Function at 0x1005082
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100923c]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x21c], eax
push 0x1001dd8
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
mov dword [ebp - 0x214], ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001dc8
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.01005cac
push 0x10016d0
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x80000002
push edi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01004e0d
test eax, eax
je 0x100534e
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x100534e
push 1
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.ADVPACK.dll_GetVersionFromFile
test eax, eax
jl 0x1005373
cmp dword [ebp - 0x224], 0x40000
jb 0x100534e
lea eax, [ebp - 0x218]
push eax
push 0x20019
push ebx
push 0x1001d9c
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call edi
test eax, eax
jne 0x1005233
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x1001d90
push dword [ebp - 0x218]
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100521b
lea eax, [ebp - 0x220]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x218]
call edi
test eax, eax
jne 0x100521b
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x1001d88
push dword [ebp - 0x220]
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100520f
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x1001d78
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
call fcn.01005cac
mov dword [ebp - 0x214], 1
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x214], ebx
jne 0x1005373
lea eax, [ebp - 0x218]
push eax
push 1
push ebx
push 0x1001d4c
push 0x80000001
mov byte [ebp - 0x20c], bl
call edi
test eax, eax
jne 0x1005373
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
push ebx
push 0x1001d90
push dword [ebp - 0x218]
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005340
lea eax, [ebp - 0x220]
push eax
push 1
push ebx
push 0x1001d20
push 0x80000001
call edi
test eax, eax
jne 0x1005340
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push 0x1001d0c
push dword [ebp - 0x220]
mov dword [ebp - 0x210], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1005334
lea eax, [ebp - 0x108]
push eax
call fcn.01005c21
test eax, eax
je 0x1005334
push 0x1001d04
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005cac
lea eax, [ebp - 0x20c]
push eax
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005cac
push 0x1001d78
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.01005cac
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x21c]
mov dword [ebp - 0x214], 1
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1005373
push dword [0x10091a4]
push dword [0x10091a0]
push 0x80000001
push dword [ebp + 0xc]
push dword [ebp - 0x21c]
call fcn.01004e0d
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x214]
pop edi
pop esi
pop ebx
call fcn.01005857
leave
ret 8