Function at 0x1013aac8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x240
mov edi, dword [ebp + 8]
mov eax, dword [0x101b9014]
xor eax, ebp
mov dword [esp + 0x238], eax
xor eax, eax
dec eax
lea ecx, [esp + 0x30]
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
push 0x1019d59a
call fcn.100349a0
xor ebx, ebx
lea esi, [esp + 0x20]
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
push esi
push 0x102cf5d8
call fcn.10013648
add esp, 8
mov eax, dword [esi]
cmp eax, dword [esi + 4]
je 0x1013aba8
lea ecx, [esp + 0x14]
push dword [eax]
push ecx
call fcn.100139b6
add esp, 8
cmp byte [esp + 0x3b], 0
jns 0x1013ab4a
push dword [esp + 0x30]
call fcn.10145bd4
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
movsd xmm0, qword [esp + 0x14]
movsd qword [esp + 0x30], xmm0
lea ebx, [esp + 0x30]
push ebx
call fcn.10012a8e
add esp, 4
test al, al
je 0x1013aba2
movzx eax, byte [esp + 0x3b]
test al, al
cmovs eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
cmovns ecx, ebx
test eax, eax
je 0x1013aba2
add eax, eax
test eax, eax
je 0x1013aba2
lea edx, [eax - 2]
cmp word [ecx + eax - 2], 0x5c
mov eax, edx
jne 0x1013ab88
cmp edx, 0xfffffffe
jne 0x1013aec1
xor ebx, ebx
mov eax, dword [esp + 0x20]
test eax, eax
je 0x1013abb9
mov dword [esp + 0x24], eax
push eax
call fcn.10145bd4
add esp, 4
cmp byte [esp + 0x3b], 0
jns 0x1013abcc
push dword [esp + 0x30]
call fcn.10145bd4
add esp, 4
mov al, 1
mov dword [esp + 4], eax
test bl, bl
jne 0x1013af7e
xor eax, eax
dec eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov ecx, esi
push 0x1019d59a
call fcn.100349a0
call fcn.100134e6
mov ecx, 0x102cf5e4
mov edx, 0x102cf5f0
test al, al
cmovne edx, ecx
mov ecx, esi
push edx
call fcn.1005cf00
xor ebx, ebx
mov dword [esp + 0x14], ebx
cmp byte [esp + 0x2b], 0
jns 0x1013ac22
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x14]
push eax
push 0x20019
push ebx
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1013acce
xor edi, edi
push 0x208
push edi
lea ebx, [esp + 0x38]
push ebx
call fcn.10149430
add esp, 0xc
lea esi, [esp + 0x10]
mov dword [esi], edi
push esi
push edi
push edi
push edi
push str.Path
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1013ac84
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov edi, dword [ebp + 8]
jmp 0x1013acce
lea eax, [esp + 0xc]
mov dword [eax], 1
push esi
push ebx
push eax
push 0
push str.Path
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete bl
mov edi, dword [ebp + 8]
jne 0x1013acce
lea esi, [esp + 0x30]
push esi
call fcn.10163aa4
add esp, 4
mov ecx, edi
push eax
push esi
call fcn.10056e90
cmp byte [esp + 0x2b], 0
jns 0x1013ace1
push dword [esp + 0x20]
call fcn.10145bd4
add esp, 4
test bl, bl
je 0x1013adf2
movzx ebx, byte [edi + 0xb]
test bl, bl
jns 0x1013acf4
mov ebx, dword [edi + 4]
lea esi, [esp + 0x20]
xor eax, eax
dec eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
lea eax, [ebx + 1]
sub esp, 0xc
mov cl, byte [esp + 0x20]
mov byte [esp], cl
lea ecx, [esp + 0x3c]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov ecx, esi
call fcn.10035b36
cmp byte [esi + 0xb], 0
jns 0x1013ad2d
mov esi, dword [esp + 0x20]
cmp byte [edi + 0xb], 0
mov eax, edi
jns 0x1013ad37
mov eax, dword [edi]
lea edi, [esi + ebx*2]
cmp eax, esi
jb 0x1013ad46
cmp edi, eax
