 0x74]
shr esi, 1
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
mov dword [ebp - 0x78], esi
neg ecx
or ecx, eax
push ecx
call fcn.100690b4
mov edi, eax
pop ecx
cmp edi, dword [ebp - 0x70]
je 0x10014fd8
push dword [ebp - 0x70]
call fcn.1006994c
pop ecx
push ebx
mov dword [ebp - 0x70], edi
call fcn.1006994c
lea eax, [ebp - 0x6c]
mov dword [esp], str.Install_Directory
push eax
lea esi, [ebp - 0x78]
call fcn.100136f0
test eax, eax
je 0x1001501d
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.10001673
push edi
call fcn.1006994c
pop ecx
push ebx
push 1
lea esi, [ebp - 0x64]
call fcn.10001673
push ebx
push 1
jmp 0x10014f8c
push edi
push dword [ebp - 0x7c]
call fcn.1000164e
push ebx
push 1
lea esi, [ebp - 0x48]
call fcn.10001673
push edi
call fcn.1006994c
pop ecx
push ebx
push 1
lea esi, [ebp - 0x64]
call fcn.10001673
push ebx
push 1
lea esi, [ebp - 0x2c]
call fcn.10001673
cmp dword [ebp - 0x6c], ebx
je 0x1001505c
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
call fcn.1006ce29
ret