Function at 0x100133b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056798
mov eax, dword fs:[0]
push eax
sub esp, 0x32c
mov eax, dword [0x10076008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x314], ecx
lea ecx, [ebp - 0x240]
call fcn.10005620
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.10005620
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a0]
call fcn.10005620
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.10005620
mov byte [ebp - 4], 3
push str._INF__FixSnapshot__Start
call fcn.100098e0
add esp, 4
mov eax, dword [ebp - 0x314]
movzx ecx, byte [eax + 8]
test ecx, ecx
jne 0x1001348c
push str._INF__FixSnapshot__End__WinPE_Mode_
call fcn.100098e0
add esp, 4
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.10005450
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a0]
call fcn.10005450
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.10005450
jmp 0x1001382b
push str.SYSTEMCurrentControlSet_servicesVSSProviders
lea ecx, [ebp - 0x240]
call fcn.100053c0
lea ecx, [ebp - 0x308]
call fcn.1002f4d0
mov byte [ebp - 4], 4
push 0x2001f
lea ecx, [ebp - 0x240]
call fcn.10005370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x308]
call fcn.1002f500
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0
je 0x1001352e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x308]
call fcn.1002f4e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.10005450
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a0]
call fcn.10005450
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.10005450
jmp 0x1001382b
push 0x200
push 0
lea edx, [ebp - 0x210]
push edx
call fcn.10033d10
add esp, 0xc
mov dword [ebp - 0x310], 0x100
lea ecx, [ebp - 0x228]
call fcn.10005620
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x258]
call fcn.10005620
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x270]
call fcn.10005620
mov byte [ebp - 4], 7
lea eax, [ebp - 0x338]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x310]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
mov eax, dword [ebp - 0x308]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1001376b
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x228]
call fcn.100053c0
lea edx, [ebp - 0x228]
push edx
lea eax, [ebp - 0x2d0]
push eax
call fcn.100256e0
add esp, 8
mov dword [ebp - 0x318], eax
mov ecx, dword [ebp - 0x318]
push ecx
lea ecx, [ebp - 0x228]
call fcn.100054a0
lea ecx, [ebp - 0x2d0]
call fcn.10005450
push str.microsoft_software
lea ecx, [ebp - 0x228]
call fcn.10005370
push eax
call fcn.10041a4b
add esp, 8
mov dword [ebp - 0x31c], eax
push str.ms_software
lea ecx, [ebp - 0x228]
call fcn.10005370
push eax
call fcn.10041a4b
add esp, 8
mov dword [ebp - 0x320], eax
push str..back
lea ecx, [ebp - 0x228]
call fcn.10005370
push eax
call fcn.10041a4b
add esp, 8
mov dword [ebp - 0x32c], eax
cmp dword [ebp - 0x31c], 0
jne 0x1001374e
cmp dword [ebp - 0x320], 0
jne 0x1001374e
cmp dword [ebp - 0x30c], 0
jne 0x1001374e
lea edx, [ebp - 0x210]
push edx
lea ecx, [ebp - 0x240]
call fcn.10005370
push eax
push 0x10068eec
lea eax, [ebp - 0x2e8]
push eax
call fcn.1002eaa0
add esp, 0x10
mov dword [ebp - 0x324], eax
mov ecx, dword [ebp - 0x324]
push ecx
lea ecx, [ebp - 0x258]
call fcn.100054a0
lea ecx, [ebp - 0x2e8]
call fcn.10005450
push str..bak
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x300]
push eax
call fcn.1000a460
add esp, 0xc
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x328]
push ecx
lea ecx, [ebp - 0x270]
call fcn.100054a0
lea ecx, [ebp - 0x300]
call fcn.10005450
push 1
lea ecx, [ebp - 0x270]
call fcn.10005370
push eax
lea ecx, [ebp - 0x258]
call fcn.10005370
push eax
lea ecx, [ebp - 0x308]
call fcn.1002f8d0
lea ecx, [ebp - 0x270]
call fcn.10005370
push eax
lea ecx, [ebp - 0x258]
call fcn.10005370
push eax
push str._INF__FixSnapshot__Rename__s_____s.back
call fcn.100098e0
add esp, 0xc
mov edx, dword [ebp - 0x310]
push edx
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.10033d10
add esp, 0xc
jmp 0x1001357b
lea ecx, [ebp - 0x308]
call fcn.1002f570
push str._INF__FixSnapshot__Restart_Service
call fcn.100098e0
add esp, 4
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x330], esp
push 0x10068f54
call fcn.10005a60
mov ecx, dword [ebp - 0x314]
call fcn.10013190
push str._INF__FixSnapshot__Finish
call fcn.100098e0
add esp, 4
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x270]
call fcn.10005450
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x258]
call fcn.10005450
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x228]
call fcn.10005450
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x308]
call fcn.1002f4e0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x288]
call fcn.10005450
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2a0]
call fcn.10005450
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2b8]
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.10005450
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002fa64
mov esp, ebp
pop ebp
ret