ja 0x1013af9a
test ebx, ebx
je 0x1013ad57
add ebx, ebx
push ebx
push eax
push esi
call fcn.10148eb0
add esp, 0xc
cmp edi, 0x101a0662
ja 0x1013ad6d
lea eax, [edi + 2]
cmp eax, 0x101a0662
ja 0x1013af9d
mov dword [edi], 0x5c
movzx eax, byte [0x102cf5e3]
mov edx, 0x102cf5d8
test al, al
lea edi, [esp + 0x30]
jns 0x1013ad92
mov eax, dword [0x102cf5dc]
mov edx, dword [0x102cf5d8]
lea esi, [esp + 0x20]
mov ecx, esi
push eax
push edx
call fcn.1005725a
mov ecx, dword [eax + 8]
mov dword [esp + 0x38], ecx
movsd xmm0, qword [eax]
movsd qword [esp + 0x30], xmm0
xor ecx, ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], ecx
mov dword [eax], ecx
cmp byte [esi + 0xb], 0
jns 0x1013adcc
push dword [esp + 0x20]
call fcn.10145bd4
add esp, 4
push edi
call fcn.10012a8e
add esp, 4
mov ebx, eax
cmp byte [esp + 0x3b], 0
jns 0x1013adea
push dword [esp + 0x30]
call fcn.10145bd4
add esp, 4
test bl, bl
jne 0x1013af7e
xor ebx, ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], ebx
lea eax, [esp + 0x30]
push eax
push 1
call fcn.10071140
add esp, 8
test al, al
je 0x1013af67
xor eax, eax
dec eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
cmp byte [esp + 0x3b], 0
js 0x1013ae43
mov eax, dword [esp + 0x38]
mov dword [esp + 0x28], eax
movsd xmm0, qword [esp + 0x30]
movsd qword [esp + 0x20], xmm0
jmp 0x1013ae54
lea ecx, [esp + 0x20]
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.10056cf6
lea esi, [esp + 0x20]
movzx ecx, byte [esi + 0xb]
test cl, cl
mov eax, ecx
cmovs eax, dword [esi + 4]
mov edx, dword [esi]
cmovns edx, esi
lea edi, [edx + eax*2]
mov dword [esp + 4], edx
test eax, eax
je 0x1013af05
mov ebx, dword [esp + 4]
mov edx, edi
cmp word [ebx], 0x5c
je 0x1013ae8d
add ebx, 2
cmp ebx, edi
jne 0x1013ae7e
jmp 0x1013af05
mov dword [esp + 8], ecx
mov eax, 2
cmp eax, 0x12
je 0x1013aeb5
lea ecx, [ebx + eax]
cmp ecx, edi
je 0x1013aefd
movzx ecx, word [ecx]
lea esi, [eax + 2]
cmp cx, word [eax + str.Protect_]
mov eax, esi
je 0x1013ae96
jmp 0x1013aeb7
mov edx, ebx
lea esi, [esp + 0x20]
mov ecx, dword [esp + 8]
jmp 0x1013ae84
sar edx, 1
lea eax, [esp + 0x3c]
lea ecx, [esp + 0x14]
push eax
push edx
push 0
push ebx
call fcn.10057318
cmp byte [edi + 0xb], 0
jns 0x1013aee5
push dword [edi]
call fcn.10145bd4
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [edi + 8], eax
movsd xmm0, qword [esp + 0x14]
movsd qword [edi], xmm0
mov bl, 1
jmp 0x1013aba4
lea esi, [esp + 0x20]
mov ecx, dword [esp + 8]
cmp edx, edi
sete al
sub edx, dword [esp + 4]
cmp edx, 0xfffffffe
sete bl
or bl, al
jne 0x1013af54
sar edx, 1
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x14]
push eax
push edx
push 0
push esi
call fcn.10057318
mov esi, dword [ebp + 8]
cmp byte [esi + 0xb], 0
jns 0x1013af3f
push dword [esi]
call fcn.10145bd4
add esp, 4
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], eax
movsd xmm0, qword [esp + 0x14]
movsd qword [esi], xmm0
mov cl, byte [esp + 0x2b]
test cl, cl
jns 0x1013af64
push dword [esp + 0x20]
call fcn.10145bd4
add esp, 4
xor bl, 1
mov dword [esp + 4], ebx
cmp byte [esp + 0x3b], 0
jns 0x1013af7e
push dword [esp + 0x30]
call fcn.10145bd4
add esp, 4
mov ecx, dword [esp + 0x238]
xor ecx, ebp
call fcn.101465a3
mov eax, dword [esp + 4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3
int3