Function at 0x10002890
Capabilities:
Get hostname
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10014e60
mov eax, dword fs:[0]
push eax
sub esp, 0xa34
mov eax, dword [0x10024018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
lea edi, [esi + 0x10]
lea ebx, [esi + 0x18]
push 0x10016a04
lea ecx, [esi + 0x20]
mov dword [ebp - 0xa3c], eax
mov dword [esi + 0xc], 1
mov dword [edi], 0
mov dword [esi + 0x14], 0
mov dword [ebx], 0
mov dword [esi + 0x1c], 0
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
push edi
lea edi, [esi + 0x14]
call fcn.10002ed0
xor edi, edi
push 0x206
lea ecx, [ebp - 0x216]
push edi
push ecx
mov word [ebp - 0x218], di
call sub.MSVCR80.dll_memset
add esp, 0x10
lea edx, [ebp - 0xa34]
push edx
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0xa34], 0x104
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x10002954
lea ecx, [ebp - 0x218]
push ecx
lea ecx, [esi + 0x2c]
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
lea ecx, [ebp - 0xa28]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
lea ecx, [ebp - 0xa1c]
mov dword [ebp - 4], edi
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov byte [ebp - 4], 1
call sub.acdb17.dll_unsigned_long_int___cdecl_acrxProductLCID_void_
movzx eax, al
cmp eax, 4
lea ecx, [ebp - 0xa28]
je 0x100029a6
cmp eax, 9
je 0x10002992
push 0x10016a24
jmp 0x100029ab
push 0x10016a1c
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
mov dword [esi + 0x1c], 1
jmp 0x100029b1
push 0x10016a14
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
lea ecx, [ebp - 0xa24]
call dword [sym.imp.MFC80U.DLL_Ordinal_293]
mov byte [ebp - 4], 2
call sub.acdb17.dll_wchar_t_const____cdecl_acrxProductKey_void_
push eax
lea ecx, [ebp - 0xa24]
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
push edi
push 0x10016a2c
lea ecx, [ebp - 0xa24]
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
mov edi, eax
mov edx, edi
add edi, 1
test edx, edx
jl 0x10002a3b
push edi
push 0x10016a34
lea ecx, [ebp - 0xa24]
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
test eax, eax
jle 0x10002a3b
sub eax, edi
push eax
push edi
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xa24]
call dword [sym.imp.MFC80U.DLL_Ordinal_4101]
push eax
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 3
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov edx, dword [ebp - 0xa24]
lea ecx, [ebp - 0xa2c]
push ecx
push edx
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x10002bb0
lea eax, [ebp - 0xa38]
push eax
mov eax, dword [ebp - 0xa2c]
lea ecx, [ebp - 0xa18]
push ecx
lea edx, [ebp - 0xa40]
push edx
push 0
push 0x10016a38
push eax
mov dword [ebp - 0xa38], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10002b9f
cmp dword [ebp - 0xa40], 1
jne 0x10002b9f
lea ecx, [ebp - 0xa18]
push ecx
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
mov edi, dword [sym.imp.MSVCR80.dll__wcsnicmp]
push 7
lea edx, [ebp - 0xa18]
push str.AutoCAD
push edx
call edi
add esp, 0xc
test eax, eax
jne 0x10002aef
push 7
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_4100]
mov byte [ebp - 4], 4
jmp 0x10002b1f
push 5
lea ecx, [ebp - 0xa18]
push 0x10016a60
push ecx
call edi
add esp, 0xc
test eax, eax
jne 0x10002b3c
push 5
lea edx, [ebp - 0xa20]
push edx
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_4100]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
lea ecx, [ebp - 0xa20]
mov byte [ebp - 4], 2
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_6161]
push eax
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
push 0
push 0x10016a6c
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_2261]
test eax, eax
jle 0x10002bb0
push eax
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_3990]
push eax
lea ecx, [ebp - 0xa1c]
mov byte [ebp - 4], 6
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
lea ecx, [ebp - 0xa20]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
jmp 0x10002bb0
push 0x10016a70
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
lea ecx, [ebp - 0xa24]
mov byte [ebp - 4], 1
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [ebp - 0xa2c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebx], 0
mov eax, 0x10016a84
jne 0x10002bdc
mov eax, 0x10016aac
push eax
lea ecx, [ebp - 0xa30]
call dword [sym.imp.MFC80U.DLL_Ordinal_283]
mov byte [ebp - 4], 7
mov ecx, dword [ebx]
xor ecx, dword [esi + 0x14]
mov edx, dword [ebp - 0xa28]
mov eax, dword [ebp - 0xa1c]
neg ecx
push edx
mov edx, dword [ebp - 0xa30]
sbb ecx, ecx
push eax
and ecx, 0x20
add ecx, 0x20
push ecx
push edx
lea eax, [esi + 0x28]
push 0x10016a88
push eax
call dword [sym.imp.MFC80U.DLL_Ordinal_2311]
push esi
lea ecx, [esi + 4]
call fcn.10003160
mov ecx, dword [ebp - 0xa3c]
mov dword [ecx + 0x10], eax
add esp, 0x1c
lea ecx, [ebp - 0xa30]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
lea ecx, [ebp - 0xa1c]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
lea ecx, [ebp - 0xa28]
call dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012a8e
mov esp, ebp
pop ebp
ret 4