Function at 0x100d49e0
Capabilities:
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6b4
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x63c], ebx
mov dword [ebp - 0x638], edi
mov dword [ebp - 0x62c], 0
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d4a2e
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x2f
call fcn.10003680
add esp, 4
test eax, eax
je 0x100d4a49
lea ecx, [ebp - 0x62c]
push ecx
push edi
push ebx
call eax
jmp 0x100d4a58
lea eax, [ebp - 0x62c]
push eax
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edi, eax
test esi, esi
je 0x100d4a65
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x100d52a3
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
xor ebx, ebx
mov dword [ebp - 0x644], ebx
mov edi, dword [ebp - 0x62c]
mov dword [ebp - 0x648], 0x208
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d4ab0
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3f
call fcn.10003680
add esp, 4
push 0
push 0
push 0
push 0
test eax, eax
je 0x100d4ada
lea ecx, [ebp - 0x648]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push ebx
push edi
call eax
jmp 0x100d4af0
lea eax, [ebp - 0x648]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test esi, esi
je 0x100d4afd
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x100d5263
push 0x10202940
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x100d5241
push 0x410
lea eax, [ebp - 0x61c]
push edi
push eax
call sub.msvcrt.dll_memset
push 0x20019
push 0x410
lea eax, [ebp - 0x61c]
push eax
push 1
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x638]
push dword [ebp - 0x63c]
call fcn.10176900
add esp, 0x28
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
push edi
lea esi, [eax + 0x10]
mov eax, 0x10202940
mov dword [ebp - 0x624], esi
test eax, 0xffff0000
jne 0x100d4c75
mov ecx, 0x1025bea0
call fcn.101beff4
mov edi, eax
mov ebx, 1
test edi, edi
je 0x100d4c8b
mov ecx, 0x10202940
movzx eax, cx
shr eax, 4
inc eax
mov dword [ebp - 0x620], eax
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x100d4bd7
mov edx, 0x10202940
movzx ecx, dx
push ecx
push eax
push edi
call fcn.10003980
add esp, 0xc
test eax, eax
jne 0x100d4bf5
push ebx
mov ecx, 0x1025bea0
call fcn.101beff4
mov edi, eax
inc ebx
test edi, edi
je 0x100d4c8b
mov eax, dword [ebp - 0x620]
jmp 0x100d4bb0
test edi, edi
je 0x100d4c8b
push 6
push dword [ebp - 0x620]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, eax
test ecx, ecx
je 0x100d4c8b
mov edx, 0x10202940
movzx eax, dx
push eax
push ecx
push edi
call fcn.10003980
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x100d4c8b
movzx ecx, word [ebx]
mov eax, dword [esi - 8]
mov edi, ecx
mov edx, ecx
sub eax, edi
mov ecx, 1
sub ecx, dword [esi - 4]
or ecx, eax
jge 0x100d4c58
push edi
lea ecx, [ebp - 0x624]
call fcn.10003310
movzx edx, word [ebx]
mov esi, dword [ebp - 0x624]
movzx ecx, dx
lea eax, [ebx + 2]
push ecx
push eax
push edi
push esi
call fcn.101eb860
add esp, 0x10
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
jmp 0x100d4c8b
push 0x10202940
lea ecx, [ebp - 0x624]
call fcn.10003740
mov esi, dword [ebp - 0x624]
cmp dword [0x1025b434], 0
je 0x100d4ec0
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x634], 0
push eax
lea eax, [ebp - 0x654]
push eax
call fcn.10009120
mov ecx, dword [0x1025b434]
lea edi, [ebp - 0x634]
add esp, 8
mov edx, dword [ecx]
push edi
push 1
push dword [eax]
push ecx
call dword [edx + 0x40]
mov edx, dword [ebp - 0x654]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d4ced
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x634], 0
je 0x100d4ec0
mov dword [ebp - 0x6b4], 0
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x6ac], 0
mov dword [ebp - 0x6b0], eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a8], eax
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x6a0], 0
mov dword [ebp - 0x6a4], eax
lea edx, [ebp - 0x620]
mov eax, dword [ebp - 0x634]
mov dword [ebp - 0x69c], 0
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x694], 0
mov dword [ebp - 0x690], 0
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x688], 0xffffffff
mov dword [ebp - 0x684], 0
mov ecx, dword [eax]
push edx
push eax
mov dword [ebp - 0x620], 0
call dword [ecx + 0x10]
mov esi, dword [ebp - 0x620]
test esi, esi
je 0x100d4e33
mov eax, dword [esi]
lea ecx, [ebp - 0x630]
push ecx
push esi
mov dword [ebp - 0x630], 0
call dword [eax + 0xc]
cmp dword [ebp - 0x630], 0
jbe 0x100d4e23
mov eax, dword [esi]
lea ecx, [ebp - 0x628]
push ecx
push 0
push esi
mov dword [ebp - 0x628], 0
call dword [eax + 0x10]
mov eax, dword [ebp - 0x628]
test eax, eax
je 0x100d4e23
push eax
lea ecx, [ebp - 0x6b4]
call fcn.1003aba0
