Function at 0x1000a5bd
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x248
mov eax, 0x10025af1
call fcn.1000992d
mov ecx, 0x10041d40
call fcn.1000a6bd
lea eax, [ebp - 0x240]
xor edi, edi
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], edi
push eax
push edi
push 2
push 0x1000a630
push 0x1000a640
push 0x80000001
mov dword [ebp - 0x230], edi
mov ebx, edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x240], 0x208
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x1001e5f0
call fcn.10009919
ret
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x23c]
call fcn.100101e7
lea ecx, [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.10005277
push dword [ebp - 0x23c]
call dword [sym.imp.msvcrt.dll__wcslwr]
lea ecx, [ebp - 0x228]
mov dword [esp], 0x1001e8a4
call fcn.100103b7
lea eax, [ebp - 0x228]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x254]
call fcn.10006532
lea ecx, [ebp - 0x228]
call fcn.10003610
mov eax, dword [0x10041c78]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x224], edi
mov byte [ebp - 4], 5
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x228]
push eax
lea ecx, [ebp - 0x254]
call fcn.10006305
test eax, eax
je 0x1001e819
mov esi, dword [ebp - 0x228]
cmp dword [esi - 0xc], 0
jl 0x1001e774
push 0x1001e8a8
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e6c1
sub eax, esi
sar eax, 1
js 0x1001e6c1
mov dword [ebp - 0x230], 0x1002e810
jmp 0x1001e66c
cmp dword [esi - 0xc], 0
jl 0x1001e774
push 0x1001e8c0
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e6f2
sub eax, esi
sar eax, 1
js 0x1001e6f2
mov dword [ebp - 0x22c], 0x1002e7b0
jmp 0x1001e66c
cmp dword [esi - 0xc], 0
jl 0x1001e774
push 0x1001e8dc
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e71f
sub eax, esi
sar eax, 1
js 0x1001e71f
mov dword [ebp - 0x234], 0x1002e750
jmp 0x1001e66c
cmp dword [esi - 0xc], 0
jl 0x1001e774
push 0x1001e8f8
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e747
sub eax, esi
sar eax, 1
js 0x1001e747
mov ebx, 0x1002e860
jmp 0x1001e66c
cmp dword [esi - 0xc], 0
jl 0x1001e774
push 0x1001e91c
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e774
sub eax, esi
sar eax, 1
js 0x1001e774
mov ecx, 0x10041d40
call fcn.1002e8bb
jmp 0x1001e66c
cmp dword [esi - 0xc], edi
jl 0x1001e66c
push 0x1001e938
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e7a4
sub eax, esi
sar eax, 1
js 0x1001e7a4
mov dword [0x10041d74], 1
jmp 0x1001e66c
cmp dword [esi - 0xc], edi
jl 0x1001e66c
push 0x1001e960
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e7d7
sub eax, esi
sar eax, 1
js 0x1001e7d7
xor eax, eax
inc eax
mov dword [0x10041d40], eax
mov dword [0x10041d58], eax
jmp 0x1001e66c
cmp dword [esi - 0xc], edi
jl 0x1001e66c
push 0x1001e980
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001e66c
sub eax, esi
sar eax, 1
js 0x1001e66c
mov dword [0x10041d40], 1
mov dword [0x10041d58], 2
jmp 0x1001e66c
mov esi, dword [ebp - 0x234]
push ebx
push esi
push dword [ebp - 0x22c]
push dword [ebp - 0x230]
call sym.IEShims.dll_AcRedirNotify
cmp dword [ebp - 0x230], 0
jne 0x1001e84c
cmp dword [ebp - 0x22c], 0
jne 0x1001e84c
test esi, esi
jne 0x1001e84c
test ebx, ebx
je 0x1001e84f
xor edi, edi
inc edi
lea ecx, [ebp - 0x228]
mov dword [0x10041d34], edi
call fcn.10003610
lea ecx, [ebp - 0x248]
call fcn.10003610
lea ecx, [ebp - 0x250]
call fcn.10003610
lea ecx, [ebp - 0x23c]
call fcn.10003610
jmp 0x1000a627