Function at 0x10013f01
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xa94
mov eax, 0x1004e231
call fcn.10035d35
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xa6c], eax
xor ebx, ebx
lea eax, [ebp - 0xa84]
mov dword [ebp - 4], ebx
push eax
mov dword [ebp - 0xa58], ebx
call fcn.1000cafd
mov byte [ebp - 4], 1
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x10013f40
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0xa58]
push ecx
push 1
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100141d3
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0xa68], ebx
call fcn.10035820
add esp, 0xc
xor eax, eax
push 0x7fe
mov word [ebp - 0xa18], ax
lea eax, [ebp - 0xa16]
push ebx
push eax
mov dword [ebp - 0xa5c], 0x104
mov dword [ebp - 0xa64], ebx
call fcn.10035820
add esp, 0xc
push 7
pop esi
push ebx
lea ecx, [ebp - 0xa50]
mov dword [ebp - 0xa60], 0x400
mov dword [ebp - 0xa38], esi
call fcn.10002d1a
push ebx
lea ecx, [ebp - 0xa34]
mov dword [ebp - 0xa1c], esi
call fcn.10002d1a
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa64]
push eax
push ebx
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0x218]
push eax
mov byte [ebp - 4], 3
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push ebx
jmp 0x100140e3
inc dword [ebp - 0xa68]
cmp dword [ebp - 0xa64], 1
jne 0x1001407b
cmp dword [ebp - 0xa5c], ebx
jbe 0x1001407b
cmp dword [ebp - 0xa60], 3
jbe 0x1001407b
lea eax, [ebp - 0x218]
push eax
push str.NetCfgInstanceId
call fcn.100330b8
pop ecx
pop ecx
test eax, eax
jne 0x10014052
lea ecx, [ebp - 0xa34]
jmp 0x1001406f
lea eax, [ebp - 0x218]
push eax
push str.DeviceInstanceID
call fcn.100330b8
pop ecx
pop ecx
test eax, eax
jne 0x1001407b
lea ecx, [ebp - 0xa50]
lea eax, [ebp - 0xa18]
push eax
call fcn.10002941
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.10035820
add esp, 0xc
push 0x800
lea eax, [ebp - 0xa18]
push ebx
push eax
call fcn.10035820
add esp, 0xc
lea eax, [ebp - 0xa60]
push eax
lea eax, [ebp - 0xa18]
push eax
lea eax, [ebp - 0xa64]
push eax
push ebx
lea eax, [ebp - 0xa5c]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0xa68]
mov dword [ebp - 0xa5c], 0x104
mov dword [ebp - 0xa60], 0x400
push dword [ebp - 0xa58]
call esi
test eax, eax
je 0x10014013
push dword [ebp - 0xa58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
push ebx
lea eax, [ebp - 0xaa0]
push eax
lea ecx, [ebp - 0xa50]
call fcn.100026fc
cmp dword [eax + 0x18], 8
jb 0x1001411f
mov eax, dword [eax + 4]
jmp 0x10014122
add eax, 4
push 0x10054e48
push eax
call fcn.100330b8
pop ecx
neg eax
sbb al, al
pop ecx
xor esi, esi
push ebx
inc al
inc esi
push esi
lea ecx, [ebp - 0xaa0]
mov byte [ebp - 0xa51], al
call fcn.10002a1b
cmp byte [ebp - 0xa51], bl
je 0x100141b9
mov ecx, dword [ebp - 0xa6c]
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0xa34]
push eax
call fcn.100028ae
push ebx
push esi
lea ecx, [ebp - 0xa34]
call fcn.10002a1b
push ebx
push esi
lea ecx, [ebp - 0xa50]
call fcn.10002a1b
mov byte [ebp - 0xa51], 1
lea esi, [ebp - 0xa84]
call fcn.1000e95a
push dword [ebp - 0xa84]
call fcn.10032bcc
pop ecx
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.10002a1b
mov al, byte [ebp - 0xa51]
call fcn.10035db8
ret 0x20
push ebx
push esi
lea ecx, [ebp - 0xa34]
call fcn.10002a1b
push ebx
push esi
lea ecx, [ebp - 0xa50]
call fcn.10002a1b
mov byte [ebp - 0xa51], bl
jmp 0x10014189