mov eax, dword [ebp - 0x628]
test eax, eax
je 0x100d4e23
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x620]
test eax, eax
je 0x100d4e33
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea eax, [ebp - 0x6a8]
push eax
lea ecx, [ebp - 0x624]
call fcn.10002790
lea ecx, [ebp - 0x6a0]
call fcn.1002a3c0
mov edx, dword [ebp - 0x6a4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d4e6e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6a8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d4e8c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6b0]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d4eaa
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0x6b4]
test ecx, ecx
je 0x100d4eba
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov esi, dword [ebp - 0x624]
cmp dword [esi - 0xc], 0
je 0x100d5223
call fcn.10003180
mov edi, dword [eax + 0x154]
test edi, edi
je 0x100d4ee0
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push esi
test eax, eax
je 0x100d4ef3
call eax
jmp 0x100d4ef9
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test edi, edi
je 0x100d4f06
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x100d5223
test bl, 0x10
jne 0x100d5223
mov ecx, dword [ebp - 0x64c]
push esi
call fcn.100d4740
test eax, eax
je 0x100d5223
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
push dword [ebp - 0x63c]
add eax, 0x10
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x650]
push eax
call fcn.100dbb30
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x638]
lea eax, [ebp - 0x620]
push dword [ebp - 0x650]
push str._s_s__s_
push eax
call fcn.10002cb0
add esp, 0x1c
mov dword [ebp - 0x680], 0
lea eax, [ebp - 0x620]
mov dword [ebp - 0x67c], 0
lea ecx, [ebp - 0x680]
mov dword [ebp - 0x678], 0
push eax
push 0
call fcn.100048e0
lea eax, [ebp - 0x624]
mov dword [ebp - 0x674], 0
push eax
push 0
lea ecx, [ebp - 0x674]
mov dword [ebp - 0x670], 0
mov dword [ebp - 0x66c], 0
call fcn.100048e0
push 0x10202940
lea ecx, [ebp - 0x658]
call fcn.10002490
push eax
lea eax, [ebp - 0x640]
push 0x27d2
push eax
call fcn.100053d0
mov edx, dword [ebp - 0x658]
add esp, 0xc
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d5021
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x624]
push eax
lea ecx, [ebp - 0x640]
call fcn.100d1ef0
push 0x2790
lea ecx, [ebp - 0x668]
call fcn.10002490
push 0x2807
lea ecx, [ebp - 0x664]
mov eax, dword [eax]
mov dword [ebp - 0x630], eax
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x660]
mov ebx, dword [eax]
mov eax, dword [ebp - 0x640]
mov dword [ebp - 0x628], eax
call fcn.10002490
push eax
lea eax, [ebp - 0x65c]
push 0x27bb
push eax
call fcn.100053d0
add esp, 0xc
mov edi, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x680]
push eax
lea eax, [ebp - 0x674]
push eax
push 0
push dword [ebp - 0x630]
push ebx
push dword [ebp - 0x628]
mov ebx, dword [ebp - 0x64c]
mov ecx, ebx
push edi
call fcn.100cd930
mov edx, dword [ebp - 0x65c]
mov edi, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x100d511f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x660]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d513d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x664]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d515b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x668]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d5179
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
lea eax, [ebp - 0x20c]
mov ecx, esp
push eax
call fcn.10002490
push ecx
mov ecx, esp
push dword [ebp - 0x638]
call fcn.10002490
push dword [ebp - 0x63c]
mov ecx, ebx
push edi
call fcn.100d3ee0
mov edx, dword [ebp - 0x640]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d51d1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x674]
call fcn.1002a3c0
lea ecx, [ebp - 0x680]
call fcn.1002a3c0
mov edx, dword [ebp - 0x650]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d5205
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x620]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100d5223
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100d523b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x644]
push 0x208
lea eax, [ebp - 0x20c]
inc ebx
push 0
push eax
mov dword [ebp - 0x644], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
jmp 0x100d4a8a
mov edi, dword [ebp - 0x62c]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100d527f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x44
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x100d5292
call eax
jmp 0x100d5298
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100d52a3
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8