Function at 0x101a7010
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1054
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea edx, [ecx + 8]
mov ecx, dword [edx]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x1038], ebx
cmp dword [ecx - 0xc], 0
mov dword [ebp - 0x1054], edx
jne 0x101a7061
push 0x10202940
mov ecx, ebx
call fcn.10002490
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
push esi
push edi
push str.OpenWithProgids
push edx
lea eax, [ebp - 0x1034]
mov byte [ebp - 0x1019], 1
push eax
call fcn.10007f40
mov edi, dword [ebp - 0x1034]
lea ecx, [ebp - 0x1018]
add esp, 0xc
mov dword [ebp - 0x1018], 0
mov dword [ebp - 0x1014], 0
mov dword [ebp - 0x1010], 0xffffffff
push 0x20019
push edi
push SysReAllocString
call fcn.10058810
or ebx, 0xffffffff
test eax, eax
jne 0x101a74c0
push 0x800
push eax
lea eax, [ebp - 0x1004]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov ecx, 0x400
xor esi, esi
mov dword [ebp - 0x1024], ecx
mov dword [ebp - 0x1030], esi
mov eax, dword [ebp - 0x1010]
mov edx, dword [ebp - 0x1018]
mov dword [ebp - 0x1020], ecx
cmp eax, 0xffffffff
je 0x101a716c
cmp esi, eax
jb 0x101a716c
test edx, edx
je 0x101a716c
mov ebx, esi
sub ebx, eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a7125
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a7158
lea ecx, [ebp - 0x1024]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
mov ecx, dword [ebp - 0x1018]
push ebx
push ecx
call eax
jmp 0x101a7291
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
jmp 0x101a7284
cmp dword [ebp - 0x1014], 0
mov ebx, 0x103
mov dword [ebp - 0x1010], 0xffffffff
je 0x101a721d
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a719e
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a71d2
lea ecx, [ebp - 0x1024]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
push dword [ebp - 0x1030]
push dword [ebp - 0x1014]
call eax
jmp 0x101a71f2
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 0x1030]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x101a71ff
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0x103
jne 0x101a729e
mov esi, dword [ebp - 0x1030]
mov ecx, dword [ebp - 0x1020]
mov edx, dword [ebp - 0x1018]
test edx, edx
je 0x101a729e
mov dword [ebp - 0x1010], esi
mov dword [ebp - 0x1024], ecx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a7243
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a7274
lea ecx, [ebp - 0x1024]
push ecx
lea ecx, [ebp - 0x1004]
push ecx
mov ecx, dword [ebp - 0x1018]
push 0
push ecx
call eax
jmp 0x101a7291
lea eax, [ebp - 0x1024]
push eax
lea eax, [ebp - 0x1004]
push eax
push 0
mov ecx, dword [ebp - 0x1018]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x101a729e
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
jne 0x101a74b0
lea ecx, [ebp - 0x1048]
mov dword [ebp - 0x1048], ebx
mov dword [ebp - 0x1044], ebx
mov dword [ebp - 0x1040], 0xffffffff
call fcn.10008220
push str.SOFTWAREClasses
lea ecx, [ebp - 0x1008]
call fcn.10002490
cmp word [ebp - 0x1004], 0x5c
je 0x101a7386
mov esi, dword [ebp - 0x1008]
mov ebx, 0x10202944
push 1
sub ebx, esi
mov dword [ebp - 0x1020], 0x10202944
push 0x10202944
mov eax, dword [esi - 0xc]
sar ebx, 1
mov dword [ebp - 0x104c], eax
call fcn.101e6fd0
mov ecx, dword [esi - 8]
mov edx, 1
sub edx, dword [esi - 4]
add esp, 8
mov dword [ebp - 0x1050], eax
add eax, dword [ebp - 0x104c]
sub ecx, eax
or edx, ecx
jge 0x101a7345
push eax
lea ecx, [ebp - 0x1008]
call fcn.10003310
mov esi, dword [ebp - 0x1008]
mov ecx, dword [ebp - 0x104c]
cmp ebx, ecx
ja 0x101a7358
lea eax, [esi + ebx*2]
mov dword [ebp - 0x1020], eax
mov ebx, dword [ebp - 0x1050]
lea eax, [ebx + ebx]
push eax
push dword [ebp - 0x1020]
push eax
