Function at 0x10030ef1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x1065e7ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x1a
pop ecx
mov dword [ebp - 0x12c], eax
lea edi, [ebp - 0xb4]
lea eax, [ebp - 0x138]
mov esi, str.SoftwareMicrosoftOfficeCommonGraphicsBlocklist
push eax
push 0x20019
push 0
lea eax, [ebp - 0xb4]
push eax
rep movsd dword es:[edi], dword [esi]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10030f9d
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 4
push eax
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x148]
push eax
push 0x10
push str.DisableBlocklist
push 0
push dword [ebp - 0x138]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push dword [ebp - 0x138]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10030f9d
cmp dword [ebp - 0x134], 1
jne 0x10030f9d
xor al, al
jmp 0x10031898
push 0x1c
pop ecx
mov esi, str.SoftwareMicrosoftOffice16.0CommonGraphicsBlocklist
lea edi, [ebp - 0x128]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x13c]
push eax
push 0x20019
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x128]
xor esi, esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10031088
push dword [ebx + 0x10c]
lea eax, [ebp - 0x4c]
push dword [ebx + 0x108]
push dword [ebx + 0x104]
push dword [ebx + 0x100]
push str._08X__08X__08X__08X
push eax
call fcn.100309fb
add esp, 0x18
mov dword [ebp - 0x130], esi
lea eax, [ebp - 0x134]
mov dword [ebp - 0x134], 8
push eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x130]
push eax
push esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x13c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x13c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x10031088
cmp dword [ebp - 0x130], 0xb
jne 0x10030f96
mov ecx, dword [ebp - 0x144]
mov eax, ecx
mov edx, dword [ebp - 0x140]
or eax, edx
je case.0x1003181d.29328
mov eax, dword [ebp - 0x12c]
cmp edx, dword [eax + 4]
jl 0x10030f96
jg case.0x1003181d.29328
cmp ecx, dword [eax]
jbe 0x10030f96
mov al, 1
jmp 0x10031898
mov eax, dword [ebx + 0x100]
cmp eax, 0x1002
je 0x1003134f
cmp eax, 0x10de
je 0x100310b6
mov esi, dword [ebp - 0x12c]
cmp eax, 0x8086
jne 0x1003188c
jmp 0x1003187d
mov eax, dword [ebx + 0x104]
cmp eax, 0x222
ja 0x10031209
cmp eax, 0x221
jae case.0x1003181d.29328
cmp eax, 0xf6
ja 0x1003117a
cmp eax, 0xf1
jae case.0x1003181d.29328
cmp eax, 0x99
ja 0x1003112e
cmp eax, 0x98
jae case.0x1003181d.29328
cmp eax, 0x40
jb case.0x1003181d.29330
cmp eax, 0x48
jbe case.0x1003181d.29328
cmp eax, 0x4c
jbe case.0x1003181d.29330
cmp eax, 0x4e
jbe case.0x1003181d.29328
cmp eax, 0x8f
jbe case.0x1003181d.29330
cmp eax, 0x93
jbe case.0x1003181d.29328
cmp eax, 0x95
jmp 0x10031871
cmp eax, 0x9d
je case.0x1003181d.29328
cmp eax, 0xbf
jbe case.0x1003181d.29330
cmp eax, 0xc3
jbe case.0x1003181d.29328
cmp eax, 0xc7
jbe case.0x1003181d.29330
cmp eax, 0xc9
jbe case.0x1003181d.29328
cmp eax, 0xcb
jbe case.0x1003181d.29330
cmp eax, 0xce
jmp 0x10031444
cmp eax, 0x1df
ja 0x100311de
cmp eax, 0x1d0
jae case.0x1003181d.29328
cmp eax, 0x14f
ja 0x100311c9
cmp eax, 0x14c
jae case.0x1003181d.29328
cmp eax, 0xf8
jb case.0x1003181d.29330
cmp eax, 0xf9
jbe case.0x1003181d.29328
cmp eax, 0x13f
jbe case.0x1003181d.29330
cmp eax, 0x14a
jmp 0x10031444
cmp eax, 0x160
jb case.0x1003181d.29330
cmp eax, 0x16a
jmp 0x10031444
cmp eax, 0x211
jb case.0x1003181d.29330
