Function at 0x10023ab0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x290
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x14], 0
mov ax, word [0x10039c68]
mov word [ebp - 0x230], ax
push 0x206
push 0
lea ecx, [ebp - 0x22e]
push ecx
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x1c], 0x104
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x234], 0x3fff
mov dl, byte [0x10033426]
mov byte [ebp - 0x288], dl
push 0x3f
push 0
lea eax, [ebp - 0x287]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov ecx, dword [ebp + 0x10]
push ecx
push str.CheckRunKey___started:_wszSearchData_S
call fcn.10018570
add esp, 8
push 0x3fff
call fcn.10019ae0
add esp, 4
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
jne 0x10023b77
push str.SetRunKey__:_mem_alloc___wszValue_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
xor eax, eax
jmp 0x10023eaa
push 0x800
call fcn.10019ae0
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x10023ba8
push str.SetRunKey__:_mem_alloc___val_data_failed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call main
add esp, 8
xor eax, eax
jmp 0x10023eaa
push 0x40
push 0
lea edx, [ebp - 0x288]
push edx
call fcn.10019d20
add esp, 0xc
cmp dword [ebp + 8], 0x80000002
jne 0x10023bdc
push 0x40
push str.HKEY_LOCAL_MACHINE
lea eax, [ebp - 0x288]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0xc
jmp 0x10023c55
cmp dword [ebp + 8], reloc.WS2_32.dll_accept
jne 0x10023bfd
push 0x40
push str.HKEY_CURRENT_USER
lea ecx, [ebp - 0x288]
push ecx
call sub.msvcrt.dll_strncpy
add esp, 0xc
jmp 0x10023c55
cmp dword [ebp + 8], 0x80000000
jne 0x10023c1e
push 0x40
push str.HKEY_CLASSES_ROOT
lea edx, [ebp - 0x288]
push edx
call sub.msvcrt.dll_strncpy
add esp, 0xc
jmp 0x10023c55
cmp dword [ebp + 8], reloc.WS2_32.dll_closesocket
jne 0x10023c3f
push 0x40
push str.HKEY_USERS
lea eax, [ebp - 0x288]
push eax
call sub.msvcrt.dll_strncpy
add esp, 0xc
jmp 0x10023c55
push 0x40
push str._UNKNOWN_
lea ecx, [ebp - 0x288]
push ecx
call sub.msvcrt.dll_strncpy
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x10023ca1
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x288]
push eax
push str.CheckRunKey__:_RegOpenKeyEx___KEY_READ___s_S__failed
mov ecx, dword [ebp - 0x23c]
push ecx
call main
add esp, 0x10
jmp 0x10023e62
mov edx, dword [ebp - 0x14]
push edx
push str.CheckRunKey__:_1_hKey_p
call fcn.10018570
add esp, 8
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x28c]
push eax
lea ecx, [ebp - 0x290]
push ecx
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x230]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
je 0x10023d29
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x288]
push eax
push str.CheckRunKey__:_RegQueryInfoKey_____s_S__failed
mov ecx, dword [ebp - 0x23c]
push ecx
call main
add esp, 0x10
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10023e62
cmp dword [ebp - 0x290], 0
je 0x10023e51
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x23c], 0
jmp 0x10023d52
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x290]
jae 0x10023e51
push 0x800
push 0
mov edx, dword [ebp - 0x18]
push edx
call fcn.10019d20
add esp, 0xc
push 0x3fff
push 0
mov eax, dword [ebp - 0x238]
push eax
call fcn.10019d20
add esp, 0xc
mov dword [ebp - 0x234], 0x3fff
mov dword [ebp - 8], 0x800
xor ecx, ecx
mov edx, dword [ebp - 0x238]
mov word [edx], cx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
push 0
push 0
lea edx, [ebp - 0x234]
push edx
mov eax, dword [ebp - 0x238]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x10023e24
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10023e22
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x238]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x288]
push eax
push str.CheckRunKey__:_Value___s_S_S__is_already_set_i_u___S_
call fcn.10018570
add esp, 0x18
mov dword [ebp - 0x240], 1
jmp 0x10023e51
jmp 0x10023e4c
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x288]
push eax
push str.CheckRunKey__:_RegEnumValue_____s_S__failed_i_d
mov ecx, dword [ebp - 0x23c]
push ecx
call main
add esp, 0x14
jmp 0x10023d49
jmp 0x10023d49
mov edx, dword [ebp - 0x14]
push edx
push str.CheckRunKey__:_2_hKey_p
call fcn.10018570
add esp, 8
cmp dword [ebp - 0x14], 0
je 0x10023e72
mov eax, dword [ebp - 0x14]
push eax
call dword [0x10052318]
push 0x3fff
lea ecx, [ebp - 0x238]
push ecx
call fcn.10019b10
add esp, 8
push 0x800
lea edx, [ebp - 0x18]
push edx
call fcn.10019b10
add esp, 8
push str.CheckRunKey__:_finished
call fcn.10018570
add esp, 4
mov eax, dword [ebp - 0x240]
mov esp, ebp
pop ebp
ret