Function at 0x1000d030
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
push edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], ecx
push eax
xor esi, esi
mov dword [ebp - 0x10], 0x80
push 1
push esi
push str.SYSTEMCurrentControlSetServicesmssmbiosData
push 0x80000002
xor edi, edi
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000d07c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push str.SMBiosData
push dword [ebp - 0x14]
call ebx
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000d0f7
cmp dword [ebp - 0xc], esi
je 0x1000d0ed
cmp dword [ebp - 0x20], 3
jne 0x1000d0ed
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x1000d0d3
mov ebx, 8
mov dword [ebp - 4], ebx
jmp 0x1000d100
lea eax, [ebp - 0xc]
push eax
push esi
push 0
push 0
push str.SMBiosData
push dword [ebp - 0x14]
call ebx
mov ebx, eax
mov dword [ebp - 4], ebx
jmp 0x1000d100
mov ebx, 0x3f2
mov dword [ebp - 4], ebx
jmp 0x1000d0fa
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x1000d22f
mov edx, dword [ebp - 8]
movzx esi, word [edx + 6]
movzx eax, word [edx + 4]
add esi, 8
add eax, 8
mov dword [ebp - 0x28], eax
cmp byte [esi + edx], 0x7f
je 0x1000d22c
nop
cmp esi, eax
jae 0x1000d229
movzx eax, byte [esi + edx + 1]
lea ecx, [edx + esi]
add esi, eax
mov dword [ebp - 0x30], ecx
mov ebx, 1
lea ebx, [ebx]
mov al, byte [ecx]
cmp al, 1
jne 0x1000d190
cmp dword [ebp - 0x18], 0
jne 0x1000d190
movzx eax, byte [ecx + 4]
cmp eax, ebx
je 0x1000d174
movzx eax, byte [ecx + 5]
cmp eax, ebx
je 0x1000d174
movzx eax, byte [ecx + 6]
cmp eax, ebx
jne 0x1000d1bd
lea edi, [esi + edx]
push str.System_manufacturer
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x1000d1bd
mov dword [ebp - 0x18], 1
jmp 0x1000d1fc
cmp al, 2
jne 0x1000d250
cmp dword [ebp - 0x18], 1
jne 0x1000d250
movzx eax, byte [ecx + 4]
cmp eax, ebx
je 0x1000d1ba
movzx eax, byte [ecx + 5]
cmp eax, ebx
je 0x1000d1ba
movzx eax, byte [ecx + 6]
cmp eax, ebx
jne 0x1000d1bd
lea edi, [esi + edx]
test edi, edi
je 0x1000d1fe
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000d1c6
sub ecx, edx
lea eax, [ecx + 1]
mov dword [ebp - 0x2c], eax
inc eax
cmp dword [ebp - 0x10], eax
jbe 0x1000d1f3
push edi
mov edi, dword [ebp - 0x24]
push 0x10071e88
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add edi, eax
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x10], eax
xor edi, edi
mov edx, dword [ebp - 8]
inc ebx
mov al, byte [esi + edx]
inc esi
test al, al
jne 0x1000d202
cmp byte [esi + edx], 0
mov eax, dword [ebp - 0x28]
je 0x1000d21e
mov ecx, dword [ebp - 0x30]
cmp esi, eax
jb 0x1000d150
inc esi
cmp byte [esi + edx], 0x7f
jne 0x1000d130
mov ebx, dword [ebp - 4]
mov esi, dword [ebp - 8]
test esi, esi
je 0x1000d23f
push esi
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x10]
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp al, 3
jne 0x1000d1bd
cmp ebx, 1
jne 0x1000d1bd
movzx eax, byte [ecx + 5]
add eax, 0xfffffffe
cmp eax, 0xc
ja case.0x1000d26d.5
jmp dword [eax*4 + 0x1000d2d8]
mov edi, str._Unknown_
jmp 0x1000d1c1
mov edi, str._Desktop_
jmp 0x1000d1c1
mov edi, str._Low_Profile_Desktop_
jmp 0x1000d1c1
mov edi, str._Mini_Tower_
jmp 0x1000d1c1
mov edi, str._Tower_
jmp 0x1000d1c1
mov edi, str._Portable_
jmp 0x1000d1c1
mov edi, str._Laptop_
jmp 0x1000d1c1
mov edi, str._Notebook_
jmp 0x1000d1c1
mov edi, str._Sub_Notebook_
jmp 0x1000d1c1
mov edi, str._Other_
jmp 0x1000d1c1