Function at 0x100bdf1
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x208]
sub esp, 0x288
mov eax, dword [0x10171b0]
push esi
push edi
push 0x2c
mov dword [ebp + 0x204], eax
call fcn.0101216f
test eax, eax
pop ecx
je 0x100be23
mov ecx, eax
call fcn.01006be3
mov esi, eax
jmp 0x100be25
xor esi, esi
test esi, esi
je 0x100be43
mov eax, dword [esi]
lea ecx, [ebp - 0x44]
push ecx
push 0x100147c
push esi
call dword [eax]
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
test edi, edi
je 0x100be4a
xor eax, eax
jmp 0x100c090
mov eax, dword [ebp - 0x44]
push ebx
mov ebx, dword [ebp + 0x210]
test ebx, ebx
lea edi, [ebp + 0x1f4]
je 0x100c0a7
and dword [ebp - 0x34], 0
and dword [ebp - 0x3c], 0
mov ebx, 0x100140c
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
movsd dword es:[edi], dword [esi]
push 0
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp eax, 0x80070002
jne 0x100bebd
mov eax, dword [ebp - 0x44]
mov esi, ebx
lea edi, [ebp + 0x1f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
push 0
push 0x1001e34
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x3c], 1
test eax, eax
jne 0x100bfda
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push 5
pop esi
push esi
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x48]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x100bfd1
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x80]
push edx
mov word [ebp - 0x80], 0x30
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x100bfc8
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], esi
lea edx, [ebp - 0x80]
xor esi, esi
push edx
mov word [ebp - 0x80], 0x30
mov dword [ebp - 0x64], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x38]
push edx
push eax
call dword [ecx + 0x5c]
test eax, eax
jl 0x100bfbf
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea edx, [ebp - 0x4c]
push edx
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x100bf6d
mov eax, dword [ebp + 0x218]
mov ecx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
and eax, 0xffffffc0
add eax, 0x40
and ecx, 0xffffffbf
or eax, ecx
mov ecx, dword [ebp - 0x38]
or eax, 0x2000
push eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x70]
cmp dword [ebp - 0x3c], esi
je 0x100bf97
push 0x111
push 0x1001a8c
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x30], si
call fcn.01013427
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x214]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp + 0x210]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor edi, edi
push 0x1001540
push edi
push edi
lea ecx, [ebp + 0x1f8]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], 4
call fcn.01008619
push 0xffffffffffffffff
lea ecx, [ebp + 0x1f8]
call fcn.01008663
push 1
push 0x2001f
push 2
call fcn.0100b77c
cmp eax, edi
mov dword [ebp - 0x3c], eax
je 0x100c077
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x40]
push ecx
push edi
push 0x10
mov esi, 0x1001e28
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x100c06b
mov eax, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
and eax, 0xffffffdf
push 4
and ebx, 0x20
or ebx, eax
lea eax, [ebp - 0x40]
push eax
push 4
push edi
push esi
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
lea ecx, [ebp + 0x1f8]
call fcn.0100868c
lea ecx, [ebp + 0x1f8]
call fcn.0100863e
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x204]
pop edi
pop esi
call fcn.0101209b
add ebp, 0x208
leave
ret 0xc
mov esi, 0x100140c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x100bfe0