Function at 0x10b32500
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x614
push ebx
push ebp
push esi
push edi
xor edi, edi
push 0x7f02
push edi
mov dword [esp + 0x20], edi
call dword [sym.imp.USER32.dll_LoadCursorA]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
lea edx, [esp + 0xa0]
lea ecx, [esp + 0x1a0]
mov esi, dword [esp + 0x628]
mov dword [esp + 0x28], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov dword [eax + 0x14], edx
lea edx, [esp + 0x4c]
mov dword [eax + 0xc], ecx
mov dword [eax + 0x10], edx
lea ecx, [esp + 0x424]
lea edx, [esp + 0x14]
mov dword [eax + 0x1c], ecx
push edx
lea ecx, [esp + 0x2a4]
push 0x10dee304
push Ordinal_2
mov dword [eax + 0x18], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10b32c04
cmp dword [esp + 0x638], 2
je 0x10b3259b
mov eax, dword [esi]
push edi
push edi
push 0x184
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [esp + 0x1c], edi
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov eax, ecx
inc ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x4c]
push 0x28
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0xea
je 0x10b3259f
test eax, eax
jne 0x10b32c04
lea edi, [esp + 0x4c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x638]
not ecx
dec ecx
cmp eax, 1
mov esi, ecx
jne 0x10b3260e
call fcn.10bd19f0
test eax, eax
lea ebx, [esp + esi + 0x4c]
je 0x10b32607
push 0x10dee30c
push ebx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b32699
mov edi, 0x10dee318
jmp 0x10b3267c
cmp eax, 2
jne 0x10b32650
call fcn.10bd19f0
test eax, eax
lea ebx, [esp + esi + 0x4c]
je 0x10b32631
push 0x10dee324
push ebx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b32699
mov edi, 0x10dee330
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x10b32694
cmp eax, 3
jne 0x10b32bf4
call fcn.10bd19f0
test eax, eax
lea ebx, [esp + esi + 0x4c]
je 0x10b32677
push 0x10dee33c
push ebx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b32699
mov edi, str.Programmable
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x50]
push edx
push eax
push ecx
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10b326d5
mov edx, dword [esp + 0x10]
test eax, eax
mov byte [esp + edx + 0xa0], al
je 0x10b328fe
cmp dword [esp + 0x638], 3
jne 0x10b3259f
call fcn.10bd19f0
test eax, eax
je 0x10b326fd
push 0x10dee35c
push ebx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b3271f
mov edi, str.Insertable
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x50]
push edx
mov esi, 0x100
push eax
push ecx
mov dword [esp + 0x20], esi
call ebp
test eax, eax
jne 0x10b3275e
mov edx, dword [esp + 0x10]
test eax, eax
mov byte [esp + edx + 0xa0], al
je 0x10b3259f
lea eax, [esp + 0x10]
lea ecx, [esp + 0xa0]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x50]
push ecx
push edx
push eax
mov byte [ebx], 0
mov dword [esp + 0x20], esi
call ebp
test eax, eax
mov ecx, dword [esp + 0x10]
jne 0x10b3278e
mov byte [esp + ecx + 0xa0], 0
test eax, eax
jne 0x10b3259f
cmp ecx, 1
jbe 0x10b3259f
mov dword [esp + 0x10], esi
call fcn.10bd19f0
test eax, eax
je 0x10b327bd
push 0x10dee374
push ebx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b327df
mov edi, 0x10dee384
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0xa0]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x50]
push ecx
push edx
push eax
call ebp
test eax, eax
jne 0x10b3259f
mov ecx, dword [esp + 0x10]
test eax, eax
mov byte [esp + ecx + 0xa0], al
jne 0x10b3259f
lea edi, [esp + 0xa0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x10b3259f
mov ecx, 5
mov esi, str._automation_Automation
lea edi, [esp + 0x88]
xor ebp, ebp
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xa0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x9f], 0
lea edx, [esp + ecx + 0xa0]
mov dword [esp + 0x24], edx
call fcn.10bd19f0
test eax, eax
push 0x2f
je 0x10b3287d
lea eax, [esp + 0xa4]
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
jmp 0x10b3288b
lea ecx, [esp + 0xa4]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
mov edi, dword [sym.imp.MSVCRT.dll_strncmp]
add esp, 8
mov esi, eax
test esi, esi
je 0x10b328f6
cmp esi, dword [esp + 0x24]
jae 0x10b328f6
lea edx, [esp + 0x88]
push 0xb
push edx
push esi
call edi
mov ebp, eax
add esp, 0xc
neg ebp
sbb ebp, ebp
inc ebp
jne 0x10b328d0
lea eax, [esp + 0x93]
push 0xb
push eax
push esi
