Function at 0x100cd1d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
lea eax, [ebp - 0x54]
push esi
mov dword [ebp - 0xc], eax
xor eax, eax
xor edx, edx
push edi
mov edi, dword [ebp + 0x10]
inc edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], eax
mov dword [ebp + 0x10], edi
mov cl, byte [edi]
cmp cl, 0x20
je 0x100cc3c
cmp cl, 9
je 0x100cc3c
cmp cl, 0xa
je 0x100cc3c
cmp cl, 0xd
jne 0x100cc3f
inc edi
jmp 0x100cc26
push 4
pop esi
mov bl, byte [edi]
inc edi
cmp eax, 0xb
ja case.0x100cc4e.10
jmp dword [eax*4 + 0x100d038]
cmp bl, 0x31
jl 0x100cc66
cmp bl, 0x39
jg 0x100cc66
push 3
jmp 0x100ce6e
cmp bl, byte [0x100f030]
jne 0x100cc75
push 5
jmp 0x100ceac
movsx eax, bl
sub eax, 0x2b
je 0x100cc9c
dec eax
dec eax
je 0x100cc90
sub eax, 3
je 0x100cd13
dec edi
jmp 0x100cf49
push 2
pop eax
mov dword [ebp - 0x28], 0x8000
jmp 0x100cc42
and dword [ebp - 0x28], 0
push 2
pop eax
jmp 0x100cc42
cmp bl, 0x31
mov dword [ebp - 0x10], edx
jl 0x100ccb2
cmp bl, 0x39
jle 0x100cc5f
cmp bl, byte [0x100f030]
je 0x100cd6c
cmp bl, 0x2b
je 0x100cce8
cmp bl, 0x2d
je 0x100cce8
cmp bl, 0x30
je 0x100cd13
cmp bl, 0x43
jle 0x100cc8a
cmp bl, 0x45
jle 0x100cce1
cmp bl, 0x63
jle 0x100cc8a
cmp bl, 0x65
jg 0x100cc8a
push 6
jmp 0x100ceac
dec edi
push 0xb
jmp 0x100ceac
cmp bl, 0x31
jl 0x100ccfe
cmp bl, 0x39
jle 0x100cc5f
cmp bl, byte [0x100f030]
je 0x100cc6e
cmp bl, 0x30
jne 0x100ce7a
mov eax, edx
jmp 0x100cc42
mov dword [ebp - 0x10], edx
cmp dword [0x100f02c], edx
movzx eax, bl
jle 0x100cd36
push esi
push eax
call fcn.01008e43
pop ecx
xor edx, edx
pop ecx
inc edx
jmp 0x100cd42
mov ecx, dword [0x100f024]
movzx eax, byte [ecx + eax*2]
and eax, esi
test eax, eax
je 0x100cd64
cmp dword [ebp - 4], 0x19
jae 0x100cd5c
mov eax, dword [ebp - 0xc]
inc dword [ebp - 4]
sub bl, 0x30
inc dword [ebp - 0xc]
mov byte [eax], bl
jmp 0x100cd5f
inc dword [ebp - 8]
mov bl, byte [edi]
inc edi
jmp 0x100cd1d
cmp bl, byte [0x100f030]
jne 0x100cdd1
mov eax, esi
jmp 0x100cc42
cmp dword [ebp - 4], 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x24], edx
jne 0x100cd8c
jmp 0x100cd87
dec dword [ebp - 8]
mov bl, byte [edi]
inc edi
cmp bl, 0x30
je 0x100cd81
cmp dword [0x100f02c], edx
movzx eax, bl
jle 0x100cda5
push esi
push eax
call fcn.01008e43
pop ecx
xor edx, edx
pop ecx
inc edx
jmp 0x100cdb1
mov ecx, dword [0x100f024]
movzx eax, byte [ecx + eax*2]
and eax, esi
test eax, eax
je 0x100cdd1
cmp dword [ebp - 4], 0x19
jae 0x100cdcc
inc dword [ebp - 4]
mov eax, dword [ebp - 0xc]
sub bl, 0x30
inc dword [ebp - 0xc]
dec dword [ebp - 8]
mov byte [eax], bl
mov bl, byte [edi]
inc edi
jmp 0x100cd8c
cmp bl, 0x2b
je 0x100cce8
cmp bl, 0x2d
je 0x100cce8
jmp 0x100cccd
cmp dword [0x100f02c], edx
mov dword [ebp - 0x24], edx
movzx eax, bl
jle 0x100ce04
push esi
push eax
call fcn.01008e43
pop ecx
xor edx, edx
pop ecx
inc edx
jmp 0x100ce10
mov ecx, dword [0x100f024]
movzx eax, byte [ecx + eax*2]
and eax, esi
test eax, eax
je 0x100ce7a
mov eax, esi
jmp 0x100ce6f
cmp bl, 0x31
lea ecx, [edi - 2]
mov dword [ebp + 0x10], ecx
jl 0x100ce28
cmp bl, 0x39
jle 0x100ce6c
movsx eax, bl
