Function at 0x10018bcd
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1444
call fcn.1001f210
mov eax, dword [0x1006d1fc]
xor eax, esp
mov dword [esp + 0x1440], eax
mov eax, dword [esp + 0x1448]
push ebx
push ebp
push esi
push edi
mov ebp, 0x400
mov dword [esp + 0x28], eax
push ebp
xor ebx, ebx
lea eax, [esp + 0x454]
push ebx
push eax
call fcn.10022500
add esp, 0xc
push 0x10057168
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x10018ea8
push ebp
lea ecx, [esp + 0x454]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x450]
push ebp
push eax
call fcn.100309e8
pop ecx
pop ecx
test eax, eax
je 0x10018ea8
lea eax, [esp + 0x450]
push str.jvm.dll
push eax
call fcn.10022790
pop ecx
pop ecx
test eax, eax
je 0x10018ea8
push ebp
lea eax, [esp + 0x854]
push eax
lea eax, [esp + 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 0x850]
push ebp
push eax
call fcn.100309e8
pop ecx
pop ecx
test eax, eax
je 0x10018ea8
lea eax, [esp + 0x850]
push str._bin
push eax
call fcn.10022790
pop ecx
pop ecx
test eax, eax
je 0x10018cad
mov byte [eax], bl
push 0x20019
push 0x10057180
mov edi, ebx
mov dword [esp + 0x40], ebx
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [esp + 0x44]
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
call fcn.10006af6
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebp, dword [esp + 0x38]
test eax, eax
jne 0x10018ef2
mov edi, 0x20019
lea ecx, [esp + 0x2c]
push edi
push 0x1005718c
push ebp
call fcn.10006af6
test eax, eax
jne 0x10018f04
push edi
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x48]
push 0x10057198
push edi
call fcn.10006af6
mov ebx, dword [esp + 0x44]
test eax, eax
jne 0x10018e93
and dword [esp + 0x14], 0
mov eax, 0x400
push eax
mov dword [esp + 0x14], eax
lea eax, [esp + 0x54]
push 0
push eax
call fcn.10022500
add esp, 0xc
lea eax, [esp + 0x10]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push eax
lea eax, [esp + 0x64]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x10018e93
xor eax, eax
xor ecx, ecx
inc eax
xor edx, edx
cmp dword [esp + 0x10], ecx
jbe 0x10018e55
cmp byte [esp + edx + 0x50], 0x2e
jne 0x10018da1
inc ecx
cmp ecx, eax
jg 0x10018db0
inc edx
cmp edx, dword [esp + 0x10]
jb 0x10018d95
cmp ecx, eax
jle 0x10018e55
push 3
lea eax, [esp + 0x54]
push 0x100571b4
push eax
call fcn.10024520
add esp, 0xc
test eax, eax
js 0x10018e55
push 0x20019
lea eax, [esp + 0x54]
push eax
push ebx
lea ecx, [esp + 0x24]
call fcn.10006af6
test eax, eax
jne 0x10018e55
mov eax, 0x400
push eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc54]
push 0
push eax
call fcn.10022500
add esp, 0xc
lea eax, [esp + 0x24]
lea ecx, [esp + 0x18]
push eax
lea eax, [esp + 0xc54]
push eax
push 0x100571b8
call fcn.10007324
test eax, eax
jne 0x10018e55
push 0x400
lea eax, [esp + 0x1054]
push eax
lea eax, [esp + 0xc58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea eax, [esp + 0x850]
push eax
lea eax, [esp + 0x1054]
push eax
call fcn.10030779
pop ecx
pop ecx
test eax, eax
je 0x10018ec3
mov eax, dword [esp + 0x14]
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x400
push ecx
lea ecx, [esp + 0x64]
inc eax
push ecx
push eax
push ebx
mov dword [esp + 0x34], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x10018d84
cmp dword [esp + 0x18], 0
je 0x10018e93
push dword [esp + 0x18]
call esi
test ebx, ebx
je 0x10018e9a
push ebx
call esi
test edi, edi
je 0x10018ea1
push edi
call esi
test ebp, ebp
je 0x10018ea8
push ebp
call esi
xor eax, eax
mov ecx, dword [esp + 0x1450]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1001efb2
add esp, 0x1444
ret
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x1460]
push dword [esp + 0x30]
call fcn.10024462
add esp, 0xc
cmp dword [esp + 0x18], 0
je 0x10018ee8
push dword [esp + 0x18]
call esi
test ebx, ebx
je 0x10018eef
push ebx
call esi
xor ebx, ebx
inc ebx
test edi, edi
je 0x10018ef9
push edi
call esi
test ebp, ebp
je 0x10018f00
push ebp
call esi
mov eax, ebx
jmp 0x10018eaa
mov edi, dword [esp + 0x2c]
jmp 0x10018ef2