Function at 0x1001b181
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x1000f75e
call fcn.1000f1bf
mov ecx, 0x10041cd0
call fcn.1001b499
lea eax, [ebp - 0x244]
xor edi, edi
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], edi
push eax
push edi
push 2
push 0x10009a44
push 0x10009a58
push 0x80000001
mov dword [ebp - 0x228], edi
mov ebx, edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x244], 0x208
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x1001b493
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x240]
call fcn.10012a30
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.10012eae
push dword [ebp - 0x240]
call dword [sym.imp.msvcrt.dll__wcslwr]
mov eax, dword [0x10041044]
lea ecx, [ebp - 0x224]
push 0x10009ad0
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], edi
call fcn.10012cec
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
call fcn.100139a3
lea ecx, [ebp - 0x224]
call fcn.1000daa0
mov eax, dword [0x10041044]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], edi
mov byte [ebp - 4], 5
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x258]
call fcn.10013c44
test eax, eax
je 0x1001b423
mov esi, dword [ebp - 0x238]
cmp dword [esi - 0xc], 0
jl 0x1001b37e
push 0x10009ad4
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b2cb
sub eax, esi
sar eax, 1
js 0x1001b2cb
mov dword [ebp - 0x228], 0x1001b6c0
jmp 0x1001b276
cmp dword [esi - 0xc], 0
jl 0x1001b37e
push 0x10009aec
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b2fc
sub eax, esi
sar eax, 1
js 0x1001b2fc
mov dword [ebp - 0x22c], 0x1001b680
jmp 0x1001b276
cmp dword [esi - 0xc], 0
jl 0x1001b37e
push 0x10009b08
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b329
sub eax, esi
sar eax, 1
js 0x1001b329
mov dword [ebp - 0x230], 0x1001b640
jmp 0x1001b276
cmp dword [esi - 0xc], 0
jl 0x1001b37e
push 0x10009b24
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b351
sub eax, esi
sar eax, 1
js 0x1001b351
mov ebx, 0x1001b700
jmp 0x1001b276
cmp dword [esi - 0xc], 0
jl 0x1001b37e
push 0x10009b48
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b37e
sub eax, esi
sar eax, 1
js 0x1001b37e
mov ecx, 0x10041cd0
call fcn.1001b740
jmp 0x1001b276
cmp dword [esi - 0xc], edi
jl 0x1001b276
push 0x10009b64
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b3ae
sub eax, esi
sar eax, 1
js 0x1001b3ae
mov dword [0x10041d04], 1
jmp 0x1001b276
cmp dword [esi - 0xc], edi
jl 0x1001b276
push 0x10009b8c
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b3e1
sub eax, esi
sar eax, 1
js 0x1001b3e1
xor eax, eax
inc eax
mov dword [0x10041cd0], eax
mov dword [0x10041ce8], eax
jmp 0x1001b276
cmp dword [esi - 0xc], edi
jl 0x1001b276
push 0x10009bac
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1001b276
sub eax, esi
sar eax, 1
js 0x1001b276
mov dword [0x10041cd0], 1
mov dword [0x10041ce8], 2
jmp 0x1001b276
mov esi, dword [ebp - 0x230]
push ebx
push esi
push dword [ebp - 0x22c]
push dword [ebp - 0x228]
call sym.IEShims.dll_AcRedirNotify
cmp dword [ebp - 0x228], 0
jne 0x1001b456
cmp dword [ebp - 0x22c], 0
jne 0x1001b456
test esi, esi
jne 0x1001b456
test ebx, ebx
je 0x1001b459
xor edi, edi
inc edi
lea ecx, [ebp - 0x238]
mov dword [0x100414c0], edi
call fcn.1000daa0
lea ecx, [ebp - 0x24c]
call fcn.1000daa0
lea ecx, [ebp - 0x254]
call fcn.1000daa0
lea ecx, [ebp - 0x240]
call fcn.1000daa0
jmp 0x1001b493
call fcn.1000f111
ret