Function at 0x10023da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x424], 4
xor esi, esi
lea eax, [edi + 0x110]
test edx, edx
je 0x10023e12
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10023e04
lea eax, [edi + 0x110]
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023f00
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10023e45
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023f00
xor eax, eax
push 0x104
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x214]
push eax
push 0xb3b0
push dword [0x10043578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x214], si
jne 0x10023ea4
mov esi, dword [0x1004338c]
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10044350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x41c]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.1001a230
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x424]
push eax
lea ebx, [edi + 0xa8]
push ebx
lea eax, [ebp - 0x428]
push eax
push 0
push 0x10003a70
push dword [edi + 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10023f34
or esi, 0xffffffff
jmp 0x10023fe2
cmp dword [ebp - 0x428], 1
mov ecx, edi
jne 0x10023f7a
call fcn.100239a0
test ax, ax
je 0x10023f69
mov ecx, edi
call fcn.100239a0
cmp ax, 1
je 0x10023f69
push 1
mov edx, 0x10001c08
mov ecx, edi
call fcn.10022b80
or esi, 0xffffffff
jmp 0x10023fe2
cmp byte [ebx], 0x19
jne 0x10023fe2
mov ecx, edi
call fcn.10023490
movzx esi, ax
jmp 0x10023fe2
movzx edx, byte [ebx]
call fcn.10019ac0
cmp byte [ebx], 0x19
jne 0x10023fe2
mov ebx, dword [edi + 0x110]
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a7c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10023fc6
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a7c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023fd6
mov ecx, edi
call fcn.10023490
movzx esi, ax
jmp 0x10023fe2
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 0x110]
test eax, eax
je 0x10023ffd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x110], 0
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x10024018
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x10c], 0
mov ecx, dword [ebp - 8]
mov ax, si
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003bd00
mov esp, ebp
pop ebp
ret 4