Function at 0x1007174f
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x100dcf8a
call fcn.100ac440
sub esp, 0x228
mov eax, dword [0x1011c710]
push ebx
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x220], ebx
call fcn.100c6d12
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push str.DisplayIcon
lea ecx, [ebp - 0x228]
mov dword [ebp - 4], ebx
call fcn.1000223a
push 0x41
pop ecx
xor eax, eax
mov byte [ebp - 0x118], bl
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
xor edx, edx
inc edx
lea eax, [ebp - 0x224]
push eax
push edx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallPPStream
mov esi, 0x104
push 0x80000002
mov byte [ebp - 4], dl
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x224], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10071883
cmp dword [ebp - 0x224], ebx
je 0x10071871
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x234]
push eax
push ebx
push dword [ebp - 0x228]
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10071871
lea eax, [ebp - 0x118]
push eax
call fcn.100ab7d0
test eax, eax
pop ecx
jbe 0x10071871
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.100ad0b7
test eax, eax
pop ecx
pop ecx
jne 0x10071871
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x220]
call fcn.10001f92
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10071983
push dword [ebp - 0x224]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x224], ebx
push 0x105
lea eax, [ebp - 0x118]
push ebx
push eax
call fcn.100ab720
add esp, 0xc
push esi
lea eax, [ebp - 0x118]
push eax
push 0x100e7c8c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x118]
push 0x5c
push eax
call fcn.100ac7cd
mov byte [eax + 1], bl
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x220]
push str._sPPStream.exe
push eax
call fcn.10001d75
push ebx
push dword [ebp - 0x220]
call fcn.100ad0b7
add esp, 0x1c
test eax, eax
je 0x10071983
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x21c], bl
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push esi
stosb byte es:[edi], al
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.100ab720
lea eax, [ebp - 0x118]
push eax
call fcn.100ab7d0
dec eax
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.100ab860
lea eax, [ebp - 0x21c]
push 0x5c
push eax
call fcn.100ac7cd
mov byte [eax + 1], bl
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x220]
push str._sPPStream.exe
push eax
call fcn.10001d75
push ebx
push dword [ebp - 0x220]
call fcn.100ad0b7
add esp, 0x38
test eax, eax
je 0x10071983
push 0x100e2d52
lea ecx, [ebp - 0x220]
call fcn.10001f92
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.10001199
mov ecx, dword [ebp - 0x22c]
lea eax, [ebp - 0x220]
push eax
call fcn.1000174b
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.10001199
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x22c]
pop edi
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop esi
xor ecx, ebp
pop ebx
call fcn.100ac33f
leave
ret 4