Function at 0x101e3d1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x70
mov eax, 0x1020abf
call fcn.01017678
mov eax, ecx
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x74], ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x78], ecx
cmp esi, ebx
jne 0x101e3fe
mov eax, 0x80070057
jmp 0x101e5da
push 0x5c
pop ecx
cmp cx, word [esi]
jne 0x101e408
inc esi
inc esi
push dword [eax + 0x10]
lea ecx, [ebp - 0x6c]
call fcn.01006783
push 0x100255c
lea ecx, [ebp - 0x68]
mov dword [ebp - 4], ebx
call fcn.01006783
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.0101e35a
mov ecx, dword [ebp - 0x68]
mov byte [ebp - 4], bl
cmp ecx, ebx
je 0x101e442
call fcn.01004d03
push esi
lea ecx, [ebp - 0x68]
call fcn.01006783
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.0101e35a
mov ecx, dword [ebp - 0x68]
cmp ecx, ebx
je 0x101e467
call fcn.01004d03
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0x64], ebx
cmp edi, ebx
je 0x101e475
mov eax, dword [edi]
jmp 0x101e477
xor eax, eax
lea ecx, [ebp - 0x64]
push ecx
push 0x20019
push ebx
push eax
push 0x80000002
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebx
je 0x101e4b9
jle 0x101e49d
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.0101dd55
cmp edi, ebx
je 0x101e4b2
mov ecx, edi
call fcn.01004d03
mov eax, esi
jmp 0x101e5da
xor eax, eax
push 0x4e
mov word [ebp - 0x60], ax
lea eax, [ebp - 0x5e]
push ebx
push eax
mov dword [ebp - 0x70], ebx
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x1002554
push dword [ebp - 0x64]
mov dword [ebp - 0x7c], 0x50
call esi
cmp eax, ebx
jne 0x101e491
cmp dword [ebp - 0x70], 1
je 0x101e51c
lea ecx, [ebp - 0x64]
call fcn.0101dd55
cmp edi, ebx
je 0x101e512
mov ecx, edi
call fcn.01004d03
mov eax, 0x80020005
jmp 0x101e5da
push dword [ebp - 0x74]
xor eax, eax
mov word [ebp - 0x12], ax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
mov edi, eax
cmp edi, ebx
jge 0x101e550
lea ecx, [ebp - 0x64]
call fcn.0101dd55
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e549
call fcn.01004d03
mov eax, edi
jmp 0x101e5da
cmp dword [ebp - 0x78], ebx
je 0x101e5c4
push 4
pop edi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push 0x1002548
push dword [ebp - 0x64]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x74], edi
call esi
cmp eax, ebx
je 0x101e59f
jle 0x101e585
and eax, 0xffff
or eax, 0x80070000
lea ecx, [ebp - 0x64]
mov esi, eax
call fcn.0101dd55
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e4b2
jmp 0x101e4ad
cmp dword [ebp - 0x70], edi
je 0x101e5bc
lea ecx, [ebp - 0x64]
call fcn.0101dd55
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e512
jmp 0x101e50d
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
lea ecx, [ebp - 0x64]
call fcn.0101dd55
mov ecx, dword [ebp - 0x6c]
cmp ecx, ebx
je 0x101e5d8
call fcn.01004d03
xor eax, eax
call fcn.010176cc
ret 0xc