Function at 0x7357e0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov dword [0xb0e838], 0x7e6ba0
mov dword [0xb10330], 0xb0e7c8
mov dword [0xb0e7c8], 0x84
push ebx
push ebp
push esi
push edi
xor ebx, ebx
push ecx
push ebx
push 0xb0e7c8
mov dword [0xb0e82c], 0x300
call fcn.0074a5a0
mov dword [0xa5a854], ebx
mov dword [0xa5a858], ebx
push 0xa5a854
push 0x79a438
push 1
push ebx
push 0x79a4d8
mov dword [0xa5a85c], ebx
mov dword [0xb102e0], ebx
mov dword [0xb102e4], ebx
mov dword [0xb102e8], ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0xa5a854], ebx
je 0x735b7f
push 0x20
call fcn.0076d5a7
mov ebp, dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x735894
mov ecx, esi
call fcn.0074b3d0
mov dword [esi], vtable.ATL::CComObject_class_CChatEventSink_.0
push 0xb0e7dc
call ebp
jmp 0x735896
xor esi, esi
mov eax, dword [0x79a5fc]
lea edx, [esp + 0x14]
mov dword [0xb0fdd4], esi
push edx
lea edi, [eax + esi]
mov eax, dword [0xa5a854]
push 0x79ab40
push eax
mov ecx, dword [eax]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x7358f2
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x10]
push edx
push 0x79a448
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
jl 0x7358f2
mov eax, dword [esp + 0x10]
push 0xb102e0
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x735900
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x73590e
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [0xa5a854], ebx
je 0x735b7f
cmp esi, ebx
jne 0x735b7f
push 0xa5a858
push 0x79a478
push 1
push ebx
push 0x79a4f8
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0xa5a858], ebx
je 0x735b76
push 0x20
call fcn.0076d5a7
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x73596e
mov ecx, esi
call fcn.0074a630
mov dword [esi], vtable.ATL::CComObject_class_CNetUtilEventSink_.0
push 0xb0e7dc
call ebp
mov eax, esi
jmp 0x735970
xor eax, eax
mov edx, dword [0x79a5bc]
mov dword [0xb0dfb0], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
lea edi, [edx + eax]
mov eax, dword [0xa5a858]
lea edx, [esp + 0x10]
mov ecx, dword [eax]
push edx
push 0x79ab40
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x7359cc
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0x79a488
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov esi, eax
cmp esi, ebx
jl 0x7359cc
mov eax, dword [esp + 0x14]
push 0xb102e4
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.00751c60
lea ecx, [esp + 0x10]
call fcn.00751c50
cmp dword [0xa5a858], ebx
je 0x735b76
cmp esi, ebx
jne 0x735b76
push 0xa5a85c
push 0x79a458
push 1
push ebx
push 0x79a4e8
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp dword [0xa5a85c], ebx
je 0x735b6d
push 0x20
call fcn.0076d5a7
add esp, 4
cmp eax, ebx
je 0x735a2e
push ebx
mov ecx, eax
call fcn.00752650
jmp 0x735a30
xor eax, eax
mov edx, dword [0x79a5a4]
mov dword [0xb0e6f0], eax
push 0xb102e8
add eax, edx
push 0x79a468
push eax
mov eax, dword [0xa5a85c]
push eax
call fcn.0074a510
cmp dword [0xa5a85c], ebx
je 0x735b6d
cmp eax, ebx
jne 0x735b6d
mov eax, dword [0xa5a854]
lea edx, [esp + 0x1c]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [esp + 0x1c], 0x1000e
jae 0x735a99
push ebx
push ebx
push 0x1a52
push str.C:RA2wonline.cpp
xor edx, edx
mov ecx, str.TXT_APIWRONGVERSION
jmp 0x735b92
mov eax, dword [0xa5a854]
push str.SOFTWAREWestwoodRed_Alert_2
push str.RegPath
push eax
mov ecx, dword [eax]
call dword [ecx + 0xa4]
mov edx, str.SOFTWAREWestwoodRed_Alert_2
test edx, edx
je 0x735b5d
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x735b5d
mov edi, str.SOFTWAREWestwoodRed_Alert_2
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x24]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x24]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x735b5d
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x24]
push ecx
push edx
push ebx
push 0x7e7118
push eax
mov dword [esp + 0x2c], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x735b52
mov eax, dword [0xa5a854]
mov edx, dword [esp + 0x10]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x8c]
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x114
ret
push ebx
push ebx
push 0x1a46
jmp 0x735b86
push ebx
push ebx
push 0x1a36
jmp 0x735b86
push ebx
push ebx
push 0x1a26
push str.C:RA2wonline.cpp
xor edx, edx
mov ecx, 0x7e7108
call fcn.006eea10
mov ecx, eax
xor edx, edx
call fcn.005bdc20
mov eax, 0xfffffffe
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret