Function at 0x100f0f60
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
neg ebx
mov dword [ebp - 0x464], ecx
push esi
sbb ebx, ebx
mov dword [ebp - 0x438], 0
and ebx, 0xffffff00
mov dword [ebp - 0x434], 0
add ebx, 0x200
mov dword [ebp - 0x430], 0xffffffff
or ebx, 0x20019
lea ecx, [ebp - 0x438]
push edi
mov dword [ebp - 0x454], ebx
call fcn.10008220
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
lea eax, [ebp - 0x438]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
mov ecx, eax
call fcn.1000a260
test eax, eax
jne 0x100f1621
push 0x208
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [ebp - 0x438]
add esp, 0xc
xor ecx, ecx
mov eax, dword [ebp - 0x430]
mov dword [ebp - 0x420], ecx
mov dword [ebp - 0x418], 0x104
cmp eax, 0xffffffff
je 0x100f1092
cmp ecx, eax
jb 0x100f1092
test ebx, ebx
je 0x100f1092
mov edi, ecx
sub edi, eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f103f
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3d
call fcn.10003680
add esp, 4
test eax, eax
je 0x100f1071
lea ecx, [ebp - 0x440]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push edi
push ebx
call eax
jmp 0x100f11cd
lea eax, [ebp - 0x440]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push edi
jmp 0x100f11c6
cmp dword [ebp - 0x434], 0
mov edi, 0x103
mov dword [ebp - 0x430], 0xffffffff
je 0x100f114b
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f10c4
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3d
call fcn.10003680
add esp, 4
test eax, eax
je 0x100f10fe
lea ecx, [ebp - 0x440]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push dword [ebp - 0x420]
mov ecx, dword [ebp - 0x434]
push ecx
call eax
jmp 0x100f112c
mov ecx, dword [ebp - 0x434]
lea eax, [ebp - 0x440]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test esi, esi
je 0x100f1139
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp edi, 0x103
jne 0x100f11da
mov ecx, dword [ebp - 0x420]
test ebx, ebx
je 0x100f11da
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x418], 0x104
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f1179
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x3d
call fcn.10003680
add esp, 4
test eax, eax
je 0x100f11a9
lea ecx, [ebp - 0x440]
push ecx
push 0
push 0
push 0
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0
push ebx
call eax
jmp 0x100f11cd
lea eax, [ebp - 0x440]
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test esi, esi
je 0x100f11da
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x100f1621
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x450], edi
mov dword [ebp - 0x44c], edi
mov dword [ebp - 0x448], 0xffffffff
call fcn.10008220
mov esi, 2
mov edi, esi
test ebx, ebx
je 0x100f122c
push dword [ebp - 0x42c]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x450]
push ebx
push eax
mov ecx, eax
call fcn.1000a260
mov esi, eax
mov eax, dword [ebp - 0x434]
test eax, eax
je 0x100f1258
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x20c]
push ecx
push eax
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x450]
call fcn.1000a260
mov edi, eax
test esi, esi
je 0x100f1264
test edi, edi
jne 0x100f160a
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
mov ebx, dword [ebp - 0x44c]
add esp, 0xc
or edi, 0xffffffff
mov dword [ebp - 0x41c], 0x208
mov dword [ebp - 0x424], 1
test ebx, ebx
je 0x100f1318
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f12b1
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
add esp, 4
test eax, eax
je 0x100f12e0
lea ecx, [ebp - 0x41c]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x424]
push ecx
push 0
push 0x10202940
push ebx
call eax
jmp 0x100f1303
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0x10202940
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test esi, esi
je 0x100f1310
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je 0x100f13a9
mov ebx, dword [ebp - 0x450]
test ebx, ebx
je 0x100f13a1
mov dword [ebp - 0x41c], 0x208
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f1342
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x41
call fcn.10003680
add esp, 4
test eax, eax
je 0x100f1371
lea ecx, [ebp - 0x41c]
push ecx
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x424]
push ecx
push 0
push 0x10202940
push ebx
call eax
jmp 0x100f1394
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x424]
push eax
push 0
push 0x10202940
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test esi, esi
je 0x100f13a1
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jne 0x100f1604
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100f1604
cmp dword [ebp + 8], 0
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0
mov dword [ebp - 0x468], 0
jne 0x100f13ec
mov edi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
mov ebx, dword [ebp - 0x454]
push ebx
push 1
push ecx
mov esi, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
push 0x10202940
mov dword [esi], eax
call fcn.10023e80
test al, al
jne 0x100f1427
push 0
push 0x10202940
mov ecx, esi
call fcn.10003740
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x428]
mov dword [ebp - 0x428], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10023e80
test al, al
jne 0x100f1482
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
jmp 0x100f1460
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100f1460
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x428]
call fcn.10003740
push ecx
mov esi, esp
lea eax, [ebp - 0x428]
push eax
push 0x10202944
push edi
lea ecx, [ebp - 0x460]
call fcn.10002490
push eax
lea eax, [ebp - 0x45c]
push eax
call fcn.10007f40
add esp, 0xc
push eax
push esi
call fcn.10007e90
add esp, 0xc
lea eax, [ebp - 0x470]
push reloc.OLEAUT32.dll_SysReAllocString
push eax
lea eax, [ebp - 0x458]
push eax
call fcn.100da240
mov edx, dword [ebp - 0x458]
add esp, 0x1c
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100f14f0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x45c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100f150e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x460]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100f152c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x428]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100f154a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push ebx
lea eax, [ebp - 0x470]
push eax
push ecx
mov esi, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0x414]
push eax
call fcn.10023e80
test al, al
jne 0x100f159f
lea ecx, [ebp - 0x414]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100f1581
sub ecx, edx
lea eax, [ebp - 0x414]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003740
push ecx
mov esi, esp
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov ecx, esi
mov dword [esi], eax
lea eax, [ebp - 0x20c]
push eax
call fcn.10023e80
test al, al
jne 0x100f15ee
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100f15d0
sub ecx, edx
lea eax, [ebp - 0x20c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.10003740
mov ecx, dword [ebp - 0x464]
call fcn.100eb020
lea ecx, [ebp - 0x470]
call fcn.1002a3c0
mov ebx, dword [ebp - 0x438]
lea ecx, [ebp - 0x450]
call fcn.10008220
mov ecx, dword [ebp - 0x420]
inc ecx
jmp 0x100f1002
lea ecx, [ebp - 0x438]
call fcn.10008220
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4