Function at 0x10001e90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push str.IsWow64Process
xor edi, edi
mov dword [ebp - 0x1c], ecx
push str.kernel32
mov dword [ebp - 8], edi
mov esi, 0x20019
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [ebp - 0x10], edi
test ebx, ebx
je 0x10001ee4
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x10001ee4
cmp dword [ebp - 0x10], edi
je 0x10001ee4
mov esi, 0x20219
lea eax, [ebp - 4]
push eax
push esi
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100020a1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 4]
mov dword [ebp - 0xc], edi
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
test eax, eax
jne 0x10001f70
push dword [ebp - 0xc]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp - 0xc]
mov edi, eax
mov dword [ebp - 8], ecx
test edi, edi
je 0x10001f70
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 4]
call esi
test eax, eax
je 0x10001f70
push edi
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
mov eax, dword [ebp - 4]
test eax, eax
je 0x10001f85
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
test edi, edi
je 0x100020a1
mov esi, dword [ebp - 8]
mov ebx, edi
shr esi, 1
cmp word [edi], 0
je 0x10002091
mov edi, edi
test esi, esi
je 0x10002091
push esi
push ebx
mov dword [ebp - 0x18], ebx
call fcn.100044b3
inc eax
sub esi, eax
mov dword [ebp - 0x10], eax
push esi
lea ebx, [ebx + eax*2]
push ebx
mov dword [ebp - 0x20], ebx
call fcn.100044b3
inc eax
add esp, 0x10
add dword [ebp - 0x10], eax
sub esi, eax
push dword [ebp - 0x1c]
lea ebx, [ebx + eax*2]
mov eax, dword [ebp - 0x18]
add eax, 8
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10001fee
mov eax, dword [ebp - 0x20]
cmp word [eax], 0
je 0x10001ff9
cmp word [ebx], 0
jne 0x10001fa0
jmp 0x10002091
push esi
push ebx
push dword [ebp - 0x18]
call fcn.10009d90
mov eax, dword [ebp - 0x10]
add esp, 0xc
sub dword [ebp - 8], eax
mov esi, 0x20006
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov dword [ebp - 0x18], 0
test ebx, ebx
je 0x10002051
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x10002051
cmp dword [ebp - 0x18], 0
je 0x10002051
mov esi, 0x20206
lea eax, [ebp - 4]
push eax
push esi
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10002091
push dword [ebp - 8]
push edi
push 7
push eax
push str.PendingFileRenameOperations
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret