Function at 0x1012de7
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x20
mov eax, 0x1017491
call fcn.01001350
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp + 0x10]
xor ebx, ebx
push 0x1013030
mov dword [ebp - 0x14], ebx
call fcn.0100b1c6
lea eax, [ebp - 0x14]
push eax
push ebx
lea eax, [ebp - 0x18]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1012e2f
mov eax, 0x80040153
call fcn.01001390
ret 0xc
cmp dword [ebp - 0x14], ebx
jbe 0x1012e22
cmp dword [ebp - 0x18], 1
je 0x1012e46
cmp dword [ebp - 0x18], 2
je 0x1012e46
cmp dword [ebp - 0x18], 7
jne 0x1012e4a
add dword [ebp - 0x14], 2
push dword [ebp - 0x14]
call fcn.010013e0
mov esi, dword [ebp - 0x14]
mov edi, eax
pop ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], esi
cmp edi, ebx
jne 0x1012e73
mov dword [ebp - 0x1c], ebx
push 0x1018e28
lea eax, [ebp - 0x1c]
push eax
call sub.msvcrt.dll__CxxThrowException
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call sym.WMIADAP.exe_private:_unsigned_long_int___thiscall_CRegistry::GetCurrentRawKeyValue_struct_HKEY_____unsigned_short_int_const___void___unsigned_long_int___unsigned_long_int__
cmp eax, ebx
je 0x1012e9a
push edi
call fcn.010013c0
pop ecx
jmp 0x1012e22
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jbe 0x1012e91
cmp eax, 2
jbe 0x1012ffb
cmp eax, 3
je 0x1012fb4
cmp eax, 4
je 0x1012f46
cmp eax, 7
jne 0x1012e91
mov eax, dword [ebp - 0x14]
lea ecx, [esi - 2]
cmp eax, ecx
jae 0x1012ed9
mov byte [edi + eax], 0
mov eax, dword [ebp - 0x14]
mov byte [edi + eax + 1], 0
jmp 0x1012ee4
lea eax, [edi + esi]
mov byte [eax - 2], 0
mov byte [eax - 1], 0
mov eax, edi
mov ebx, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1012eeb
sub eax, edx
sar eax, 1
mov esi, eax
mov dword [ebp + 0xc], esi
test esi, esi
je 0x1013016
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x24]
ja 0x1013016
mov ecx, dword [ebp + 0x10]
push ebx
call sym.WMIADAP.exe_public:_class_CHString_const____thiscall_CHString::operator_unsigned_short_int_const__
mov ecx, dword [ebp + 0x10]
push 0x101303c
call sym.WMIADAP.exe_public:_class_CHString_const____thiscall_CHString::operator_unsigned_short_int_const__
lea ebx, [ebx + esi*2 + 2]
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1012f31
sub eax, edx
sar eax, 1
mov esi, eax
add dword [ebp + 0xc], esi
jmp 0x1012efe
cmp dword [ebp - 0x14], 4
jne 0x1012e91
push 0x200
call fcn.010013e0
mov esi, eax
pop ecx
mov dword [ebp + 0xc], esi
cmp esi, ebx
je 0x1012fa4
push dword [edi]
mov byte [ebp - 4], 1
push 0x1013034
push 0x100
push esi
call fcn.01001451
mov ecx, dword [ebp + 0x10]
add esp, 0x10
push esi
call fcn.0100b1c6
push esi
call fcn.010013c0
pop ecx
jmp 0x1013016
mov dword [ebp - 0x28], ebx
push 0x1018e28
lea eax, [ebp - 0x28]
jmp 0x1012e6d
mov ecx, dword [ebp + 0x10]
call sym.WMIADAP.exe_public:_void___thiscall_CHString::Empty_void_
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
mov esi, eax
shr eax, 1
and esi, 1
add eax, esi
mov ebx, eax
push ebx
call sym.WMIADAP.exe_public:_unsigned_short_int____thiscall_CHString::GetBuffer_int_
push dword [ebp - 0x14]
push edi
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
test esi, esi
je 0x1012ff0
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
mov byte [ecx + eax], 0
mov ecx, dword [ebp + 0x10]
push ebx
call sym.WMIADAP.exe_public:_unsigned_short_int____thiscall_CHString::GetBufferSetLength_int_
jmp 0x1013016
mov eax, dword [ebp - 0x14]
cmp eax, esi
jae 0x1013008
mov byte [edi + eax], 0
jmp 0x101300d
mov byte [edi + esi - 1], 0
mov ecx, dword [ebp + 0x10]
push edi
call fcn.0100b1c6
or dword [ebp - 4], 0xffffffff
push edi
call fcn.010013c0
pop ecx
xor eax, eax
jmp 0x1012e27