cmp eax, 0x212
jbe case.0x1003181d.29328
cmp eax, 0x215
je case.0x1003181d.29328
cmp eax, 0x218
jmp 0x10031871
mov ecx, 0x39e
cmp eax, ecx
ja 0x100312c6
je case.0x1003181d.29328
cmp eax, 0x29f
ja 0x1003127a
cmp eax, 0x297
jae case.0x1003181d.29328
cmp eax, 0x240
jb case.0x1003181d.29330
cmp eax, 0x242
jbe case.0x1003181d.29328
cmp eax, 0x243
jbe case.0x1003181d.29330
cmp eax, 0x245
jbe case.0x1003181d.29328
cmp eax, 0x247
je case.0x1003181d.29328
cmp eax, 0x28f
jbe case.0x1003181d.29330
cmp eax, 0x295
jmp 0x10031444
cmp eax, 0x2e0
jb case.0x1003181d.29330
cmp eax, 0x2e4
jbe case.0x1003181d.29328
cmp eax, 0x38b
je case.0x1003181d.29328
cmp eax, 0x38f
jbe case.0x1003181d.29330
cmp eax, 0x395
jbe case.0x1003181d.29328
cmp eax, 0x396
jbe case.0x1003181d.29330
cmp eax, 0x39c
jmp 0x10031444
cmp eax, 0x53b
ja 0x10031324
cmp eax, 0x53a
jae case.0x1003181d.29328
cmp eax, 0x3d0
jb case.0x1003181d.29330
cmp eax, 0x3d2
jbe case.0x1003181d.29328
cmp eax, 0x3d4
jbe case.0x1003181d.29330
cmp eax, 0x3d6
jbe case.0x1003181d.29328
cmp eax, 0x52f
jbe case.0x1003181d.29330
cmp eax, 0x531
jbe case.0x1003181d.29328
cmp eax, 0x533
jmp 0x10031871
cmp eax, 0x53e
je case.0x1003181d.29328
cmp eax, 0x7df
jbe case.0x1003181d.29330
cmp eax, 0x7e3
jbe case.0x1003181d.29328
cmp eax, 0x7e5
jmp 0x10031871
mov eax, dword [ebx + 0x104]
cmp eax, 0x7105
ja 0x1003172a
cmp eax, 0x7104
jae case.0x1003181d.29328
cmp eax, 0x5571
ja 0x10031586
cmp eax, 0x5568
jae case.0x1003181d.29328
mov ecx, 0x4a54
cmp eax, ecx
ja 0x1003148d
je case.0x1003181d.29328
mov ecx, 0x3e74
cmp eax, ecx
ja 0x10031404
je case.0x1003181d.29328
mov ecx, 0x3175
cmp eax, ecx
ja 0x100313e8
je case.0x1003181d.29328
cmp eax, 0x3150
jb case.0x1003181d.29330
cmp eax, 0x3152
jbe case.0x1003181d.29328
cmp eax, 0x3153
jbe case.0x1003181d.29330
cmp eax, 0x3155
jbe case.0x1003181d.29328
cmp eax, 0x3171
jmp 0x10031871
sub eax, 0x3e50
je case.0x1003181d.29328
sub eax, 4
je case.0x1003181d.29328
sub eax, 0x1c
jmp 0x10031871
mov ecx, 0x4164
cmp eax, ecx
ja 0x1003144f
je case.0x1003181d.29328
cmp eax, 0x4144
je case.0x1003181d.29328
cmp eax, 0x4145
jbe case.0x1003181d.29330
cmp eax, 0x4149
jbe case.0x1003181d.29328
cmp eax, 0x414f
jbe case.0x1003181d.29330
cmp eax, 0x4155
jbe case.0x1003181d.29328
jmp case.0x1003181d.29330
cmp eax, 0x4166
jb case.0x1003181d.29330
cmp eax, 0x4169
jbe case.0x1003181d.29328
cmp eax, 0x416f
jbe case.0x1003181d.29330
cmp eax, 0x4175
jbe case.0x1003181d.29328
cmp eax, 0x4a47
jbe case.0x1003181d.29330
cmp eax, 0x4a50
jmp 0x10031444
mov ecx, 0x4e54
cmp eax, ecx
ja 0x10031529
je case.0x1003181d.29328
cmp eax, 0x4b4c
ja 0x100314e8
cmp eax, 0x4b49
jae case.0x1003181d.29328
cmp eax, 0x4a68
jb case.0x1003181d.29330
cmp eax, 0x4a6d
jbe case.0x1003181d.29328
cmp eax, 0x4a6e
jbe case.0x1003181d.29330
cmp eax, 0x4a70
jbe case.0x1003181d.29328
cmp eax, 0x4a74
jmp 0x10031871
cmp eax, 0x4b69
jb case.0x1003181d.29330
cmp eax, 0x4b6c
jbe case.0x1003181d.29328
cmp eax, 0x4e43
jbe case.0x1003181d.29330
cmp eax, 0x4e4b
jbe case.0x1003181d.29328
cmp eax, 0x4e4f
jbe case.0x1003181d.29330
cmp eax, 0x4e52
jmp 0x10031444
cmp eax, 0x5462
ja 0x10031566
cmp eax, 0x5460
jae case.0x1003181d.29328
cmp eax, 0x4e56
je case.0x1003181d.29328
cmp eax, 0x4e63
jbe case.0x1003181d.29330
cmp eax, 0x4e6b
jbe case.0x1003181d.29328
cmp eax, 0x4e71
jmp 0x10031871
