Function at 0x10023c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, ecx
lea ecx, [edx + edx + 0x26]
sub esp, 0xb8
mov dword [ebp - 0xac], ecx
mov dword [esp], ecx
mov dword [ebp - 0xa8], 0
call dword [sym.imp.ucrtbase.dll_malloc]
mov ecx, dword [ebp - 0xac]
mov edi, eax
mov eax, dword [str.PROTOCOLSHandler_]
sub ecx, 0x24
mov dword [edi], eax
mov eax, dword [0x1005fe04]
mov dword [edi + 4], eax
mov eax, dword [0x1005fe08]
mov dword [edi + 8], eax
mov eax, dword [0x1005fe0c]
mov dword [edi + 0xc], eax
mov eax, dword [0x1005fe10]
mov dword [edi + 0x10], eax
mov eax, dword [0x1005fe14]
mov dword [edi + 0x14], eax
mov eax, dword [0x1005fe18]
mov dword [edi + 0x18], eax
mov eax, dword [0x1005fe1c]
mov dword [edi + 0x1c], eax
mov eax, dword [0x1005fe20]
mov dword [edi + 0x20], eax
lea eax, [edi + 0x24]
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov dword [esp], eax
call sym._memcpy
lea eax, [ebp - 0xa8]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ParseURLW
call dword [sym.imp.advapi32.dll_RegOpenKeyW]
sub esp, 0xc
mov esi, eax
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_free]
test esi, esi
jne 0x10023ea0
lea eax, [ebp - 0xa0]
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0xa0], pe_nt_image_headers32
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xa4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xa8]
mov dword [esp + 0x10], ecx
mov dword [esp + 8], 0
mov dword [esp + 4], str.CLSID
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [ebp - 0xa8]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
sub esp, 4
test edi, edi
jne 0x10023e60
cmp dword [ebp - 0xa4], 1
lea ecx, [ebp - 0x8c]
jne 0x10023e60
lea edi, [ebp - 0x9c]
mov dword [esp], ecx
mov dword [esp + 4], edi
call dword [sym.imp.ole32.dll_CLSIDFromString]
sub esp, 8
test eax, eax
js 0x10023e20
test ebx, ebx
je 0x10023ddd
mov eax, dword [ebp - 0x9c]
mov dword [ebx], eax
mov eax, dword [ebp - 0x98]
mov dword [ebx + 4], eax
mov eax, dword [ebp - 0x94]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0x90]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x10023e13
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], 0x1006bdd8
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov dword [esp + 4], 1
mov dword [esp], edi
call dword [sym.imp.ole32.dll_CoGetClassObject]
sub esp, 0x14
test eax, eax
js 0x10023e58
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, eax
test byte [0x10056428], 4
je 0x10023e13
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], str.CLSIDFromString_failed:__08lx_n
mov dword [esp + 8], str.get_protocol_cf
mov dword [esp + 4], 0x10056428
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_15
jmp 0x10023e13
mov esi, 0x800401e4
jmp 0x10023e13
test byte [0x10056428], 4
je 0x10023e58
mov dword [esp + 0x10], edi
mov esi, 0x800401e4
mov dword [esp + 0xc], str.Could_not_get_protocol_CLSID_res_ld_n
mov dword [esp + 8], str.get_protocol_cf
mov dword [esp + 4], 0x10056428
mov dword [esp], 2
call sym._wine_dbg_log.constprop.0_15
jmp 0x10023e13
test byte [0x10056428], 8
je 0x10023e58
mov dword [esp + 0xc], str.Could_not_open_protocol_handler_key_n
mov esi, 0x800401e4
mov dword [esp + 8], str.get_protocol_cf
mov dword [esp + 4], 0x10056428
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_15
jmp 0x10023e13