Function at 0x10001110
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x100501dc
mov eax, dword fs:[0]
push eax
sub esp, 0x6b0
mov eax, dword [0x10063790]
xor eax, esp
mov dword [esp + 0x6a8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10063790]
xor eax, esp
push eax
lea eax, [esp + 0x6c4]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x6d4]
xor edi, edi
push 6
mov esi, ecx
mov ebx, 7
push str.ST_SYS
lea ecx, [esp + 0x58]
mov dword [ebp + 4], edi
mov dword [ebp + 8], edi
mov dword [ebp + 0xc], edi
mov dword [ebp + 0x10], edi
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x18], edi
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x20], edi
mov dword [ebp + 0x24], edi
mov dword [ebp + 0x28], edi
mov dword [ebp + 0x2c], edi
mov dword [ebp + 0x30], edi
mov dword [esp + 0x70], ebx
mov dword [esp + 0x6c], edi
mov word [esp + 0x5c], di
call fcn.10001bf0
mov dword [esp + 0x6cc], edi
push 6
push str.ST_SFT
lea ecx, [esp + 0x3c]
mov dword [esp + 0x54], ebx
mov dword [esp + 0x50], edi
mov word [esp + 0x40], di
call fcn.10001bf0
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x9c], edi
mov word [esp + 0x8c], di
mov dword [esp + 0x84], ebx
mov dword [esp + 0x80], edi
mov word [esp + 0x70], di
mov eax, esi
mov byte [esp + 0x6cc], 3
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x100011f6
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x90]
call fcn.10001bf0
push ebx
push 0x10056bd4
lea ecx, [esp + 0x90]
call fcn.100019e0
mov eax, esi
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x10001230
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x74]
call fcn.10001bf0
push 9
push 0x10056be4
lea ecx, [esp + 0x74]
call fcn.100019e0
push str.SeRestorePrivilege
mov eax, 1
mov dword [esp + 0x1c], 0x208
call fcn.10001070
push str.SeBackupPrivilege
mov eax, 1
call fcn.10001070
mov ecx, dword [esp + 0x8c]
mov eax, 8
cmp dword [esp + 0xa0], eax
jae 0x1000129c
lea ecx, [esp + 0x8c]
cmp dword [esp + 0x68], eax
mov eax, dword [esp + 0x54]
jae 0x100012aa
lea eax, [esp + 0x54]
mov esi, dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [esp + 0x84], 8
mov ecx, dword [esp + 0x70]
mov ebx, eax
jae 0x100012cd
lea ecx, [esp + 0x70]
cmp dword [esp + 0x4c], 8
mov eax, dword [esp + 0x38]
jae 0x100012dc
lea eax, [esp + 0x38]
push ecx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp ebx, edi
jne 0x10001429
cmp eax, edi
jne 0x10001429
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0x1c]
push eax
push 1
push edi
push str.ST_SFTMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x30], edi
call esi
test eax, eax
jne 0x10001429
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x2b0]
push edx
push edi
push edi
push str.CurrentVersion
push eax
mov dword [esp + 0x30], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000141e
mov ecx, 0x10056cc0
lea eax, [esp + 0x2ac]
mov ebx, 4
jmp 0x10001360
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001384
cmp dx, di
je 0x10001380
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001384
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x10001360
xor eax, eax
jmp 0x10001389
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x10001532
mov dword [ebp + 4], 1
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, 0x208
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x4b8]
push eax
push edi
push edi
push str.EditionID
push ecx
mov dword [esp + 0x30], ebx
call esi
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0xa8]
push eax
push edi
push edi
push str.InstallationType
push ecx
mov dword [esp + 0x30], ebx
call esi
test eax, eax
jne 0x1000141e
lea edx, [esp + 0x4b4]
push str.WindowsPE
push edx
call fcn.1003c14c
add esp, 8
test eax, eax
jne 0x10001417
lea eax, [esp + 0xa4]
push str.WindowsPE
push eax
call fcn.1003c14c
add esp, 8
test eax, eax
je 0x1000141e
mov dword [ebp + 0x34], 1
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x54]
mov ebx, 8
cmp dword [esp + 0x68], ebx
jae 0x1000143c
lea eax, [esp + 0x54]
mov esi, dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
cmp dword [esp + 0x4c], ebx
mov eax, dword [esp + 0x38]
jae 0x10001458
lea eax, [esp + 0x38]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call esi
push str.SeRestorePrivilege
xor eax, eax
call fcn.10001070
push str.SeBackupPrivilege
xor eax, eax
call fcn.10001070
cmp dword [esp + 0x84], ebx
jb 0x1000148e
mov edx, dword [esp + 0x70]
push edx
call fcn.1003c1aa
add esp, 4
cmp dword [esp + 0xa0], ebx
mov esi, 7
mov dword [esp + 0x84], esi
mov dword [esp + 0x80], edi
mov word [esp + 0x70], di
jb 0x100014bf
mov eax, dword [esp + 0x8c]
push eax
call fcn.1003c1aa
add esp, 4
cmp dword [esp + 0x4c], ebx
mov dword [esp + 0xa0], esi
mov dword [esp + 0x9c], edi
mov word [esp + 0x8c], di
jb 0x100014e8
mov ecx, dword [esp + 0x38]
push ecx
call fcn.1003c1aa
add esp, 4
cmp dword [esp + 0x68], ebx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], edi
mov word [esp + 0x38], di
jb 0x10001508
mov edx, dword [esp + 0x54]
push edx
call fcn.1003c1aa
add esp, 4
mov ecx, dword [esp + 0x6c4]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x6a8]
