Function at 0x10024180
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x424], 4
xor esi, esi
lea eax, [edi + 0x110]
test edx, edx
je 0x100241f2
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x100241e4
lea eax, [edi + 0x110]
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100242e0
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10024225
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100242e0
xor eax, eax
push 0x104
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x214]
push eax
push 0xb3b0
push dword [0x10043518]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x214], si
jne 0x10024284
mov esi, dword [0x1004332c]
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10044350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x41c]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.1001a550
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x424]
push eax
lea ebx, [edi + 0xa8]
push ebx
lea eax, [ebp - 0x428]
push eax
push 0
push 0x10003a58
push dword [edi + 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10024314
or esi, 0xffffffff
jmp 0x100243c2
cmp dword [ebp - 0x428], 1
mov ecx, edi
jne 0x1002435a
call fcn.10023d70
test ax, ax
je 0x10024349
mov ecx, edi
call fcn.10023d70
cmp ax, 1
je 0x10024349
push 1
mov edx, 0x10001c18
mov ecx, edi
call fcn.10022f20
or esi, 0xffffffff
jmp 0x100243c2
cmp byte [ebx], 0x19
jne 0x100243c2
mov ecx, edi
call fcn.10023840
movzx esi, ax
jmp 0x100243c2
movzx edx, byte [ebx]
call fcn.10019db0
cmp byte [ebx], 0x19
jne 0x100243c2
mov ebx, dword [edi + 0x110]
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a64
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x100243a6
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a64
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100243b6
mov ecx, edi
call fcn.10023840
movzx esi, ax
jmp 0x100243c2
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 0x110]
test eax, eax
je 0x100243dd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x110], 0
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x100243f8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x10c], 0
mov ecx, dword [ebp - 8]
mov ax, si
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003c3b0
mov esp, ebp
pop ebp
ret 4