Function at 0x10014df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100bc574
mov eax, dword fs:[0]
push eax
sub esp, 0x2bc
mov eax, dword [0x100f4c44]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor al, al
mov dword [ebp - 0x274], eax
cmp dword [esi + 0x10], 0
je 0x10015451
xorps xmm0, xmm0
lea ecx, [ebp - 0x268]
movups xmmword [ebp - 0x268], xmm0
movq qword [ebp - 0x258], xmm0
call fcn.100536a0
push esi
lea ecx, [ebp - 0x268]
mov dword [ebp - 4], 0
call fcn.10054630
test al, al
je 0x10015440
push 3
push 0x100c838c
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0xf
mov byte [ebp - 0x2b0], 0
call fcn.1000e070
push 0
lea eax, [ebp - 0x2b0]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x268]
call fcn.10053e80
mov edx, dword [ebp - 0x29c]
mov dword [ebp - 0x220], eax
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x10014ef3
mov ecx, dword [ebp - 0x2b0]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10014ee9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001546c
push edx
push ecx
call fcn.10046d13
add esp, 8
mov dword [ebp - 0x2a0], 0
mov dword [ebp - 0x29c], 0xf
mov byte [ebp - 0x2b0], 0
call fcn.1000b0b0
mov ecx, eax
test ecx, ecx
je 0x10015471
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x270], eax
push 0x100c7540
lea ecx, [ebp - 0x270]
mov byte [ebp - 4], 2
call fcn.1000adf0
test al, al
jne 0x10014f57
push 0
push 0x100c7540
lea ecx, [ebp - 0x270]
call fcn.10015780
push 7
push str.sub_key
lea ecx, [ebp - 0x2c8]
mov byte [ebp - 4], 3
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0xf
mov byte [ebp - 0x2c8], 0
call fcn.1000e070
push 0xfde9
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x2c8]
push eax
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x268]
call fcn.10054480
mov edx, dword [eax]
xor eax, eax
mov ecx, edx
mov byte [ebp - 4], 5
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10014fe0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x250]
call fcn.1000e170
mov edx, dword [ebp - 0x290]
or esi, 0xffffffff
mov byte [ebp - 4], 7
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10015020
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2b4]
mov byte [ebp - 4], 8
cmp edx, 0x10
jb 0x1001505e
mov ecx, dword [ebp - 0x2c8]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015054
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001547b
push edx
push ecx
call fcn.10046d13
add esp, 8
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x2b4], 0xf
mov byte [ebp - 0x2c8], 0
mov edx, dword [ebp - 0x270]
mov eax, esi
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001509a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 8
push str.is_wow64
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x278], 0xf
mov byte [ebp - 0x28c], 0
call fcn.1000e070
push 0
lea eax, [ebp - 0x28c]
mov byte [ebp - 4], 0xa
push eax
lea ecx, [ebp - 0x268]
call fcn.10053e80
mov edx, dword [ebp - 0x278]
mov dword [ebp - 0x298], eax
mov byte [ebp - 4], 9
cmp edx, 0x10
jb 0x10015123
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015119
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015480
push edx
push ecx
call fcn.10046d13
add esp, 8
call fcn.1000b0b0
mov ecx, eax
test ecx, ecx
je 0x10015485
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x100c7540
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0xb
call fcn.1000adf0
test al, al
jne 0x1001516c
push 0
push 0x100c7540
lea ecx, [ebp - 0x21c]
call fcn.10015780
push 5
push str.value
lea ecx, [ebp - 0x28c]
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x27c], 0
mov dword [ebp - 0x278], 0xf
mov byte [ebp - 0x28c], 0
call fcn.1000e070
push 0xfde9
lea eax, [ebp - 0x21c]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x28c]
push eax
lea eax, [ebp - 0x294]
push eax
lea ecx, [ebp - 0x268]
call fcn.10054480
mov edx, dword [eax]
xor eax, eax
mov ecx, edx
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100151f0
sub ecx, edi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x238]
call fcn.1000e170
mov edx, dword [ebp - 0x294]
mov eax, esi
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001522d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x278]
mov byte [ebp - 4], 0xc
cmp edx, 0x10
jb 0x1001526b
mov ecx, dword [ebp - 0x28c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10015261
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001548f
push edx
push ecx
call fcn.10046d13
add esp, 8
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x27c], 0
add edx, 0xfffffff0
mov dword [ebp - 0x278], 0xf
mov byte [ebp - 0x28c], 0
mov byte [ebp - 4], 9
lock xadd dword [edx + 0xc], esi
dec esi
test esi, esi
jg 0x100152a5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x298], 0
lea edx, [ebp - 0x26c]
push edx
mov eax, 0x101
mov dword [ebp - 0x26c], 0
mov ecx, 1
cmovne ecx, eax
cmp dword [ebp - 0x23c], 8
push ecx
lea eax, [ebp - 0x250]
cmovae eax, dword [ebp - 0x250]
push 0
push eax
mov eax, dword [ebp - 0x220]
or eax, 0x80000000
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10015386
push 0x208
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.1008cc60
add esp, 0xc
mov dword [ebp - 0x220], 0x208
cmp dword [ebp - 0x224], 8
lea ecx, [ebp - 0x220]
lea eax, [ebp - 0x238]
cmovae eax, dword [ebp - 0x238]
push ecx
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
push 0
push eax
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001537a
mov eax, dword [ebp - 0x274]
mov ecx, 1
cmp dword [ebp - 0x21c], ecx
movzx eax, al
cmove eax, ecx
mov dword [ebp - 0x274], eax
push dword [ebp - 0x26c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x224]
cmp edx, 8
jb 0x100153c6
mov ecx, dword [ebp - 0x238]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100153bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015494
push edx
push ecx
call fcn.10046d13
add esp, 8
mov edx, dword [ebp - 0x23c]
xor eax, eax
mov dword [ebp - 0x228], 0
mov dword [ebp - 0x224], 7
mov word [ebp - 0x238], ax
cmp edx, 8
jb 0x10015423
mov ecx, dword [ebp - 0x250]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10015419
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10015499
push edx
push ecx
call fcn.10046d13
add esp, 8
xor eax, eax
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x23c], 7
mov word [ebp - 0x250], ax
lea ecx, [ebp - 0x268]
call fcn.10050db0
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100470a0
mov esp, ebp
pop ebp
ret
call fcn.100902aa
push 0x80004005
call fcn.1000add0
call fcn.100902aa
call fcn.100902aa
push 0x80004005
call fcn.1000add0
call fcn.100902aa
call fcn.100902aa
call fcn.100902aa
int3