Function at 0x101279f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x10250150]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x22c], 1
push 0
push eax
mov ebx, ecx
call fcn.102134e7
add esp, 0xc
mov dword [ebp - 0x228], 0x206
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x22c]
push eax
push str.LinksFolderName
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10127d26
push 0x2871
lea ecx, [ebp - 0x214]
mov word [ebp - 6], ax
call fcn.10004700
push dword [eax]
lea eax, [ebp - 0x20c]
push eax
call fcn.102134f3
mov edx, dword [ebp - 0x214]
add esp, 8
test eax, eax
setne byte [ebp - 0x20d]
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10127ab0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp byte [ebp - 0x20d], 0
je 0x10127d26
push 0x2c
lea ecx, [ebx + 0xc4]
mov dword [ebx + 0xc0], SysReAllocString
push str.SOFTWAREMicrosoftInternet_ExplorerToolbar
call fcn.10004050
push 0xf
lea ecx, [ebx + 0xc8]
push str.LinksFolderName
call fcn.10004050
push 0x2746
lea ecx, [ebp - 0x218]
call fcn.10004700
mov esi, dword [ebx + 0xcc]
sub esi, 0x10
mov ecx, dword [eax]
lea edx, [ecx - 0x10]
cmp edx, esi
je 0x10127b5f
cmp dword [esi + 0xc], 0
jl 0x10127b50
mov eax, dword [edx]
cmp eax, dword [esi]
jne 0x10127b50
push edx
call fcn.10004ba0
add esp, 4
mov dword [ebp - 0x214], eax
or ecx, 0xffffffff
lea edx, [esi + 0xc]
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x10127b45
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x214]
add eax, 0x10
mov dword [ebx + 0xcc], eax
jmp 0x10127b5f
push dword [ecx - 0xc]
push ecx
lea ecx, [ebx + 0xcc]
call fcn.10004050
mov edx, dword [ebp - 0x218]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10127b7d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebx + 0xc8]
push 0x20019
push 1
push ecx
sub eax, 0x10
mov dword [ebp - 0x224], 0
mov esi, esp
mov dword [ebp - 0x220], 0
push eax
mov dword [ebp - 0x21c], 0
call fcn.10004ba0
add eax, 0x10
mov dword [esi], eax
mov esi, esp
mov eax, dword [ebx + 0xc4]
sub eax, 0x10
push eax
call fcn.10004ba0
add esp, 4
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x224]
push dword [ebx + 0xc0]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.100e4e10
mov edi, dword [ebx + 0xcc]
lea ecx, [ebp - 0x218]
add esp, 0x1c
push 0x9cc4
call fcn.10004700
push 1
push 0
push ecx
mov ecx, esp
mov esi, eax
push 0x10219d7c
call fcn.10004700
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push ecx
mov ecx, esp
push 0x10219d7c
call fcn.10004700
push ecx
mov ecx, esp
push 0x10219d7c
call fcn.10004700
push ecx
mov ecx, esp
push 0x10219d7c
call fcn.10004700
push 0
push 0xffffffffffffffff
push 4
lea eax, [ebp - 0x224]
push eax
push 0
push 4
call fcn.100e6ba0
add esp, 4
mov ecx, ebx
push eax
push edi
push 0x10219d7c
push dword [esi]
push dword [ebx + 0xcc]
call fcn.100d6a20
mov edx, dword [ebp - 0x218]
mov dword [ebx + 0xbc], eax
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10127c97
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x230]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10127cb5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x224]
test esi, esi
je 0x10127d26
mov edi, dword [ebp - 0x220]
cmp esi, edi
je 0x10127cf7
lea esp, [esp]
mov edx, dword [esi]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10127cea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add esi, 4
cmp esi, edi
jne 0x10127cd0
mov esi, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x21c]
mov eax, esi
sub ecx, esi
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x10127d1c
mov esi, dword [esi - 4]
add ecx, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10127d37
push ecx
push esi
call fcn.102134ff
add esp, 8
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10212f74
mov esp, ebp
pop ebp
ret
call fcn.10200ab0
int3