xor ecx, esp
call fcn.1003c13d
add esp, 0x6bc
ret 4
mov ecx, 0x10056cc8
lea eax, [esp + 0x2ac]
mov edi, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001564
cmp dx, di
je 0x10001560
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001564
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x10001540
xor eax, eax
jmp 0x10001569
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x10001693
lea ecx, [esp + 0x28]
push ecx
push 1
push edi
push str.ST_SYSControlSet001ControlProductOptions
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x3c], edi
call esi
test eax, eax
jne 0x10001398
mov ecx, dword [esp + 0x28]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2b0]
push eax
push edi
push edi
push str.ProductSuite
push ecx
mov dword [esp + 0x30], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001683
mov ecx, str.Personal
lea eax, [esp + 0x2ac]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100015f4
cmp dx, di
je 0x100015f0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100015f4
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x100015d0
xor eax, eax
jmp 0x100015f9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x10001614
mov edx, dword [esp + 0x28]
push edx
mov dword [ebp + 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10001398
lea edx, [esp + 0x24]
push edx
push 1
push edi
push str.ST_SYSWPAMediaCenter
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp + 0xc], 1
mov dword [esp + 0x38], edi
call esi
test eax, eax
jne 0x10001683
lea eax, [esp + 0x30]
push eax
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x24]
push ecx
lea edx, [esp + 0x34]
push edx
push edi
push str.Installed
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x48], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10001678
mov eax, 1
cmp dword [esp + 0x20], eax
jne 0x10001678
mov dword [ebp + 0x10], eax
mov dword [ebp + 0xc], edi
mov ecx, dword [esp + 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x28]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10001398
mov ecx, 0x10056d9c
lea eax, [esp + 0x2ac]
nop
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100016c4
cmp dx, di
je 0x100016c0
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100016c4
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x100016a0
xor eax, eax
jmp 0x100016c9
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x10001708
lea eax, [esp + 0x20]
push eax
mov ebx, 1
push ebx
push edi
push str.ST_SFTWow6432Node
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], edi
call esi
test eax, eax
jne 0x10001700
mov ecx, dword [esp + 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp + 0x1c], ebx
jmp 0x10001398
mov dword [ebp + 0x14], ebx
jmp 0x10001398
mov ecx, 0x10056dcc
lea eax, [esp + 0x2ac]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001738
cmp dx, di
je 0x10001734
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001738
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x10001714
xor eax, eax
jmp 0x1000173d
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x10001834
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x4b8]
push eax
push edi
push edi
push str.EditionID
mov ebx, 0x208
push ecx
mov dword [esp + 0x30], ebx
call esi
test eax, eax
jne 0x100013a3
lea edx, [esp + 0x4b4]
push str.Server
push edx
call fcn.1003c14c
add esp, 8
test eax, eax
mov dword [esp + 0x18], ebx
je 0x100017e0
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0xa8]
push ecx
push edi
push edi
push str.BuildLabEx
push edx
call esi
test eax, eax
jne 0x100013a3
lea eax, [esp + 0xa4]
push str..x86
push eax
call fcn.1003c14c
add esp, 8
test eax, eax
je 0x1000190c
mov dword [ebp + 0x24], 1
jmp 0x100013a3
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xa8]
push edx
push edi
push edi
push str.BuildLabEx
push eax
call esi
test eax, eax
jne 0x100013a3
lea ecx, [esp + 0xa4]
push str..x86
push ecx
call fcn.1003c14c
add esp, 8
test eax, eax
je 0x10001828
mov dword [ebp + 0x18], 1
jmp 0x100013a3
mov dword [ebp + 0x20], 1
jmp 0x100013a3
mov ecx, 0x10056e1c
lea eax, [esp + 0x2ac]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10001864
cmp dx, di
je 0x10001860
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10001864
add eax, ebx
add ecx, ebx
cmp dx, di
jne 0x10001840
xor eax, eax
jmp 0x10001869
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, edi
jne 0x10001398
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x4b8]
push eax
push edi
push edi
push str.EditionID
mov ebx, 0x208
push ecx
mov dword [esp + 0x30], ebx
call esi
test eax, eax
jne 0x100013a3
lea edx, [esp + 0x4b4]
push str.Server
push edx
call fcn.1003c14c
add esp, 8
test eax, eax
mov dword [esp + 0x18], ebx
jne 0x10001794
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0xa8]
push edx
push edi
push edi
push str.BuildLabEx
push eax
call esi
test eax, eax
jne 0x100013a3
lea ecx, [esp + 0xa4]
push str..x86
push ecx
call fcn.1003c14c
add esp, 8
test eax, eax
je 0x10001918
mov dword [ebp + 0x2c], 1
jmp 0x100013a3
mov dword [ebp + 0x28], 1
jmp 0x100013a3
mov dword [ebp + 0x30], 1
jmp 0x100013a3