Function at 0x10022ad
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x100d058]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 0x340], eax
je 0x10025eb
push ebx
push esi
push edi
mov esi, 0x400
push esi
push 0xc
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0xa
lea eax, [ebp - 0x1c]
push eax
push 0x12d
push dword [0x100de70]
call edi
push 0xa
lea eax, [ebp - 0x10]
push eax
push 0x12e
push dword [0x100de70]
call edi
push dword [0x100e1c4]
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ebx, eax
xor eax, eax
cmp ebx, dword [0x100e11c]
sete al
mov edi, eax
shl edi, 2
mov eax, dword [edi + 0x100e120]
test eax, eax
mov dword [ebp - 0x348], eax
je 0x10025bf
lea ecx, [ebp - 0x358]
push ecx
push dword [eax + 0x14]
call sub.OLECLI32.dll_OleQueryType
test eax, eax
jne 0x10025bf
test ebx, ebx
je 0x10025bf
cmp dword [edi + 0x100de88], 4
jne 0x10025bf
cmp dword [ebp - 0x358], 3
je 0x10025bf
and dword [ebp - 0x354], eax
cmp dword [ebp - 0x358], 1
movzx eax, word [0x100d534]
je 0x1002397
movzx eax, word [0x100d53c]
lea ecx, [ebp - 0x354]
push ecx
push eax
mov eax, dword [ebp - 0x348]
push dword [eax + 0x14]
call sub.OLECLI32.dll_OleGetData
test eax, eax
jne 0x10025bf
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [ebp - 0x348], eax
je 0x10025bf
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
and dword [ebp - 0x350], 0
lea ecx, [ebp - 0x34c]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
mov ebx, OleLoadFromStream
push ebx
mov dword [ebp - 0x34c], 0x12c
call edi
test eax, eax
je 0x1002418
push dword [ebp - 0x348]
lea eax, [ebp - 0x210]
push 0x12c
push eax
call fcn.010016e5
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
and dword [ebp - 0x344], 0
push 0
push dword [ebp - 0x348]
lea eax, [ebp - 0xe4]
push 0x100146c
push 0xc8
push eax
mov dword [ebp - 0x34c], 0x12c
call fcn.01001c0c
add esp, 0x14
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0xe4]
push eax
push ebx
call edi
test eax, eax
jne 0x100250b
cmp dword [ebp - 0x350], 0
jne 0x100248b
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x350], eax
lea eax, [ebp - 0x33c]
push eax
mov eax, dword [ebp - 0x344]
add eax, 0x221
push eax
push esi
push 0xffffffffffffffff
push dword [ebp - 0x350]
call dword [sym.imp.USER32.dll_InsertMenuA]
inc dword [ebp - 0x344]
push dword [ebp - 0x344]
lea eax, [ebp - 0xe4]
push dword [ebp - 0x348]
mov dword [ebp - 0x34c], 0x12c
push 0x100146c
push 0xc8
push eax
call fcn.01001c0c
add esp, 0x14
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0xe4]
push eax
push ebx
call edi
test eax, eax
je 0x1002476
cmp dword [ebp - 0x344], 0
jne 0x1002539
push 0x100d154
lea eax, [ebp - 0x210]
push eax
push 0x100d140
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x10]
call fcn.01001fe7
lea eax, [ebp - 0xe4]
push eax
push 0x221
push esi
jmp 0x10025ae
cmp dword [ebp - 0x344], 1
lea eax, [ebp - 0x210]
push 0x100d154
push eax
jne 0x100258c
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x10]
call fcn.01001fe7
lea eax, [ebp - 0xe4]
push eax
push 0x221
push esi
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_InsertMenuA]
push dword [ebp - 0x350]
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x10025bc
push 0
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x1c]
call fcn.01001fe7
lea eax, [ebp - 0xe4]
push eax
push dword [ebp - 0x350]
push 0x410
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_InsertMenuA]
push esi
jmp 0x10025da
push 0x100d154
push 0
push esi
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0x401
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_EnableMenuItem]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01003019
leave
ret 4