Function at 0x10022eb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1003f6e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x424], 4
xor esi, esi
lea eax, [edi + 0x110]
test edx, edx
je 0x10022f22
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10022f14
lea eax, [edi + 0x110]
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023010
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10022f55
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023010
xor eax, eax
push 0x104
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x214]
push eax
push 0xb3b0
push dword [0x10041578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x214], si
jne 0x10022fb4
mov esi, dword [0x1004138c]
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10042350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x41c]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.10019780
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x424]
push eax
lea ebx, [edi + 0xa8]
push ebx
lea eax, [ebp - 0x428]
push eax
push 0
push 0x10003a70
push dword [edi + 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x10023044
or esi, 0xffffffff
jmp 0x100230f2
cmp dword [ebp - 0x428], 1
mov ecx, edi
jne 0x1002308a
call fcn.10022ab0
test ax, ax
je 0x10023079
mov ecx, edi
call fcn.10022ab0
cmp ax, 1
je 0x10023079
push 1
mov edx, 0x10001c08
mov ecx, edi
call fcn.10021c90
or esi, 0xffffffff
jmp 0x100230f2
cmp byte [ebx], 0x19
jne 0x100230f2
mov ecx, edi
call fcn.100225a0
movzx esi, ax
jmp 0x100230f2
movzx edx, byte [ebx]
call fcn.10019010
cmp byte [ebx], 0x19
jne 0x100230f2
mov ebx, dword [edi + 0x110]
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a7c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x100230d6
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a7c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100230e6
mov ecx, edi
call fcn.100225a0
movzx esi, ax
jmp 0x100230f2
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 0x110]
test eax, eax
je 0x1002310d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x110], 0
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x10023128
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x10c], 0
mov ecx, dword [ebp - 8]
mov ax, si
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a1d0
mov esp, ebp
pop ebp
ret 4