Function at 0x1001f059
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100225a0
call fcn.1001fbd0
push ecx
mov eax, 0x3724
call fcn.1001fd80
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, 0x7d0
pop ecx
cmp eax, esi
jae 0x1001f207
push esi
lea eax, [ebp - 0x854]
push ebx
push eax
call sub.MSVCRT.dll_memset
push 0xfa0
lea eax, [ebp - 0x17f4]
push ebx
push eax
call sub.MSVCRT.dll_memset
push dword [ebp + 8]
lea eax, [ebp - 0x17f4]
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
add esp, 0x20
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp + 0xb], bl
je 0x1001f14d
mov dword [ebp + 0x10], ebx
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 1
push eax
push 0x1002a098
push 0x17
push ebx
push 0x10024088
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x1001f13b
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 0x84]
push edx
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
cmp eax, ebx
jl 0x1001f13b
mov eax, dword [ebp - 0x80]
push ebx
push ebx
lea ecx, [ebp - 0x854]
push esi
push ecx
lea ecx, [ebp - 0x17f4]
push 0xffffffffffffffff
push ecx
push ebx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jle 0x1001f132
mov byte [ebp + 0xb], 1
jmp 0x1001f13b
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x1001f157
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x1001f157
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x1001f15c
mov dword [ebp - 0x14], eax
cmp byte [ebp + 0xb], bl
jne 0x1001f19d
push ebx
push ebx
lea eax, [ebp - 0x854]
push esi
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
lea eax, [ebp - 0x17f4]
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x14]
call edi
test eax, eax
jne 0x1001f19d
push ebx
push ebx
lea eax, [ebp - 0x854]
push esi
push eax
lea eax, [ebp - 0x17f4]
push 0xffffffffffffffff
push eax
push ebx
push ebx
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
je 0x1001f207
lea eax, [ebp - 0x854]
push 0x25
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
test eax, eax
pop ecx
je 0x1001f313
lea eax, [ebp - 0x854]
push eax
call fcn.1001eff9
mov byte [ebp + 0xb], al
mov dword [esp], str.Shlwapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x1001f20e
push str.UrlUnescapeA
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x1001f1f8
push 0x2100000
push ebx
lea ecx, [ebp - 0x854]
push ebx
push ecx
call eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x1001f22e
xor eax, eax
jmp 0x1001f47a
lea eax, [ebp + 0xc]
push 0x30000000
push eax
lea eax, [ebp - 0x854]
push eax
lea eax, [ebp - 0x854]
push eax
mov dword [ebp + 0xc], esi
call dword [sym.imp.WININET.dll_InternetCanonicalizeUrlA]
cmp byte [ebp + 0xb], bl
je 0x1001f313
mov edi, 0xfa0
lea eax, [ebp - 0x17f4]
push edi
push ebx
push eax
mov dword [ebp + 8], esi
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x854]
push eax
call sub.MSVCRT.dll_strlen
mov dword [ebp + 0xc], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x17f4]
push eax
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x854]
push eax
call fcn.1001edb9
add esp, 0x20
test eax, eax
jne 0x1001f313
push esi
lea eax, [ebp - 0x1fc4]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1fc4]
push ebx
push ebx
push esi
push eax
lea eax, [ebp - 0x17f4]
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1001f313
push edi
lea eax, [ebp - 0x3734]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x3734]
push esi
push eax
lea eax, [ebp - 0x1fc4]
push 0xffffffffffffffff
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x1001f313
lea eax, [ebp - 0x17f4]
push eax
lea eax, [ebp - 0x3734]
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
pop ecx
test eax, eax
pop ecx
jne 0x1001f313
lea eax, [ebp - 0x1fc4]
push eax
lea eax, [ebp - 0x854]
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
lea eax, [ebp - 0x854]
push 0x3f
push eax
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
test eax, eax
pop ecx
jne 0x1001f207
cmp dword [0x1002c458], ebx
jne 0x1001f35b
push ebx
push 0x1002c458
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push str.SoftwareDownloadManager_
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1001f207
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], esi
push eax
lea eax, [ebp - 0x2794]
push eax
push ebx
push ebx
push str.Extensions
push dword [0x1002c458]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1001f207
mov byte [ebp + 0xb], 1
lea eax, [ebp - 0x854]
push 0x2e
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x1001f207
inc edi
push 0x1002c084
push edi
mov dword [ebp + 0x10], edi
call dword [sym.imp.MSVCRT.dll_strpbrk]
pop ecx
test eax, eax
pop ecx
jne 0x1001f207
push edi
lea esi, [ebp - 0x2794]
mov dword [ebp + 0xc], ebx
call sub.MSVCRT.dll_strlen
pop ecx
mov edi, eax
push edi
push dword [ebp + 0x10]
push esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x1001f3ec
mov al, byte [edi + esi]
cmp al, 0x20
je 0x1001f432
cmp al, bl
je 0x1001f432
push 0x1002bb80
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
pop ecx
cmp eax, ebx
pop ecx
je 0x1001f419
lea ecx, [edi + esi]
cmp ecx, eax
jbe 0x1001f419
sub eax, esi
push eax
push dword [ebp + 0x10]
push esi
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
je 0x1001f432
push 0x1002a568
push esi
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x1001f439
inc esi
je 0x1001f439
jmp 0x1001f3cf
mov dword [ebp + 0xc], 1
cmp byte [ebp + 0xb], bl
je 0x1001f477
cmp dword [ebp + 0xc], ebx
jne 0x1001f477
mov edi, dword [ebp + 0x10]
push edi
call sub.MSVCRT.dll_strlen
cmp eax, 4
pop ecx
jae 0x1001f477
mov esi, edi
mov al, byte [esi]
cmp al, bl
je 0x1001f46c
movsx eax, al
push eax
call dword [sym.imp.MSVCRT.dll_isdigit]
test eax, eax
pop ecx
je 0x1001f477
inc esi
jmp 0x1001f454
mov byte [edi - 1], bl
mov byte [ebp + 0xb], bl
jmp 0x1001f388
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc