Function at 0x180c656a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x1820f00c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x110]
push esi
push 0
push eax
mov edi, edx
mov ebx, ecx
call fcn.181620e0
add esp, 0xc
mov dword [ebp - 0x2a4], esi
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push 0x10002
push str.BuildLabEx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueA]
and dword [ebp - 0x130], 0
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x12c], 0xf
lea edx, [ecx + 1]
mov byte [ebp - 0x140], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x180c65ec
sub ecx, edx
lea eax, [ebp - 0x110]
push ecx
push eax
lea ecx, [ebp - 0x140]
call fcn.18019812
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x180c6627
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
jmp 0x180c6629
xor esi, esi
push 0x110
lea eax, [ebp - 0x29c]
mov dword [ebp - 0x2a0], 0x114
push 0
push eax
call fcn.181620e0
add esp, 0xc
test esi, esi
je 0x180c690f
lea eax, [ebp - 0x2a0]
push eax
call esi
test eax, eax
js 0x180c690f
push 0
push dword [ebp - 0x298]
lea ecx, [ebp - 0x170]
call fcn.180a5e88
push 0
push dword [ebp - 0x29c]
lea ecx, [ebp - 0x188]
mov esi, eax
call fcn.180a5e88
add esp, 0x10
mov ecx, eax
push 1
push 0x181e0b40
call fcn.1801ea02
xor ecx, ecx
mov byte [ebp - 0x2a4], cl
push dword [ebp - 0x2a4]
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
lea ecx, [ebp - 0x128]
push eax
call fcn.1801240b
push esi
lea eax, [ebp - 0x128]
push eax
push dword [ebp - 0x2a4]
lea ecx, [ebp - 0x158]
call fcn.18075807
lea eax, [ebp - 0x158]
cmp ebx, eax
je 0x180c6706
mov ecx, ebx
call fcn.1801238a
mov byte [ebp - 0x2a4], 0
lea eax, [ebp - 0x158]
push dword [ebp - 0x2a4]
mov ecx, ebx
push eax
call fcn.1801240b
lea ecx, [ebp - 0x158]
call fcn.1801238a
mov eax, dword [ebp - 0x114]
cmp eax, 0x10
jb 0x180c6760
mov ecx, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a4], ecx
cmp eax, 0x1000
jb 0x180c6757
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.18007386
mov eax, dword [ebp - 0x2a8]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2a4]
push eax
push ecx
call fcn.1814d45b
pop ecx
pop ecx
and dword [ebp - 0x118], 0
lea ecx, [ebp - 0x188]
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], 0
call fcn.1801238a
lea ecx, [ebp - 0x170]
call fcn.1801238a
push 0
push dword [ebp - 0x294]
lea ecx, [ebp - 0x188]
call fcn.180a5e88
push 0x181e0b40
mov edx, ebx
lea ecx, [ebp - 0x170]
mov esi, eax
call fcn.180adb3b
add esp, 0xc
lea ecx, [ebp - 0x158]
push esi
push eax
push dword [ebp - 0x2a4]
call fcn.18075807
lea eax, [ebp - 0x158]
cmp edi, eax
je 0x180c67f7
mov ecx, edi
call fcn.1801238a
mov byte [ebp - 0x2a4], 0
lea eax, [ebp - 0x158]
push dword [ebp - 0x2a4]
mov ecx, edi
push eax
call fcn.1801240b
lea ecx, [ebp - 0x158]
call fcn.1801238a
lea ecx, [ebp - 0x170]
call fcn.1801238a
lea ecx, [ebp - 0x188]
call fcn.1801238a
push 0x181e0b40
mov edx, ebx
lea ecx, [ebp - 0x170]
call fcn.180adb3b
cmp dword [ebp - 0x12c], 0x10
pop ecx
lea ecx, [ebp - 0x140]
jb 0x180c6840
mov ecx, dword [ebp - 0x140]
push dword [ebp - 0x130]
push ecx
mov ecx, eax
call fcn.1801ea02
xor ebx, ebx
lea ecx, [ebp - 0x128]
mov byte [ebp - 0x2a4], bl
push dword [ebp - 0x2a4]
mov dword [ebp - 0x118], ebx
push eax
mov dword [ebp - 0x114], ebx
call fcn.1801240b
lea eax, [ebp - 0x128]
cmp edi, eax
je 0x180c689f
mov ecx, edi
call fcn.1801238a
mov byte [ebp - 0x2a4], bl
lea eax, [ebp - 0x128]
push dword [ebp - 0x2a4]
mov ecx, edi
push eax
call fcn.1801240b
mov eax, dword [ebp - 0x114]
cmp eax, 0x10
jb 0x180c68ee
mov ecx, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x2a8], ecx
cmp eax, 0x1000
jb 0x180c68e5
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.18007386
mov eax, dword [ebp - 0x2a4]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2a8]
push eax
push ecx
call fcn.1814d45b
pop ecx
pop ecx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], 0xf
mov byte [ebp - 0x128], bl
call fcn.1801238a
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x180c695e
mov ecx, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x2a4], eax
mov dword [ebp - 0x2a8], ecx
cmp eax, 0x1000
jb 0x180c6955
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2a8]
push eax
call fcn.18007386
mov eax, dword [ebp - 0x2a4]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x2a8]
push eax
push ecx
call fcn.1814d45b
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1814cf3d
leave
ret