Function at 0x10186ea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f9f8c
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.10009930
movzx eax, al
test eax, eax
je 0x10186ee1
xor al, al
jmp 0x101873e3
mov dword [ebp - 0x26c], 0
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x268]
call fcn.10009ad0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x268]
call fcn.10009a20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10186f24
mov dword [ebp - 0x27c], 0x20119
jmp 0x10186f2e
mov dword [ebp - 0x27c], 0x20019
mov ecx, dword [ebp - 0x27c]
mov dword [ebp - 0x280], ecx
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x280]
push eax
push 0
lea ecx, [ebp - 0x268]
call fcn.100099e0
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 0
jne 0x10186f78
cmp dword [ebp - 0x26c], 0
jne 0x10186fa8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x288], eax
mov byte [ebp - 0x26e], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x26e]
jmp 0x101873e3
mov byte [ebp - 0x26d], 0
mov dword [ebp - 0x238], 1
mov dword [ebp - 0x21c], 0
push 0x208
push 0
lea edx, [ebp - 0x218]
push edx
call fcn.101a9880
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
lea ecx, [ebp - 0x238]
push ecx
push 0
push 0x102044f4
mov edx, dword [ebp - 0x26c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10187041
cmp dword [ebp - 0x21c], 0x104
jae 0x10187041
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x238]
push edx
push 0
push str.UninstallString
mov eax, dword [ebp - 0x26c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10187041
mov byte [ebp - 0x26d], 1
mov ecx, dword [ebp - 0x26c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx edx, byte [ebp - 0x26d]
test edx, edx
jne 0x1018707d
mov byte [ebp - 0x26f], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x26f]
jmp 0x101873e3
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x234]
call fcn.10008860
mov byte [ebp - 4], 1
push 0x10204534
lea ecx, [ebp - 0x234]
push ecx
call fcn.10010dd0
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.10009930
movzx edx, al
test edx, edx
je 0x101870ec
mov byte [ebp - 0x270], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x270]
jmp 0x101873e3
cmp dword [ebp + 0x18], 0
je 0x10187101
lea eax, [ebp - 0x234]
push eax
mov ecx, dword [ebp + 0x18]
call fcn.1000b800
push 0
lea ecx, [ebp - 0x234]
call fcn.1000d560
movzx ecx, word [eax]
cmp ecx, 0x22
jne 0x101871cd
push 0xc
lea ecx, [ebp - 0x244]
call fcn.10008df0
lea ecx, [ebp - 0x244]
call fcn.1000d2b0
mov byte [ebp - 4], 2
lea edx, [ebp - 0x244]
push edx
push 0x22
lea eax, [ebp - 0x234]
push eax
call fcn.1000f900
add esp, 0xc
lea ecx, [ebp - 0x244]
call fcn.1000d140
cmp eax, 2
jae 0x101871a0
mov byte [ebp - 0x271], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.1000d270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x271]
jmp 0x101873e3
push 1
lea ecx, [ebp - 0x244]
call fcn.1000d130
push eax
lea ecx, [ebp - 0x234]
call fcn.1000b800
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x244]
call fcn.1000d270
jmp 0x101872cb
lea ecx, [ebp - 0x234]
push ecx
call fcn.1000ec70
add esp, 4
movzx edx, al
test edx, edx
je 0x1018721b
mov byte [ebp - 0x272], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x272]
jmp 0x101873e3
push 0xc
lea ecx, [ebp - 0x250]
call fcn.10008df0
lea ecx, [ebp - 0x250]
call fcn.1000d2b0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x250]
push eax
push 0x20
lea ecx, [ebp - 0x234]
push ecx
call fcn.1000f900
add esp, 0xc
lea ecx, [ebp - 0x250]
call fcn.1000d160
movzx edx, al
test edx, edx
je 0x101872a3
mov byte [ebp - 0x273], 0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
call fcn.1000d270
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x273]
jmp 0x101873e3
push 0
lea ecx, [ebp - 0x250]
call fcn.1000d130
push eax
lea ecx, [ebp - 0x234]
call fcn.1000b800
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x250]
call fcn.1000d270
push 0x10204150
lea eax, [ebp - 0x234]
push eax
call fcn.10010dd0
add esp, 8
lea ecx, [ebp - 0x234]
call fcn.10009930
movzx ecx, al
test ecx, ecx
je 0x10187324
mov byte [ebp - 0x274], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x274]
jmp 0x101873e3
push str.MsiExec.exe
lea edx, [ebp - 0x234]
push edx
call fcn.10010aa0
add esp, 8
movzx eax, al
test eax, eax
je 0x1018736f
mov byte [ebp - 0x275], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x275]
jmp 0x101873e3
lea ecx, [ebp - 0x234]
push ecx
call fcn.1000ec70
add esp, 4
movzx edx, al
test edx, edx
je 0x101873b5
mov byte [ebp - 0x276], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x276]
jmp 0x101873e3
mov byte [ebp - 0x277], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x234]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10008820
mov al, byte [ebp - 0x277]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret