Function at 0x4101c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor esi, esi
lea eax, [ebp - 0x14]
push eax
push 0x20019
push esi
push str.softwaremicrosoftwindows_ntcurrentversionperflib
push 0x80000002
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
mov dword [ebx + 0xc], esi
mov dword [ebx + 0x10], esi
mov dword [ebx + 0x14], esi
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], esi
mov dword [ebp - 0xc], 1
call edi
test eax, eax
jne 0x4103c8
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
push esi
push str.Last_Counter
push ecx
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4103c8
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
push ecx
push esi
push str.Version
push edx
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x41028f
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push str.softwaremicrosoftwindows_ntcurrentversionperflib009
push 0x80000002
mov dword [ebp - 0x1c], str.Counters
call edi
test eax, eax
jne 0x4103c8
jmp 0x41029d
mov dword [ebp - 0x1c], str.Counter_009
mov dword [ebp - 8], 0x80000004
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 8]
push esi
lea edx, [ebp - 0x18]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4103c8
mov edi, dword [ebp - 4]
cmp edi, esi
jne 0x4102df
push str.TM_PERF_DATA_Init
push str.__s__Attempt_to_Allocate_Zero_Bytes_Memory_n
push str.TM_MemAlloc
call fcn.0040b140
add esp, 0xc
xor eax, eax
jmp 0x4102ee
mov ebx, str.TM_PERF_DATA_Init
call fcn.0040ec00
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebx + 4], eax
cmp eax, esi
je 0x4103c1
mov eax, dword [ebp - 0x10]
lea eax, [eax*4 + 4]
cmp eax, esi
jne 0x410322
push str.TM_PERF_DATA_Init
push str.__s__Attempt_to_Allocate_Zero_Bytes_Memory_n
push str.TM_MemAlloc
call fcn.0040b140
add esp, 0xc
xor eax, eax
jmp 0x410333
mov edi, eax
mov ebx, str.TM_PERF_DATA_Init
call fcn.0040ec00
mov ebx, dword [ebp + 8]
xor esi, esi
mov dword [ebx + 8], eax
cmp eax, esi
je 0x4103c1
mov edx, dword [ebp - 0x10]
lea ecx, [edx*4 + 4]
push ecx
push eax
call sym.SelectBehaviorsExe.exe_TM_ZeroBuffer
mov eax, dword [ebx + 4]
add esp, 8
lea edx, [ebp - 4]
push edx
mov edx, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0x18]
push ecx
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4103c8
mov esi, dword [ebx + 4]
cmp byte [esi], al
je 0x4103ac
mov eax, esi
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x410380
sub eax, edx
push esi
mov dword [ebp - 4], eax
call fcn.004173b8
mov ecx, dword [ebp - 4]
add esp, 4
lea esi, [esi + ecx + 1]
cmp eax, dword [ebp - 0x10]
ja 0x4103a7
mov edx, dword [ebx + 8]
mov dword [edx + eax*4], esi
cmp byte [esi], 0
jne 0x410378
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0x20
mov dword [ebx + 0x1c], eax
mov dword [ebp - 0xc], 0
jmp 0x4103f0
mov dword [ebp - 0xc], 0xa
mov eax, dword [ebx + 4]
cmp eax, esi
je 0x4103dd
mov esi, eax
mov edi, str.TM_PERF_DATA_Init
call fcn.0040ec60
xor esi, esi
mov ebx, dword [ebx + 8]
cmp ebx, esi
je 0x4103f2
mov esi, ebx
mov edi, str.TM_PERF_DATA_Init
call fcn.0040ec60
xor esi, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x410402
push eax
call edi
mov eax, dword [ebp - 8]
cmp eax, esi
je 0x41040c
push eax
call edi
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret