Function at 0x1000dd30
Capabilities:
Query or enumerate registry value

Disassembly:
mov al, byte [str.]
sub esp, 0x344
cmp al, 0x2a
push esi
push edi
jne 0x1000e09d
mov ecx, 0x23
xor eax, eax
lea edi, [esp + 0x38]
mov dword [esp + 0x30], 0x94
mov dword [esp + 0x34], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x40]
mov dword [0x1004cccc], eax
dec eax
je 0x1000ddb4
dec eax
jne 0x1000de58
lea ecx, [esp + 0xc4]
push ecx
push 0x10041000
push 0x10041004
call fcn.1000dc10
mov edx, dword [str.NT_s]
mov ax, word [0x1004100c]
add esp, 0xc
mov dword [esp + 0x10], edx
mov word [esp + 0x14], ax
jmp 0x1000de58
lea ecx, [esp + 0xc4]
push ecx
push 0x10041010
push 0x10041014
call fcn.1000dc10
mov edx, dword [str.9X_s]
mov ax, word [0x1004101c]
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], edx
mov word [esp + 0x14], ax
push ecx
push 0x20019
push 0
push 0x10041020
push reloc.WS2_32.dll_bind
mov dword [esp + 0x30], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x1c]
lea eax, [esp + 0x248]
push edx
push eax
push 0
push 0
push str.VersionNumber
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x38]
push eax
lea edx, [esp + 0x38]
push ecx
push edx
lea eax, [esp + 0x254]
push str._d._d._d
push eax
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0x14
lea edi, [esp + 0xc4]
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
mov ebx, dword [sym.imp.MSVCRT.dll_strchr]
dec ecx
push ebp
lea ebp, [esp + 0xcc]
mov byte [esp + ecx + 0xcd], al
mov al, byte [esp + 0xcc]
test al, al
je 0x1000df50
push 0x2c
push ebp
call ebx
add esp, 8
test eax, eax
je 0x1000dea5
push 0x2c
push ebp
call ebx
add esp, 8
mov byte [eax], 0
lea ecx, [esp + 0x18]
push ebp
lea edx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x34]
push eax
push str.MAJOR
push ecx
call fcn.1000dca0
add esp, 0x18
test eax, eax
je 0x1000dedd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
cmp edx, eax
jb 0x1000df10
lea eax, [esp + 0x10]
lea ecx, [esp + 0x28]
push eax
push str.MINOR
push ecx
call fcn.1000dca0
add esp, 0xc
test eax, eax
je 0x1000df04
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
cmp edx, eax
jb 0x1000df10
push 0x2e
push ebp
call ebx
add esp, 8
test eax, eax
je 0x1000df2e
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ebp, [ecx + ebp + 1]
test al, al
jne 0x1000de8e
jmp 0x1000df50
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp], 0
je 0x1000e087
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ebp, [ecx + ebp + 1]
test al, al
je 0x1000e070
push 0x2c
push ebp
call ebx
add esp, 8
test eax, eax
je 0x1000df8d
push 0x2c
push ebp
call ebx
add esp, 8
mov byte [eax], 0
mov edi, str.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.
push ebp
call dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x1000e02a
mov edi, str.
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebp], 0x2e
jne 0x1000e02a
lea ecx, [esp + 0x18]
push ebp
lea edx, [esp + 0x2c]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x1dc]
lea ecx, [esp + 0x34]
push eax
push 0x10041078
push ecx
call fcn.1000dc10
add esp, 0x18
test eax, eax
je 0x1000e048
lea esi, [esp + 0x4c]
lea eax, [esp + 0x1d0]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x1000e021
test cl, cl
je 0x1000e01d
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x1000e021
add eax, 2
add esi, 2
test cl, cl
jne 0x1000dffd
xor eax, eax
jmp 0x1000e026
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000e048
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov al, byte [ecx + ebp + 1]
lea ebp, [ecx + ebp + 1]
test al, al
jne 0x1000df76
jmp 0x1000e06a
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp byte [ebp], 0
jne 0x1000e087
mov edi, str.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov cx, word [0x1004107c]
mov word [edi - 1], cx
mov al, byte [str.]
pop ebp
cmp al, 0x2a
pop ebx
jne 0x1000e09d
pop edi
xor eax, eax
pop esi
add esp, 0x344
ret
mov edx, dword [esp + 0x350]
test edx, edx
je 0x1000e0ca
mov edi, str.
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x1004cccc]
pop edi
pop esi
add esp, 0x344
ret