lea eax, [esi + ecx*2]
push eax
call fcn.10004510
mov eax, dword [ebp - 0x104c]
add esp, 0x10
add eax, ebx
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x101a7390
sub ecx, edx
lea eax, [ebp - 0x1004]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1008]
call fcn.10002970
mov esi, dword [ebp - 0x1008]
lea eax, [ebp - 0x1048]
push 0x20019
push esi
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov ecx, eax
call fcn.1000a260
push 0x20019
push esi
mov ebx, eax
lea ecx, [ebp - 0x1048]
push SysReAllocString
lea eax, [ebp - 0x1044]
push eax
call fcn.1000a260
test ebx, ebx
je 0x101a745c
test eax, eax
je 0x101a745c
or ebx, 0xffffffff
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x101a7412
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1030]
lea eax, [ebp - 0x1004]
push 0x800
push 0
inc esi
mov dword [ebp - 0x1024], 0x400
push eax
mov dword [ebp - 0x1030], esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov byte [ebp - 0x1019], 0
lea ecx, [ebp - 0x1048]
call fcn.10008220
mov ecx, dword [ebp - 0x1024]
jmp 0x101a70ec
or ebx, 0xffffffff
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x101a7476
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x1038]
lea eax, [ebp - 0x1004]
push eax
mov ecx, esi
call fcn.10002490
lea ecx, [ebp - 0x1048]
call fcn.10008220
lea ecx, [ebp - 0x1018]
call fcn.10008220
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], ebx
dec ebx
test ebx, ebx
jmp 0x101a7a0c
cmp byte [ebp - 0x1019], 0
je 0x101a79e1
or ebx, 0xffffffff
push str.OpenWithProgids
push dword [ebp - 0x1054]
lea eax, [ebp - 0x1050]
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_
push eax
call fcn.10021a80
add esp, 0xc
push eax
lea eax, [ebp - 0x1054]
push eax
call fcn.10007f40
add esp, 0xc
lea ecx, [ebp - 0x1034]
push eax
call fcn.10002790
mov edx, dword [ebp - 0x1054]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101a7518
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x1050]
mov eax, ebx
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101a7535
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x1034]
lea ecx, [ebp - 0x1018]
push 0x20019
push edi
push SysReAllocString
call fcn.10058810
test eax, eax
jne 0x101a7764
push 0x800
push eax
lea eax, [ebp - 0x804]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x1010]
add esp, 0xc
mov edx, 0x400
xor eax, eax
mov dword [ebp - 0x1028], edx
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1018]
mov dword [ebp - 0x1020], edx
cmp esi, 0xffffffff
je 0x101a75c6
cmp eax, esi
jb 0x101a75c6
test ecx, ecx
je 0x101a75c6
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1028]
sub eax, esi
push edx
lea edx, [ebp - 0x804]
push edx
push eax
push ecx
call fcn.101a4e60
mov ebx, eax
jmp 0x101a76e5
cmp dword [ebp - 0x1014], 0
mov ebx, 0x103
mov dword [ebp - 0x1010], 0xffffffff
je 0x101a7673
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a75f8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a762c
lea ecx, [ebp - 0x1028]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push dword [ebp - 0x1008]
push dword [ebp - 0x1014]
call eax
jmp 0x101a764c
lea eax, [ebp - 0x1028]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x101a7659
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0x103
jne 0x101a76df
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 0x1018]
mov edx, dword [ebp - 0x1020]
test ecx, ecx
je 0x101a76df
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x1028], edx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a7699
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
mov ecx, eax
lea eax, [ebp - 0x1028]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x1018]
push 0
push eax
test ecx, ecx
je 0x101a76cc
