Function at 0x101fc8d9
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1b8
mov eax, dword [0x1023904c]
xor eax, esp
mov dword [esp + 0x1b4], eax
cmp dword [0x1023a234], 0
mov edx, dword [esp + 0x1bc]
mov ecx, dword [esp + 0x1c4]
mov eax, dword [esp + 0x1cc]
push ebx
mov ebx, dword [esp + 0x1d8]
push ebp
mov ebp, dword [esp + 0x1d8]
push esi
mov esi, dword [esp + 0x1d4]
push edi
mov edi, dword [esp + 0x1e8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebp
je 0x101fcb21
mov eax, dword [esi]
push 1
push 0
lea ecx, [esp + 0xdc]
push ecx
push eax
push 0
push 0x78
lea ecx, [esp + 0x68]
mov dword [esp + 0x3c], eax
call fcn.1015692e
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x101fc9d4
test edi, edi
je 0x101fc98a
test ebx, ebx
je 0x101fc97f
mov eax, dword [edi]
mov dword [esp + 0x10], eax
jmp 0x101fc984
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
jmp 0x101fc98c
xor eax, eax
push eax
push ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x50]
push esi
push ecx
push dword [esp + 0x1e8]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
test esi, esi
jne 0x101fcb14
push dword [esp + 0x24]
mov esi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push dword [esp + 0x38]
push 0xffffffffffffffff
push dword [esp + 0x24]
push eax
push eax
call esi
test eax, eax
jne 0x101fc9de
mov esi, 0x8007000e
jmp 0x101fcb14
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x101fcaff
cmp ecx, 2
jbe 0x101fc9f8
cmp ecx, 7
jne 0x101fcaff
test edi, edi
je 0x101fcb0b
push 1
push 0
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x1c]
lea ecx, [esp + 0x38]
push 0
push 0x78
call fcn.1015692e
mov ebp, dword [esp + 0x2c]
test ebp, ebp
jne 0x101fca2d
lea ecx, [esp + 0x28]
call fcn.1000cead
jmp 0x101fc9d4
test ebx, ebx
je 0x101fca6f
push dword [esp + 0x10]
push ebx
push ebp
call sub.msvcr100.dll_memcpy
mov eax, dword [edi]
add esp, 0xc
shr eax, 1
push eax
push ebx
push 0xffffffffffffffff
push ebp
xor ebx, ebx
push ebx
push ebx
call esi
mov esi, eax
test esi, esi
je 0x101fca22
lea eax, [esi + esi]
lea ecx, [esp + 0x28]
mov dword [edi], eax
call fcn.1000cead
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x48]
jmp 0x101fcb0b
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
push eax
push ebp
xor ebx, ebx
push ebx
push ebx
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x1e8]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
test esi, esi
je 0x101fcaaa
lea ecx, [esp + 0x28]
call fcn.1000cead
jmp 0x101fcb14
push 1
push ebx
lea eax, [esp + 0x154]
push eax
mov eax, dword [esp + 0x1c]
add eax, eax
push eax
push ebx
push 0x78
lea ecx, [esp + 0x50]
call fcn.1015692e
cmp dword [esp + 0x3c], ebx
jne 0x101fcadc
lea ecx, [esp + 0x38]
call fcn.1000cead
jmp 0x101fca22
push dword [esp + 0x10]
push dword [esp + 0x40]
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.1000cead
jmp 0x101fca50
test edi, edi
je 0x101fcb0b
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [edi], eax
test ebp, ebp
je 0x101fcb12
mov dword [ebp], ecx
xor esi, esi
lea ecx, [esp + 0x50]
call fcn.1000cead
mov eax, esi
jmp 0x101fcb35
push edi
push ebx
push ebp
push eax
push esi
push ecx
push dword [esp + 0x1e8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10001e57
add esp, 0x1b8
ret 0x20