Function at 0x1001a8a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x100dbc1c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push str.360se6_Frame
push esi
call fcn.1008394a
add esp, 8
test eax, eax
je 0x1001aa1f
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.100837f0
add esp, 0xc
mov dword [ebp - 0x21c], 1
lea eax, [ebp - 0x218]
mov dword [ebp - 0x218], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x21c]
push eax
push str.Version
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall360se6
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1001ab25
lea esi, [eax + 2]
xor edx, edx
nop word [eax + eax]
mov ax, word [ebp + edx - 0x20c]
cmp ax, word [edx + 0x100b3e58]
jne 0x1001a987
add edx, 2
sub esi, 1
jne 0x1001a940
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.10012750
add esp, 8
mov ecx, ebx
push eax
call fcn.100192d0
mov edi, dword [ebp - 0x210]
test edi, edi
je 0x1001ab10
or esi, 0xffffffff
jmp 0x1001aaf2
mov edx, 3
xor ecx, ecx
nop
mov ax, word [ebp + ecx - 0x20c]
cmp ax, word [ecx + 0x100b3e60]
jne 0x1001a9ab
add ecx, 2
sub edx, 1
jne 0x1001a990
jmp 0x1001a959
mov edx, 2
xor ecx, ecx
nop dword [eax]
nop word [eax + eax]
mov ax, word [ebp + ecx - 0x20c]
cmp ax, word [ecx + 0x100b3e68]
jne 0x1001a9f6
add ecx, 2
sub edx, 1
jne 0x1001a9c0
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.10016240
add esp, 8
mov ecx, ebx
push eax
call fcn.100192d0
jmp 0x1001a971
mov edx, 2
xor ecx, ecx
nop dword [eax]
mov ax, word [ebp + ecx - 0x20c]
cmp ax, word [ecx + 0x100b3e70]
jne 0x1001ab25
add ecx, 2
sub edx, 1
jne 0x1001aa00
jmp 0x1001a9d9
push str.IEFrame
push esi
call fcn.1008394a
add esp, 8
test eax, eax
je 0x1001aa40
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.10017d80
jmp 0x1001aaa5
push str.SE_SogouExplorerFrame
push esi
call fcn.1008394a
add esp, 8
test eax, eax
je 0x1001aa61
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.1001d250
jmp 0x1001aaa5
push str.QQBrowser_WidgetWin_1
push esi
call fcn.1008394a
add esp, 8
test eax, eax
je 0x1001aa82
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.1001c350
jmp 0x1001aaa5
push str.Chrome_WidgetWin_1
push esi
call fcn.1008394a
add esp, 8
test eax, eax
je 0x1001ab25
lea eax, [ebp - 0x214]
push edi
push eax
call fcn.10016f00
mov ecx, dword [eax]
add esp, 8
mov edx, dword [eax + 4]
or esi, 0xffffffff
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [ebx], ecx
mov edi, dword [ebx + 4]
mov dword [ebx + 4], edx
test edi, edi
je 0x1001aae8
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001aae8
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
mov eax, esi
lock xadd dword [edi + 8], eax
jne 0x1001aae8
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
mov edi, dword [ebp - 0x210]
test edi, edi
je 0x1001ab10
mov eax, esi
lock xadd dword [edi + 4], eax
jne 0x1001ab10
mov eax, dword [edi]
mov ecx, edi
call dword [eax]
lock xadd dword [edi + 8], esi
dec esi
jne 0x1001ab10
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
pop edi
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100763b4
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [ebp - 4]
xor al, al
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100763b4
mov esp, ebp
pop ebp
ret 0xc