cmp eax, 0x5464
je case.0x1003181d.29328
cmp eax, 0x5547
jbe case.0x1003181d.29330
cmp eax, 0x5551
jmp 0x10031444
cmp eax, 0x5d4d
ja 0x100316a2
cmp eax, 0x5d4c
jae case.0x1003181d.29328
mov ecx, 0x5874
cmp eax, ecx
ja 0x1003160e
je case.0x1003181d.29328
mov ecx, 0x5657
cmp eax, ecx
ja 0x100315f0
je case.0x1003181d.29328
cmp eax, 0x564a
jb case.0x1003181d.29330
cmp eax, 0x564b
jbe case.0x1003181d.29328
cmp eax, 0x564f
je case.0x1003181d.29328
cmp eax, 0x5651
jbe case.0x1003181d.29330
cmp eax, 0x5653
jmp 0x10031444
sub eax, 0x5673
je case.0x1003181d.29328
sub eax, 4
je case.0x1003181d.29328
sub eax, 0x1dd
jmp 0x10031871
cmp eax, 0x5a63
ja 0x10031661
cmp eax, 0x5a61
jae case.0x1003181d.29328
cmp eax, 0x5954
jb case.0x1003181d.29330
cmp eax, 0x5955
jbe case.0x1003181d.29328
cmp eax, 0x5973
jbe case.0x1003181d.29330
cmp eax, 0x5975
jbe case.0x1003181d.29328
cmp eax, 0x5a40
jbe case.0x1003181d.29330
cmp eax, 0x5a43
jmp 0x10031444
cmp eax, 0x5b60
jb case.0x1003181d.29330
cmp eax, 0x5b66
jbe case.0x1003181d.29328
cmp eax, 0x5b6f
jbe case.0x1003181d.29330
cmp eax, 0x5b76
jbe case.0x1003181d.29328
cmp eax, 0x5d47
jbe case.0x1003181d.29330
cmp eax, 0x5d4a
jmp 0x10031444
mov ecx, 0x5e48
cmp eax, ecx
ja 0x100316cd
je case.0x1003181d.29328
sub eax, 0x5d4f
cmp eax, 0x28
ja case.0x1003181d.29330
movzx eax, byte [eax + 0x100318b3]
jmp dword [eax*4 + 0x100318ab]
cmp eax, 0x5e6d
ja 0x1003170a
cmp eax, 0x5e6a
jae case.0x1003181d.29328
cmp eax, 0x5e4a
jb case.0x1003181d.29330
cmp eax, 0x5e4d
jbe case.0x1003181d.29328
cmp eax, 0x5e4f
je case.0x1003181d.29328
cmp eax, 0x5e68
jmp 0x10031871
cmp eax, 0x5e6f
je case.0x1003181d.29328
cmp eax, 0x70ff
jbe case.0x1003181d.29330
cmp eax, 0x7102
jmp 0x10031444
mov ecx, 0x71d2
cmp eax, ecx
ja 0x10031757
je case.0x1003181d.29328
sub eax, 0x7108
cmp eax, 0xc6
ja case.0x1003181d.29330
movzx eax, byte [eax + 0x100318e7]
jmp dword [eax*4 + 0x100318df]
mov ecx, 0x728b
cmp eax, ecx
ja 0x100317fd
je case.0x1003181d.29328
mov ecx, 0x71fa
cmp eax, ecx
ja 0x10031795
je case.0x1003181d.29328
sub eax, 0x71d4
cmp eax, 0x1e
ja case.0x1003181d.29330
movzx eax, byte [eax + 0x100319b7]
jmp dword [eax*4 + 0x100319af]
cmp eax, 0x726f
ja 0x100317d2
cmp eax, 0x7263
jae case.0x1003181d.29328
cmp eax, 0x7240
je case.0x1003181d.29328
cmp eax, 0x7242
jbe case.0x1003181d.29330
cmp eax, 0x724f
jbe case.0x1003181d.29328
cmp eax, 0x7260
jmp 0x10031871
cmp eax, 0x7280
je case.0x1003181d.29328
cmp eax, 0x7284
je case.0x1003181d.29328
cmp eax, 0x7287
jbe case.0x1003181d.29330
cmp eax, 0x7289
jmp 0x10031444
mov ecx, 0x72b3
cmp eax, ecx
ja 0x10031824
je case.0x1003181d.29328
sub eax, 0x7290
cmp eax, 0x21
ja case.0x1003181d.29330
movzx eax, byte [eax + 0x100319df]
jmp dword [eax*4 + 0x100319d7]
cmp eax, 0x7942
ja 0x1003185a
cmp eax, 0x7941
jae case.0x1003181d.29328
cmp eax, 0x72b7
je case.0x1003181d.29328
cmp eax, 0x791d
jbe case.0x1003181d.29330
cmp eax, 0x791f
jbe case.0x1003181d.29328
cmp eax, 0x793f
jmp 0x10031871
cmp eax, 0x796e
jb case.0x1003181d.29330
cmp eax, 0x796f
jbe case.0x1003181d.29328
cmp eax, 0x958d
je case.0x1003181d.29328
mov esi, dword [ebp - 0x12c]
push esi
push ebx
call fcn.10031d23
test al, al
jne case.0x1003181d.29328
push esi
push ebx
call fcn.10031a01
test al, al
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.102790a9
mov esp, ebp
pop ebp
ret 8