Function at 0x10023360
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x428
mov eax, dword [0x1003f6e4]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x424], 4
xor esi, esi
lea eax, [edi + 0x110]
test edx, edx
je 0x100233d2
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x100233c4
lea eax, [edi + 0x110]
push eax
push 0x20019
push esi
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100234c0
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10023405
lea eax, [edi + 0x110]
push eax
push 0x20019
push 0
push ebx
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100234c0
xor eax, eax
push 0x104
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x214]
push eax
push 0xb3b0
push dword [0x10041578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x214], si
jne 0x10023464
mov esi, dword [0x1004138c]
lea eax, [ebp - 0x214]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10042350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push ebx
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x41c]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x41c]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.10019d30
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1003a750
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x424]
push eax
lea ebx, [edi + 0xa8]
push ebx
lea eax, [ebp - 0x428]
push eax
push 0
push 0x10003a70
push dword [edi + 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100234f4
or esi, 0xffffffff
jmp 0x100235a2
cmp dword [ebp - 0x428], 1
mov ecx, edi
jne 0x1002353a
call fcn.10022f60
test ax, ax
je 0x10023529
mov ecx, edi
call fcn.10022f60
cmp ax, 1
je 0x10023529
push 1
mov edx, 0x10001c08
mov ecx, edi
call fcn.10022110
or esi, 0xffffffff
jmp 0x100235a2
cmp byte [ebx], 0x19
jne 0x100235a2
mov ecx, edi
call fcn.10022a20
movzx esi, ax
jmp 0x100235a2
movzx edx, byte [ebx]
call fcn.10019620
cmp byte [ebx], 0x19
jne 0x100235a2
mov ebx, dword [edi + 0x110]
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a7c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 6
jne 0x10023586
lea eax, [ebp - 0x420]
push eax
push 0x20019
push 0
push 0x10003a7c
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10023596
mov ecx, edi
call fcn.10022a20
movzx esi, ax
jmp 0x100235a2
push dword [ebp - 0x420]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [edi + 0x110]
test eax, eax
je 0x100235bd
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x110], 0
mov ecx, dword [edi + 0x10c]
test ecx, ecx
je 0x100235d8
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [edi + 0x10c], 0
mov ecx, dword [ebp - 8]
mov ax, si
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1003a750
mov esp, ebp
pop ebp
ret 4