Function at 0x100f4df0
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x614], 0x103
lea eax, [ebp - 0x614]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0x10212824
push str.SOFTWARE360SafeLiveup
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [esi + 4]
xor dword [ebp - 0x20c], 0xdeadbabe
xor dword [ebp - 0x208], 0xdeadbabe
xor dword [ebp - 0x204], 0xdeadbabe
xor dword [ebp - 0x200], 0xdeadbabe
xor dword [ebp - 0x1fc], 0xdeadbabe
xor dword [ebp - 0x1f8], 0xdeadbabe
mov dword [ebp - 0x5fc], eax
mov eax, dword [esi + 0xc]
mov dword [ebp - 0x5f8], eax
lea eax, [esi + 0x10]
push 0x1f4
push eax
lea eax, [ebp - 0x5f4]
mov dword [ebp - 0x600], 0x4f484951
push eax
call sub.msvcrt.dll_wcsncpy
push 0x1025c02a
push 0x3fc
call fcn.101c85a0
mov ebx, eax
add esp, 0x14
mov dword [ebp - 0x610], ebx
test ebx, ebx
je 0x100f4f1d
push 0x3fc
push 0
push ebx
call sub.msvcrt.dll_memset
push 0x3fc
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x600]
push 0x3f4
push eax
call fcn.10139900
add esp, 0x20
mov dword [ebp - 0x60c], eax
test eax, eax
jne 0x100f4f32
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f4f48
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 8
call fcn.10003680
add esp, 4
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push edi
test eax, eax
je 0x100f4f6a
call eax
jmp 0x100f4f70
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
test esi, esi
je 0x100f4f7d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ebx, 1
cmp edi, 0xffffffff
je 0x100f511c
mov dword [ebp - 0x604], 0
call fcn.10003180
mov ebx, dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f4fad
push esi
call ebx
push 0xa
call fcn.10003680
add esp, 4
push 0
test eax, eax
je 0x100f4fd1
lea ecx, [ebp - 0x604]
push ecx
push 8
push dword [ebp - 0x610]
push edi
call eax
jmp 0x100f4fe7
lea eax, [ebp - 0x604]
push eax
push 8
push dword [ebp - 0x610]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x608], eax
test esi, esi
je 0x100f4ff8
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f500a
push esi
call ebx
push 0xa
call fcn.10003680
add esp, 4
push 0
test eax, eax
je 0x100f502f
lea ecx, [ebp - 0x604]
push ecx
push 0x18
lea ecx, [ebp - 0x20c]
push ecx
push edi
call eax
jmp 0x100f5046
lea eax, [ebp - 0x604]
push eax
push 0x18
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test esi, esi
je 0x100f5053
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x610]
and ebx, dword [ebp - 0x608]
add eax, 8
mov dword [ebp - 0x608], eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f507e
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xa
call fcn.10003680
add esp, 4
push 0
test eax, eax
je 0x100f50aa
lea ecx, [ebp - 0x604]
push ecx
mov ecx, dword [ebp - 0x60c]
add ecx, 0xfffffff8
push ecx
push dword [ebp - 0x608]
push edi
call eax
jmp 0x100f50c8
mov ecx, dword [ebp - 0x60c]
lea eax, [ebp - 0x604]
push eax
add ecx, 0xfffffff8
push ecx
push dword [ebp - 0x608]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x60c], eax
test esi, esi
je 0x100f50d9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
and ebx, dword [ebp - 0x60c]
and ebx, 1
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x100f50f8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x14
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x100f510b
call eax
jmp 0x100f5111
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x100f511c
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp - 0x610]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
mov ecx, dword [ebp - 4]
add esp, 4
mov eax, ebx
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 8