Function at 0x1013921
Capabilities:
Query or enumerate registry value
Read file on windows

Disassembly:
push 0x560
mov eax, 0x101c5a8
call fcn.01019f16
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x550], edi
call sub.MFC42u.dll_CString::CString
and dword [ebp - 4], 0
lea ecx, [ebp - 0x544]
call sub.MFC42u.dll_CString::CString
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 1
call sub.MFC42u.dll_CString::CString
mov ecx, edi
mov byte [ebp - 4], 2
call sub.MFC42u.dll_CString::Empty
push esi
lea ecx, [ebp - 0x538]
call fcn.01019490
push dword [0x1024374]
lea ecx, [ebp - 0x52c]
call sub.MFC42u.dll_CString::CString_1
mov esi, eax
push 1
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 3
call sub.MFC42u.dll_CString::Right
push dword [esi]
mov ecx, eax
call fcn.01008914
test eax, eax
lea ecx, [ebp - 0x530]
setne bl
call fcn.010194b4
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.010194b4
test bl, bl
je 0x1013a03
push dword [0x1024374]
lea ecx, [ebp - 0x52c]
call sub.MFC42u.dll_CString::CString_1
push eax
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 4
call sub.MFC42u.dll_CString::operator
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 2
call fcn.010194b4
push 0x66
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::LoadStringW
push 0x1007214
lea ecx, [ebp - 0x530]
call sub.MFC42u.dll_CString::CString_3
lea ecx, [ebp - 0x528]
push ecx
push eax
lea eax, [ebp - 0x52c]
push eax
mov byte [ebp - 4], 5
call sub.MFC42u.dll_operator
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 6
call fcn.01019490
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 5
call fcn.010194b4
lea ecx, [ebp - 0x530]
mov byte [ebp - 4], 2
call fcn.010194b4
push 0x4b5
lea ecx, [ebp - 0x544]
call sub.MFC42u.dll_CString::LoadStringW
lea eax, [ebp - 0x54c]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp - 0x544]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1013af7
lea eax, [ebp - 0x52c]
push eax
lea eax, [ebp - 0x524]
push eax
lea eax, [ebp - 0x530]
push eax
push esi
push dword [0x1024370]
mov dword [ebp - 0x52c], 0x104
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1013aeb
cmp dword [ebp - 0x530], 1
jne 0x1013aeb
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x528]
call fcn.01019808
push dword [ebp - 0x54c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x534]
call sub.MFC42u.dll_CString::CString
push 0xa
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 7
call sub.MFC42u.dll_CStringList::CStringList
mov byte [ebp - 4], 8
jmp 0x1013c4b
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
cmp eax, 0xffffffff
jne 0x1013b42
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call fcn.01019490
jmp 0x1013b81
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
push eax
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Left
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 9
call fcn.01019490
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call fcn.010194b4
lea ecx, [ebp - 0x56c]
call sub.MFC42u.dll_CStringList::RemoveAll
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.01013165
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x530], eax
cmp eax, esi
jne 0x1013cae
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
mov ecx, dword [ebp - 0x534]
sub eax, dword [ecx - 8]
lea ecx, [ebp - 0x528]
push eax
lea eax, [ebp - 0x548]
push eax
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xa
call fcn.01019490
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call fcn.010194b4
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
test eax, eax
jne 0x1013c4b
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xb
call fcn.01019490
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], 8
call fcn.010194b4
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
jne 0x1013b1c
push 0x1007208
lea ecx, [ebp - 0x528]
call fcn.01019484
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], esi
je 0x1013ccb
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
cmp eax, 0xffffffff
jne 0x1013d20
lea eax, [ebp - 0x528]
push eax
lea ecx, [ebp - 0x534]
call fcn.01019490
jmp 0x1013d5f
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x56c]
call fcn.0100cbae
push eax
mov ecx, edi
call fcn.01019490
xor esi, esi
inc esi
lea ecx, [ebp - 0x56c]
mov byte [ebp - 4], 7
call fcn.01019868
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 2
call fcn.010194b4
lea ecx, [ebp - 0x538]
mov byte [ebp - 4], 1
call fcn.010194b4
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0
call fcn.010194b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x528]
call fcn.010194b4
mov eax, esi
call fcn.01019fa8
ret 8
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
push eax
lea eax, [ebp - 0x540]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Left
push eax
lea ecx, [ebp - 0x534]
mov byte [ebp - 4], 0xc
call fcn.01019490
lea ecx, [ebp - 0x540]
mov byte [ebp - 4], 8
call fcn.010194b4
lea ecx, [ebp - 0x56c]
call sub.MFC42u.dll_CStringList::RemoveAll
lea eax, [ebp - 0x56c]
push eax
lea eax, [ebp - 0x538]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.01013165
mov eax, dword [ebp - 0x568]
mov dword [ebp - 0x530], eax
test eax, eax
je 0x1013edb
lea eax, [ebp - 0x530]
push eax
lea ecx, [ebp - 0x56c]
call fcn.0100cbae
mov esi, dword [ebp - 0x550]
push eax
mov ecx, esi
call fcn.01019490
mov eax, dword [esi]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1013ece
push 0
lea eax, [ebp - 0x53c]
push eax
push 1
lea eax, [ebp - 0x420]
push eax
push esi
call ebx
test eax, eax
je 0x1013f7e
cmp word [ebp - 0x420], 0x3c
jne 0x1013e56
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x420]
push eax
push esi
call ebx
test eax, eax
je 0x1013f7e
lea eax, [ebp - 0x420]
push 0x10071f4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1013f88
push 1
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x1013e05
jmp 0x1013ecb
push 0
lea eax, [ebp - 0x53c]
push eax
push 1
lea eax, [ebp - 0x218]
push eax
push esi
call ebx
test eax, eax
je 0x1013f7e
push 0
lea eax, [ebp - 0x53c]
push eax
push 0x12
lea eax, [ebp - 0x218]
push eax
push esi
call ebx
test eax, eax
je 0x1013f7e
xor eax, eax
mov word [ebp - 0x1f4], ax
lea eax, [ebp - 0x218]
push 0x10071f4
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1013f88
push 1
push 0
push 0xfffffffffffffff0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp - 0x53c], 0x12
je 0x1013e73
push esi
call edi
cmp dword [ebp - 0x530], 0
jne 0x1013d98
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
mov ecx, dword [ebp - 0x534]
sub eax, dword [ecx - 8]
lea ecx, [ebp - 0x528]
push eax
lea eax, [ebp - 0x548]
push eax
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xd
call fcn.01019490
lea ecx, [ebp - 0x548]
mov byte [ebp - 4], 8
call fcn.010194b4
push 0x7c
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Find
test eax, eax
jne 0x1013f6c
mov eax, dword [ebp - 0x528]
mov eax, dword [eax - 8]
dec eax
push eax
lea eax, [ebp - 0x52c]
push eax
lea ecx, [ebp - 0x528]
call sub.MFC42u.dll_CString::Right
push eax
lea ecx, [ebp - 0x528]
mov byte [ebp - 4], 0xe
call fcn.01019490
lea ecx, [ebp - 0x52c]
mov byte [ebp - 4], 8
call fcn.010194b4
mov eax, dword [ebp - 0x528]
cmp dword [eax - 8], 0
jne 0x1013c81
jmp 0x1013f81
push esi
call edi
xor esi, esi
jmp 0x1013ccb
push esi
call edi
jmp 0x1013cc8