Function at 0x1008740
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
push ebx
push esi
push edi
mov ebx, 0x410
push ebx
push 8
mov edi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], 1
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x1008a38
push dword [ebp + 8]
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0x420]
push 0x1002a8c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008a28
push dword [ebp + 8]
push 0x1002a84
push dword [edi + 0x410]
call fcn.010076a1
and byte [esi], 0
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002a7c
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100880e
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100880e
push esi
push 0x1002a78
push dword [edi + 0x410]
call fcn.010076a1
add esp, 0xc
jmp 0x1008820
push 0x1002a70
push dword [edi + 0x410]
call fcn.010076a1
pop ecx
pop ecx
and byte [esi], 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002a64
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1008870
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x1008870
mov ecx, dword [edi + 0x410]
push esi
call fcn.01007670
push esi
push 0x1002a78
push dword [edi + 0x410]
call fcn.010076a1
add esp, 0xc
jmp 0x1008882
push 0x1002a70
push dword [edi + 0x410]
call fcn.010076a1
pop ecx
pop ecx
push 0x1001261
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002a58
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10088db
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10088db
mov ecx, dword [edi + 0x410]
push esi
call fcn.01007670
push esi
push 0x1002a78
push dword [edi + 0x410]
call fcn.010076a1
add esp, 0xc
jmp 0x10088ed
push 0x1002a70
push dword [edi + 0x410]
call fcn.010076a1
pop ecx
pop ecx
and byte [esi], 0
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002a54
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100893d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100893d
mov ecx, dword [edi + 0x410]
push esi
call fcn.01007670
push esi
push 0x1002a78
push dword [edi + 0x410]
call fcn.010076a1
add esp, 0xc
jmp 0x100894f
push 0x1002a70
push dword [edi + 0x410]
call fcn.010076a1
pop ecx
pop ecx
push dword [ebp + 8]
and byte [esi], 0
lea eax, [ebp - 0x420]
push 0x1002a48
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x420]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10089f8
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1002a38
push dword [ebp - 0x10]
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10089d8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x10089d8
mov ecx, dword [edi + 0x410]
push esi
call fcn.01007670
push esi
push 0x1002a30
push dword [edi + 0x410]
call fcn.010076a1
add esp, 0xc
jmp 0x10089ea
push 0x1002a28
push dword [edi + 0x410]
call fcn.010076a1
pop ecx
pop ecx
push dword [ebp - 0x10]
and byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008a0a
push 0x1002a28
push dword [edi + 0x410]
call fcn.010076a1
pop ecx
pop ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
jmp 0x1008a3a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4