sub eax, 0x2b
je 0x100ceaa
dec eax
dec eax
je 0x100ce9e
sub eax, 3
jne 0x100cf47
push 8
jmp 0x100ceac
mov dword [ebp - 0x20], edx
jmp 0x100ce49
mov bl, byte [edi]
inc edi
cmp bl, 0x30
je 0x100ce46
cmp bl, 0x31
jl 0x100cc8a
cmp bl, 0x39
jg 0x100cc8a
jmp 0x100ce6c
cmp bl, 0x31
jl 0x100ce75
cmp bl, 0x39
jg 0x100ce75
push 9
pop eax
dec edi
jmp 0x100cc42
cmp bl, 0x30
je 0x100ce3d
mov edi, dword [ebp + 0x10]
jmp 0x100cf49
cmp dword [ebp + 0x20], 0
je 0x100ceb2
movsx eax, bl
sub eax, 0x2b
lea ecx, [edi - 1]
mov dword [ebp + 0x10], ecx
je 0x100ceaa
dec eax
dec eax
jne 0x100cf47
or dword [ebp - 0x18], 0xffffffff
push 7
pop eax
jmp 0x100cc42
push 7
pop eax
jmp 0x100cc42
push reloc.USER32.dll_SetFocus
pop eax
dec edi
cmp eax, 0xa
jne 0x100cc42
jmp 0x100cf49
mov dword [ebp - 0x20], 1
xor esi, esi
cmp dword [0x100f02c], 1
movzx eax, bl
jle 0x100cee5
push 4
push eax
call fcn.01008e43
pop ecx
pop ecx
jmp 0x100cef2
mov ecx, dword [0x100f024]
movzx eax, byte [ecx + eax*2]
and eax, 4
test eax, eax
je 0x100cf12
movsx ecx, bl
lea eax, [esi + esi*4]
lea esi, [ecx + eax*2 - 0x30]
cmp esi, 0x1450
jg 0x100cf0d
mov bl, byte [edi]
inc edi
jmp 0x100cecd
mov esi, 0x1451
mov dword [ebp - 0x1c], esi
cmp dword [0x100f02c], 1
movzx eax, bl
jle 0x100cf2d
push 4
push eax
call fcn.01008e43
pop ecx
pop ecx
jmp 0x100cf3a
mov ecx, dword [0x100f024]
movzx eax, byte [ecx + eax*2]
and eax, 4
test eax, eax
je 0x100cc8a
mov bl, byte [edi]
inc edi
jmp 0x100cf15
mov edi, ecx
cmp dword [ebp - 0x10], 0
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
je 0x100cfee
push 0x18
pop eax
cmp dword [ebp - 4], eax
jbe 0x100cf75
cmp byte [ebp - 0x3d], 5
jl 0x100cf69
inc byte [ebp - 0x3d]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
dec eax
inc dword [ebp - 8]
jmp 0x100cf78
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 4], 0
jbe 0x100d015
jmp 0x100cf8a
dec dword [ebp - 4]
inc dword [ebp - 8]
dec eax
cmp byte [eax], 0
je 0x100cf84
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 4]
lea eax, [ebp - 0x54]
push eax
call fcn.0100cb23
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
add esp, 0xc
cmp dword [ebp - 0x18], ecx
jge 0x100cfaf
neg eax
add eax, dword [ebp - 8]
cmp dword [ebp - 0x20], ecx
jne 0x100cfba
add eax, dword [ebp + 0x18]
cmp dword [ebp - 0x24], ecx
jne 0x100cfc2
sub eax, dword [ebp + 0x1c]
cmp eax, 0x1450
jg 0x100cff7
cmp eax, 0xffffebb0
jl 0x100d00e
push dword [ebp + 0x14]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.0100d508
mov edx, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x36]
mov esi, dword [ebp - 0x32]
mov eax, dword [ebp - 0x2e]
add esp, 0xc
jmp 0x100d01d
mov dword [ebp - 0x14], 4
jmp 0x100d015
xor ebx, ebx
mov eax, 0x7fff
mov esi, 0x80000000
xor edx, edx
mov dword [ebp - 0x14], 2
jmp 0x100d01d
mov dword [ebp - 0x14], 1
xor edx, edx
xor eax, eax
xor esi, esi
xor ebx, ebx
mov ecx, dword [ebp + 8]
or eax, dword [ebp - 0x28]
pop edi
mov dword [ecx + 6], esi
pop esi
mov dword [ecx + 2], ebx
mov word [ecx + 0xa], ax
mov eax, dword [ebp - 0x14]
mov word [ecx], dx
pop ebx
leave
ret