call edi
mov ebp, eax
add esp, 0xc
neg ebp
sbb ebp, ebp
inc ebp
call fcn.10bd19f0
test eax, eax
push 0x2f
je 0x10b328e5
inc esi
push esi
call dword [sym.imp.MSVCRT.dll__mbschr]
jmp 0x10b328ed
inc esi
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
add esp, 8
mov esi, eax
test ebp, ebp
je 0x10b32896
test ebp, ebp
je 0x10b3259f
lea ecx, [esp + 0x10]
lea edx, [esp + 0xa0]
push ecx
mov ecx, dword [esp + 0x18]
lea eax, [esp + 0x50]
push edx
push eax
push ecx
mov byte [ebx], 0
mov dword [esp + 0x20], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x10b3259f
mov edx, dword [esp + 0x10]
test eax, eax
mov byte [esp + edx + 0xa0], al
jne 0x10b3259f
lea eax, [esp + 0x4c]
push 0x3c
lea ecx, [esp + 0x2a4]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_mbstowcs]
add esp, 0xc
call fcn.10bd19f0
test eax, eax
je 0x10b32973
push 0x10dee3ac
push ebx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b32995
mov edi, str.LocalServer32
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1a0]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x50]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0x100
call ebp
test eax, eax
jne 0x10b329cf
mov ecx, dword [esp + 0x10]
test eax, eax
mov byte [esp + ecx + 0x1a0], al
je 0x10b32a47
call fcn.10bd19f0
test eax, eax
je 0x10b329e9
push 0x10dee3cc
push ebx
call dword [sym.imp.MSVCRT.dll__mbscpy]
add esp, 8
jmp 0x10b32a0b
mov edi, 0x10dee3dc
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x1a0]
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x50]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0x100
call ebp
test eax, eax
jne 0x10b3259f
mov ecx, dword [esp + 0x10]
test eax, eax
mov byte [esp + ecx + 0x1a0], al
jne 0x10b3259f
lea edx, [esp + 0x1a0]
push 0x100
lea eax, [esp + 0x428]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_mbstowcs]
lea edi, [esp + 0x1ac]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 0x4000
mov esi, ecx
lea ecx, [esp + 0x31c]
lea edx, [esp + 0x1a4]
push ecx
push edx
call sym.PBVM90.dll_osOpenFile
test esi, esi
mov ebx, eax
jbe 0x10b32aff
mov edi, dword [sym.imp.MSVCRT.dll_isspace]
cmp ebx, 0xffffffff
jne 0x10b32b08
xor eax, eax
mov al, byte [esp + esi + 0x1a0]
push eax
call edi
add esp, 4
test eax, eax
je 0x10b32afa
test esi, esi
jbe 0x10b32aff
xor ecx, ecx
mov cl, byte [esp + esi + 0x1a0]
push ecx
call edi
add esp, 4
test eax, eax
je 0x10b32ad8
mov byte [esp + esi + 0x1a0], 0
dec esi
jne 0x10b32aba
test esi, esi
jbe 0x10b32aff
lea edx, [esp + 0x318]
push 0x4000
lea eax, [esp + 0x1a4]
push edx
push eax
call sym.PBVM90.dll_osOpenFile
mov ebx, eax
jmp 0x10b32afb
dec esi
test esi, esi
ja 0x10b32a9e
cmp ebx, 0xffffffff
je 0x10b3259f
mov edi, dword [esp + 0x62c]
xor esi, esi
test edi, edi
jne 0x10b32b20
mov eax, dword [esp + 0x634]
test eax, eax
je 0x10b32b33
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x2a0]
push ecx
push edx
call dword [sym.imp.ole32.dll_CLSIDFromString]
xor eax, eax
test edi, edi
jbe 0x10b32b8a
mov ebp, dword [esp + 0x630]
test esi, esi
jne 0x10b3259f
mov ecx, ebp
lea edi, [esp + 0x3c]
lea esi, [esp + 0x2c]
mov edx, dword [ecx]
mov dword [esp + 0x3c], edx
mov edx, dword [ecx + 4]
mov dword [esp + 0x40], edx
mov edx, dword [ecx + 8]
mov dword [esp + 0x44], edx
xor edx, edx
mov ecx, dword [ecx + 0xc]
mov dword [esp + 0x48], ecx
mov ecx, 0x10
repe cmpsb byte [esi], byte es:[edi]
mov ecx, dword [esp + 0x62c]
sete dl
inc eax
add ebp, 0x10
cmp eax, ecx
mov esi, edx
jb 0x10b32b40
test esi, esi
jne 0x10b3259f
mov eax, dword [esp + 0x634]
test eax, eax
je 0x10b32bc3
mov edx, dword [esp + 0x2c]
sub esp, 0x10
mov ecx, esp
push eax
mov dword [ecx], edx
mov edx, dword [esp + 0x44]
mov dword [ecx + 4], edx
mov edx, dword [esp + 0x48]
mov dword [ecx + 8], edx
mov edx, dword [esp + 0x4c]
mov dword [ecx + 0xc], edx
call fcn.10b36a50
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
push eax
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x62c]
mov edx, dword [eax]
push edx
call dword [eax + 8]
cmp eax, dword [esp + 0x18]
jle 0x10b32beb
mov dword [esp + 0x18], eax
jmp 0x10b3259f
test eax, eax
jl 0x10b32c04
jmp 0x10b3259f
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x614
ret 0x14
mov eax, dword [esp + 0x28]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [esp + 0x10]
pop ebp
pop ebx
add esp, 0x614
ret 0x14