Function at 0x10001480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x10008030]
push ebx
push esi
push edi
mov ebx, 0x32
mov edi, 1
cmp eax, 0xffffffff
mov dword [esp + 0xc], ebx
mov dword [0x10008ef0], 0
mov dword [esp + 0x14], edi
jne 0x100014cf
push 0
push str.Fehler
push str.RegKey_wurde_nicht_in_der_Resource_definiert
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x210
ret
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push 0
push 0x10009778
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1000150f
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
call edi
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
jmp 0x100016c0
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push 0x10009fd8
push ecx
push 0
push 0x100097fc
push edx
call esi
test eax, eax
je 0x10001536
or dword [0x10008ef0], edi
mov edx, dword [esp + 0x10]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push 0x10008ff4
push ecx
push 0
mov edi, 0x200
push 0x10009528
push edx
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x1000156c
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
lea eax, [esp + 0x1c]
push str.Path
push eax
mov dword [esp + 0x14], edi
call fcn.10001a1f
add esp, 8
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push 0x10009bd8
push edx
push 0
push eax
push ecx
call esi
test eax, eax
je 0x100015af
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
lea edx, [esp + 0x1c]
push str.ResourceFile
push edx
mov dword [esp + 0x14], 0x40
call fcn.10001a1f
add esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push 0x10009a98
push ecx
push 0
push edx
push eax
call esi
test eax, eax
je 0x100015f6
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push 0x10009a64
push edx
push 0
push 0x100095fc
push eax
mov dword [esp + 0x24], ebx
call esi
test eax, eax
je 0x10001627
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push 0x10009dd8
push edx
push 0
push 0x10009830
push eax
mov dword [esp + 0x24], edi
call esi
test eax, eax
je 0x10001658
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push 0x10009744
push edx
push 0
push 0x100095d4
push eax
mov dword [esp + 0x24], ebx
call esi
test eax, eax
je 0x10001689
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push 0x100092f4
push edx
push 0
push 0x1000a038
push eax
mov dword [esp + 0x24], ebx
call esi
test eax, eax
je 0x100016ba
mov eax, dword [0x10008ef0]
or al, 1
mov dword [0x10008ef0], eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x10008030]
lea edx, [esp + 0x10]
push edx
push 0x20019
push 0
push 0x10008f74
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10001720
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [0x10008ef0]
pop edi
or al, 2
pop esi
mov dword [0x10008ef0], eax
mov dword [0x100095f8], 0x3c0000
mov dword [0x1000a194], 0
mov byte [0x1000a190], 1
pop ebx
add esp, 0x210
ret
mov eax, 4
lea edx, [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0x100095e4
push edx
call esi
test eax, eax
mov ebx, 2
je 0x10001759
or dword [0x10008ef0], ebx
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xc]
mov dword [0x100095f8], eax
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push 0x10009950
push ecx
call esi
test eax, eax
je 0x10001789
or dword [0x10008ef0], ebx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0xc]
mov dword [0x1000a194], edx
lea ecx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push 0x10009730
push eax
call esi
test eax, eax
je 0x100017ba
or dword [0x10008ef0], ebx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x10]
test ecx, ecx
setne cl
push edx
mov byte [0x1000a190], cl
call edi
mov eax, dword [0x10008ef0]
pop edi
pop esi
pop ebx
add esp, 0x210
ret