Function at 0x1001c150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004be63
mov eax, dword fs:[0]
push eax
sub esp, 0x84c
mov eax, dword [0x10068224]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x858], ebx
mov dword [ebp - 4], 0
mov dword [ebp - 0x848], 0
call fcn.10003e90
mov ecx, eax
test ecx, ecx
je 0x1001c732
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x848], 1
call fcn.10003e90
mov ecx, eax
test ecx, ecx
je 0x1001c73c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x838], eax
push 0x1004d364
lea ecx, [ebp - 0x838]
mov dword [ebp - 4], 1
call fcn.10003c30
test al, al
jne 0x1001c20c
push 0
push 0x1004d364
lea ecx, [ebp - 0x838]
call fcn.10004920
push dword [ebp + 0xc]
mov dword [ebp - 4], 2
call fcn.1001c890
mov edx, dword [0x10069d28]
add esp, 4
mov esi, eax
mov eax, edx
mov ecx, dword [edx + 4]
cmp byte [ecx + 0xd], 0
jne 0x1001c24e
cmp dword [ecx + 0x10], esi
jge 0x1001c23b
mov ecx, dword [ecx + 8]
jmp 0x1001c23f
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x1001c231
cmp eax, edx
je 0x1001c24e
cmp esi, dword [eax + 0x10]
jge 0x1001c250
mov eax, edx
cmp edx, eax
je 0x1001c280
mov edx, dword [eax + 0x14]
test edx, edx
jne 0x1001c25f
xor ecx, ecx
jmp 0x1001c273
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001c264
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x838]
call fcn.10004920
call fcn.10003e90
mov ecx, eax
test ecx, ecx
je 0x1001c746
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x83c], eax
push 0x10056e8c
lea ecx, [ebp - 0x83c]
mov byte [ebp - 4], 3
call fcn.10003c30
test al, al
jne 0x1001c2c7
push 3
push 0x10056e8c
lea ecx, [ebp - 0x83c]
call fcn.10004920
dec esi
mov byte [ebp - 4], 4
cmp esi, 0xb
ja case.default.0x1001c2dc
movzx eax, byte [esi + 0x1001c774]
jmp dword [eax*4 + 0x1001c764]
push 8
push str.VendorID
lea ecx, [ebp - 0x83c]
call fcn.10004920
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
mov esi, dword [ebp - 0x838]
lea ecx, [ebp - 0x854]
push 0x20219
push esi
push 0x80000002
mov byte [ebp - 4], 5
call fcn.1001ca40
mov edi, dword [ebp - 0x83c]
test eax, eax
jne 0x1001c3a2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10026b00
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x854]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
call fcn.1001caf0
test eax, eax
jne 0x1001c3a2
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001c384
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10004920
mov eax, dword [ebp - 0x854]
test eax, eax
je 0x1001c6dc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001c6dc
lea ecx, [ebp - 0x844]
call fcn.100089f0
mov dword [ebp - 0x854], 0
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
push 0x20219
push dword [ebp - 0x838]
lea ecx, [ebp - 0x854]
mov byte [ebp - 4], 7
push 0x80000002
call fcn.1001ca40
mov edi, dword [ebp - 0x83c]
test eax, eax
jne 0x1001c609
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10026b00
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x854]
push eax
lea eax, [ebp - 0x420]
push eax
push edi
call fcn.1001caf0
test eax, eax
jne 0x1001c47e
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001c460
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10004920
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.10026b00
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x854]
push eax
lea eax, [ebp - 0x628]
push eax
push str.SUBPID
call fcn.1001caf0
test eax, eax
jne 0x1001c4f2
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001c4d0
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x844]
call fcn.10004920
mov esi, dword [ebp - 0x844]
cmp dword [esi - 0xc], 0
jne 0x1001c510
push ebx
lea ecx, [ebp - 0x844]
call fcn.10003810
mov esi, dword [ebp - 0x844]
mov eax, dword [ebx]
mov byte [ebp - 4], 8
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x1001c528
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x1001c53e
call fcn.10003e90
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x1001c750
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x848], 3
mov dword [ebp - 0x840], eax
mov eax, dword [ebx]
push 2
push 0x10056eb8
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.1001b140
add esp, 0x14
mov eax, dword [ebp - 0x840]
mov byte [ebp - 4], 9
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x1001c58e
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x1001c5a4
call fcn.10003e90
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
test ecx, ecx
je 0x1001c75a
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [esi - 0xc]
add eax, 0x10
mov dword [ebp - 0x848], 7
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x840]
push esi
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x834]
push eax
call fcn.1001b140
add esp, 0x14
lea eax, [ebp - 0x834]
mov ecx, ebx
push eax
call fcn.10003810
lea ecx, [ebp - 0x834]
call fcn.100037d0
lea ecx, [ebp - 0x840]
mov dword [ebp - 0x848], 1
call fcn.100037d0
jmp 0x1001c60f
mov esi, dword [ebp - 0x844]
mov eax, dword [ebp - 0x854]
test eax, eax
je 0x1001c620
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 4], 4
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001c6d6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001c6d6
push 0x208
lea eax, [ebp - 0x830]
mov dword [ebp - 0x840], 1
push 0
push eax
mov dword [ebp - 0x834], 0x104
call fcn.10026b00
mov edi, dword [ebp - 0x83c]
lea eax, [ebp - 0x834]
mov esi, dword [ebp - 0x838]
add esp, 0xc
push eax
lea eax, [ebp - 0x830]
push eax
lea eax, [ebp - 0x840]
push eax
push edi
push esi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1001c6dc
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001c6b0
sub ecx, edx
lea eax, [ebp - 0x830]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.10004920
jmp 0x1001c6dc
mov edi, dword [ebp - 0x83c]
mov esi, dword [ebp - 0x838]
mov byte [ebp - 4], 2
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1001c6f8
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001c714
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10019d88
mov esp, ebp
pop ebp
ret
int 0xe8
pop edx
salc
invalid
push 0x80004005
call fcn.10003c10
push 0x80004005
call fcn.10003c10
push 0x80004005
call fcn.10003c10
push 0x80004005
call fcn.10003c10
push 0x80004005
call fcn.10003c10
jecxz 0x1001c728
add dword [eax], edx
inc ebp
mov byte [ecx], 16
mov esp, 0xf51001c3
ret 4097