call ecx
jmp 0x101a76d2
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x101a76df
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x1010]
test ebx, ebx
jne 0x101a7764
push 0x20019
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1048], ebx
push eax
push SysReAllocString
lea ecx, [ebp - 0x1048]
mov dword [ebp - 0x1044], ebx
mov dword [ebp - 0x1040], 0xffffffff
call fcn.10058810
test eax, eax
lea eax, [ebp - 0x804]
je 0x101a799b
inc dword [ebp - 0x1008]
push 0x800
push ebx
push eax
mov dword [ebp - 0x1028], 0x400
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1048]
call fcn.10008220
mov edx, dword [ebp - 0x1028]
mov eax, dword [ebp - 0x1008]
jmp 0x101a7587
lea ecx, [ebp - 0x1018]
call fcn.10008220
push 0x20019
push edi
lea eax, [ebp - 0x1018]
push SysReAllocString
push eax
mov ecx, eax
call fcn.1000a260
test eax, eax
jne 0x101a79e1
push 0x800
push eax
lea eax, [ebp - 0x804]
push eax
call sub.msvcrt.dll_memset
mov esi, dword [ebp - 0x1010]
add esp, 0xc
mov edx, 0x400
xor eax, eax
mov dword [ebp - 0x102c], edx
mov dword [ebp - 0x1008], eax
mov ecx, dword [ebp - 0x1018]
mov dword [ebp - 0x1020], edx
cmp esi, 0xffffffff
je 0x101a77fd
cmp eax, esi
jb 0x101a77fd
test ecx, ecx
je 0x101a77fd
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x102c]
sub eax, esi
push edx
lea edx, [ebp - 0x804]
push edx
push eax
push ecx
call fcn.101a4e60
mov ebx, eax
jmp 0x101a791c
cmp dword [ebp - 0x1014], 0
mov ebx, 0x103
mov dword [ebp - 0x1010], 0xffffffff
je 0x101a78aa
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a782f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x101a7863
lea ecx, [ebp - 0x102c]
push ecx
lea ecx, [ebp - 0x804]
push ecx
push dword [ebp - 0x1008]
push dword [ebp - 0x1014]
call eax
jmp 0x101a7883
lea eax, [ebp - 0x102c]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
push dword [ebp - 0x1014]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x101a7890
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0x103
jne 0x101a7916
mov eax, dword [ebp - 0x1008]
mov ecx, dword [ebp - 0x1018]
mov edx, dword [ebp - 0x1020]
test ecx, ecx
je 0x101a7916
mov dword [ebp - 0x1010], eax
mov dword [ebp - 0x102c], edx
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x101a78d0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
mov ecx, eax
lea eax, [ebp - 0x102c]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x804]
push eax
mov eax, dword [ebp - 0x1018]
push 0
push eax
test ecx, ecx
je 0x101a7903
call ecx
jmp 0x101a7909
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
test esi, esi
je 0x101a7916
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [ebp - 0x1010]
test ebx, ebx
jne 0x101a79e1
push 0x20019
lea eax, [ebp - 0x804]
mov dword [ebp - 0x1048], ebx
push eax
push SysReAllocString
lea ecx, [ebp - 0x1048]
mov dword [ebp - 0x1044], ebx
mov dword [ebp - 0x1040], 0xffffffff
call fcn.10058810
test eax, eax
lea eax, [ebp - 0x804]
je 0x101a799b
inc dword [ebp - 0x1008]
push 0x800
push ebx
push eax
mov dword [ebp - 0x102c], 0x400
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x1048]
call fcn.10008220
mov edx, dword [ebp - 0x102c]
mov eax, dword [ebp - 0x1008]
jmp 0x101a77be
mov ecx, dword [ebp - 0x1038]
push eax
call fcn.10002490
lea ecx, [ebp - 0x1048]
call fcn.10008220
lea ecx, [ebp - 0x1018]
call fcn.10008220
lea ecx, [ebp - 0x1034]
call fcn.10007e10
mov eax, dword [ebp - 0x1038]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
mov esi, dword [ebp - 0x1038]
mov ecx, esi
push 0x10202940
call fcn.10002490
lea ecx, [ebp - 0x1018]
call fcn.10008220
or eax, 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x101a7a16
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4