Function at 0x1002ebb
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push 0xf003f
push ebx
push 0x1001720
push ebx
push 0x10016e8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp - 0xc], 2
jne 0x10030b2
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push 4
pop edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x10016d0
push dword [ebp - 4]
mov dword [ebp - 0x10], edi
call esi
test eax, eax
jne 0x1002f23
push dword [ebp - 0x14]
call sub.NARRHOOK.dll_void___stdcall_SetTrackCaret_int_
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x10016b0
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1002f46
push dword [ebp - 0x10]
call sub.NARRHOOK.dll_void___stdcall_SetTrackInputFocus_int_
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x100169c
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1002f69
push dword [ebp - 0x10]
call sub.NARRHOOK.dll_void___stdcall_SetEchoChars_int_
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x100167c
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1002f8c
push dword [ebp - 0x10]
call sub.NARRHOOK.dll_void___stdcall_SetAnnounceWindow_int_
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x1001660
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1002faf
push dword [ebp - 0x10]
call sub.NARRHOOK.dll_void___stdcall_SetAnnounceMenu_int_
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x1001644
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1002fd2
push dword [ebp - 0x10]
call sub.NARRHOOK.dll_void___stdcall_SetAnnouncePopup_int_
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x1001620
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1002ff5
push dword [ebp - 0x10]
call sub.NARRHOOK.dll_void___stdcall_SetAnnounceToolTips_int_
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push 0x1001608
push dword [ebp - 4]
mov dword [ebp - 0x14], edi
call esi
test eax, eax
jne 0x1003018
push dword [ebp - 0x10]
call sub.NARRHOOK.dll_void___stdcall_SetReviewLevel_int_
lea eax, [ebp - 8]
push eax
push 0x10060d0
push ebx
push ebx
push 0x10015ec
push dword [ebp - 4]
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 8]
push eax
push 0x10060d8
push ebx
push ebx
push 0x10015d0
push dword [ebp - 4]
mov dword [ebp - 8], 2
call esi
lea eax, [ebp - 8]
push eax
push 0x10060e0
push ebx
push ebx
push 0x10015b4
push dword [ebp - 4]
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 8]
push eax
push 0x1006420
push ebx
push ebx
push 0x1001598
push dword [ebp - 4]
mov dword [ebp - 8], 0x200
call esi
lea eax, [ebp - 8]
push eax
push 0x1006640
push ebx
push ebx
push 0x1001584
push dword [ebp - 4]
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 8]
push eax
push 0x10060c4
push ebx
push ebx
push 0x100156c
push dword [ebp - 4]
mov dword [ebp - 8], edi
call esi
pop edi
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret