Function at 0x1000e12a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x1002b1f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x230], ebp
xor ebx, ebx
inc ebx
push ebx
push dword [ebp - 0x230]
push str.int___cdecl_GetXmpPath_wchar_t__wchar_t__
call fcn.1000b484
mov esi, eax
add esp, 0xc
mov eax, 0x10020a40
cmp esi, edi
jne 0x1000e184
mov esi, eax
push edi
push edi
push edi
push edi
push eax
push 0x10020a24
push esi
lea ecx, [ebp - 0x260]
call fcn.1000a370
cmp esi, edi
jne 0x1000e1a0
push ebp
pop ebp
mov dword [ebp - 0x248], edi
cmp dword [ebp - 0x23c], edi
je 0x1000e505
cmp dword [ebp - 0x234], edi
je 0x1000e505
mov esi, 0x10020a0c
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x1000e1eb
push ebx
push str.Begin_search_for_xmpPath:_n
push edi
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
push dword [ebp - 0x23c]
mov dword [ebp - 0x238], edi
mov dword [ebp - 0x22c], edi
call dword [sym.imp.MSVCR90.dll_wcslen]
mov esi, dword [sym.imp.MSVCR90.dll_wcscpy]
pop ecx
test eax, eax
jne 0x1000e21d
push 0x100209cc
push dword [ebp - 0x23c]
call esi
pop ecx
pop ecx
lea eax, [ebp - 0x22c]
push eax
push str.SOFTWAREThunder_NetworkXmp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1000e2b4
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x244]
push eax
push edi
push str.InstDir
push dword [ebp - 0x22c]
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e29c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
pop ecx
test eax, eax
jbe 0x1000e29c
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x234]
call esi
pop ecx
pop ecx
mov dword [ebp - 0x238], ebx
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x238], edi
jne 0x1000e4c4
lea eax, [ebp - 0x22c]
push eax
push str.SOFTWAREThunder_NetworkThunderOem_thunder_backwnd
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, dword [sym.imp.MSVCR90.dll__swprintf]
test eax, eax
jne 0x1000e401
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x240]
push eax
push 0
push str.Path
push dword [ebp - 0x22c]
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x244], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e3e8
mov esi, dword [sym.imp.MSVCR90.dll_wcslen]
lea eax, [ebp - 0x20c]
push eax
call esi
pop ecx
test eax, eax
jbe 0x1000e3e8
lea eax, [ebp - 0x20c]
push eax
call esi
pop ecx
lea esi, [ebp + eax*2 - 0x20e]
jmp 0x1000e34c
cmp word [esi], 0x5c
je 0x1000e356
dec esi
dec esi
lea eax, [ebp - 0x20c]
cmp esi, eax
ja 0x1000e344
sub esi, 4
jmp 0x1000e363
cmp word [esi], 0x5c
je 0x1000e36d
dec esi
dec esi
lea eax, [ebp - 0x20c]
cmp esi, eax
ja 0x1000e35b
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push 0
push str.Program_
lea ecx, [ebp - 0x228]
call dword [sym.imp.MSVCP90.dll_public:_unsigned_int___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::find_wchar_t_const___unsigned_int_const]
mov ecx, dword [sym.imp.MSVCP90.dll_unsigned_int_const_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::npos]
cmp eax, dword [ecx]
je 0x1000e3b4
sub esi, 4
jmp 0x1000e3aa
cmp word [esi], 0x5c
je 0x1000e3b4
dec esi
dec esi
lea eax, [ebp - 0x20c]
cmp esi, eax
ja 0x1000e3a2
push dword [ebp - 0x23c]
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x20c]
push eax
push 0x1001d31c
push dword [ebp - 0x234]
call edi
add esp, 0x10
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x238], ebx
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x238], 0
jne 0x1000e4c2
lea eax, [ebp - 0x22c]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1000e4ac
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x240]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 0x22c]
mov dword [ebp - 0x240], ebx
mov dword [ebp - 0x244], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000e497
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR90.dll_wcslen]
pop ecx
test eax, eax
jbe 0x1000e497
push dword [ebp - 0x23c]
lea eax, [ebp - 0x20c]
push eax
push str._sThunder_Network_s
push dword [ebp - 0x234]
call edi
add esp, 0x10
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x238], ebx
push dword [ebp - 0x22c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x238], 0
jne 0x1000e4c2
push dword [ebp - 0x23c]
push str.C:Program_FilesThunder_Network_s
push dword [ebp - 0x234]
call edi
add esp, 0xc
xor edi, edi
mov esi, 0x10020a0c
push esi
call fcn.10005425
pop ecx
test eax, eax
jne 0x1000e4f2
push ebx
push dword [ebp - 0x234]
push edi
push esi
call fcn.10009855
pop ecx
pop ecx
mov ecx, eax
call fcn.100016a4
mov ecx, eax
call fcn.1000a33f
lea ecx, [ebp - 0x260]
call fcn.1000be71
mov eax, dword [ebp - 0x248]
jmp 0x1000e512
lea ecx, [ebp - 0x260]
call fcn.1000be71
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10018dd2
leave
ret