Function at 0x101486d
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1017caa
call sub.MSVCRT.dll__EH_prolog
sub esp, 0xa0
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_LoadCursorA]
xor ebx, ebx
push 0x7f02
push ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], ebx
call edi
mov esi, dword [sym.imp.USER32.dll_SetCursor]
push eax
call esi
push 1
mov dword [ebp - 0x84], ebx
pop eax
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
mov dword [ebp - 0x74], ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x10148fc
push 0x7f00
push ebx
call edi
push eax
call esi
jmp 0x1014b63
lea eax, [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0x1c]
push ebx
push eax
push ebx
mov dword [ebp - 0x10], ebx
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call edi
mov esi, eax
cmp esi, ebx
je 0x1014937
cmp esi, 0x7a
je 0x1014937
cmp esi, 2
je 0x1014940
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x1014b65
cmp esi, 2
jne 0x1014b76
push 0x14
call sub.MFC42.DLL_operatornew
pop ecx
mov dword [ebp + 0x1c], eax
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x101495d
mov ecx, eax
call fcn.01014c1e
mov esi, eax
jmp 0x101495f
xor esi, esi
or dword [ebp - 4], 0xffffffff
push ebx
mov ecx, esi
mov dword [ebp - 0x20], esi
call fcn.01014d2f
mov edi, eax
cmp edi, ebx
jge 0x10149b5
cmp esi, ebx
je 0x1014986
mov ecx, esi
call fcn.01014c31
push esi
call sub.MFC42.DLL_operatordelete
pop ecx
push 0x1001fb0
lea ecx, [ebp + 0x10]
call fcn.01016118
lea eax, [ebp + 0x10]
push edi
push eax
mov dword [ebp - 4], 1
call fcn.01015db9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call sub.MFC42.DLL_CString::CString
jmp 0x1014b63
push 1
push 0x1001fa8
mov ecx, esi
call fcn.01014f4c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push 0x1002d68
push dword [ebp + 0x10]
call edi
test eax, eax
je 0x10149e5
push 0x10036c4
push dword [ebp + 0x10]
call edi
test eax, eax
jne 0x1014a01
push 1
push 0x1003700
mov ecx, esi
call fcn.01014f4c
push 1
push 0x10036f4
mov ecx, esi
call fcn.01014f4c
push 0x1002b94
push dword [ebp + 0x10]
call edi
test eax, eax
je 0x1014a1d
push 0x1001f90
push dword [ebp + 0x10]
call edi
test eax, eax
jne 0x1014a32
lea eax, [ebp - 0x18]
push eax
call fcn.01015174
push 1
mov ecx, esi
push dword [ebp - 0x18]
call fcn.01014f1a
mov esi, dword [esi]
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x14]
push 8
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0xac]
rep stosd dword es:[edi], eax
lea edi, [ebp - 0x38]
push 0xa
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, 0x20019
pop ecx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], eax
xor eax, eax
lea edi, [ebp - 0x6c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x44]
mov dword [ebp - 0x68], eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0xac]
mov dword [ebp - 0x5c], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x8c]
mov dword [ebp - 0xac], 0x1004e4c
mov dword [ebp - 0x34], 0x20006
mov dword [ebp - 0x2c], 0xf003f
mov byte [ebp - 0x6c], 1
mov byte [ebp - 0x6b], 1
mov byte [ebp - 0x6a], bl
mov byte [ebp - 0x69], bl
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], 0x1004e48
call sub.MFC42.DLL_AfxGetModuleState
mov edi, dword [eax + 8]
call fcn.01008df1
cmp eax, ebx
jne 0x1014af4
xor eax, eax
jmp 0x1014af7
mov eax, dword [eax + 0x20]
lea ecx, [ebp - 0x10]
push ebx
push ecx
push ebx
push ebx
lea ecx, [ebp - 0x28]
push esi
push ecx
push 0x10147c9
lea ecx, [ebp - 0x44]
push dword [ebp + 0x14]
push ecx
lea ecx, [ebp - 0x6c]
push ecx
push ebx
push edi
push eax
call dword [0x101b8b0]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [sym.imp.MSVCRT.dll_free]
push esi
call edi
mov esi, dword [ebp - 0x20]
pop ecx
cmp esi, ebx
je 0x1014b4a
cmp dword [esi], ebx
je 0x1014b3c
mov dword [esi], ebx
mov ecx, esi
call fcn.01014c31
push esi
call sub.MFC42.DLL_operatordelete
pop ecx
cmp dword [ebp - 0x18], ebx
je 0x1014b55
push dword [ebp - 0x18]
call edi
pop ecx
push 1
pop eax
cmp dword [ebp - 0x10], eax
je 0x1014b65
cmp dword [ebp - 0x10], 3
je 0x1014b65
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x1c
push dword [ebp - 0x10]
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebx
je 0x1014b63
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call edi
cmp eax, ebx
je 0x1014a34
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.MSVCRT.dll_free]
pop ecx
jmp 0x1014b63