Function at 0x10116020
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x230], 1
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x234], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x22c], 0x206
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x230]
push eax
push str.LinksFolderName
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x101163b7
push 0x2871
lea ecx, [ebp - 0x214]
mov word [ebp - 6], ax
call fcn.10002490
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll__wcsicmp
mov edx, dword [ebp - 0x214]
add esp, 8
test eax, eax
setne byte [ebp - 0x20d]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101160e6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x20d], 0
je 0x101163b7
push 0x2c
lea ecx, [ebx + 0xc4]
mov dword [ebx + 0xc0], VariantCopy
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
call fcn.10003740
push 0xf
lea ecx, [ebx + 0xc8]
push str.LinksFolderName
call fcn.10003740
push 0x10202940
lea ecx, [ebp - 0x21c]
call fcn.10002490
push eax
lea eax, [ebp - 0x218]
push 0x2746
push eax
call fcn.100053d0
mov esi, dword [ebx + 0xcc]
lea edi, [ebx + 0xcc]
sub esi, 0x10
add esp, 0xc
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x101161a8
cmp dword [esi + 0xc], 0
jl 0x1011619d
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x1011619d
push edx
call fcn.10002a60
add esp, 4
mov dword [ebp - 0x214], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10116196
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x214]
add eax, 0x10
mov dword [edi], eax
jmp 0x101161a8
push dword [ecx - 0xc]
push ecx
mov ecx, edi
call fcn.10003740
mov edx, dword [ebp - 0x218]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101161c6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x21c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x101161e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0xc8]
push 0x20019
push 1
push ecx
sub eax, 0x10
mov dword [ebp - 0x228], 0
mov esi, esp
mov dword [ebp - 0x224], 0
push eax
mov dword [ebp - 0x220], 0
call fcn.10002a60
add eax, 0x10
mov dword [esi], eax
mov esi, esp
mov eax, dword [ebx + 0xc4]
sub eax, 0x10
push eax
call fcn.10002a60
add esp, 4
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x228]
push dword [ebx + 0xc0]
push eax
lea eax, [ebp - 0x238]
push eax
call fcn.100da240
mov ebx, dword [edi]
lea ecx, [ebp - 0x218]
add esp, 0x1c
push 0x10202940
call fcn.10002490
push eax
lea eax, [ebp - 0x21c]
push 0x9cc4
push eax
call fcn.100053d0
mov edi, dword [edi]
add esp, 0xc
mov esi, dword [eax]
push 1
push 0
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push ecx
mov ecx, esp
push 0x10202940
call fcn.10002490
push 0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x228]
push eax
push 0
push 4
call fcn.100dbb10
add esp, 4
push eax
push ebx
push 0x10202940
push esi
mov esi, dword [ebp - 0x234]
mov ecx, esi
push edi
call fcn.100cd930
mov edx, dword [ebp - 0x21c]
mov dword [esi + 0xbc], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10116311
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x218]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1011632f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x238]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1011634d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x228]
test esi, esi
je 0x101163b7
mov edi, dword [ebp - 0x224]
cmp esi, edi
je 0x10116388
mov edx, dword [esi]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1011637b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, edi
jne 0x10116361
mov esi, dword [ebp - 0x228]
mov ecx, dword [ebp - 0x220]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x101163ad
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x101163c8
push ecx
push esi
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
call fcn.101e6c40
int3