Function at 0x100041da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push edi
mov edi, 0x400
push edi
push 8
push dword [esi]
mov eax, 0x800
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x10004210
xor eax, eax
jmp 0x100043d7
push edi
push 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 0xc], eax
cmp eax, ebx
jne 0x10004230
push dword [ebp - 8]
push ebx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10004209
push edi
push 8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x1000425a
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [esi]
call edi
push dword [ebp - 8]
push ebx
push dword [esi]
call edi
jmp 0x10004209
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100042a1
push dword [ebp - 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [esi]
call edi
push dword [ebp - 8]
push ebx
push dword [esi]
call edi
push str.Mozilla_4.0__compatible__MSIE_6.0_
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscpy]
jmp 0x100043d2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
push ebx
push ebx
push str.User_Agent
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10004278
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x10]
push eax
push 0x20019
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_Settings5.0User_AgentPost_Platform
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100042f6
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [esi]
call edi
push dword [ebp - 0xc]
jmp 0x10004289
push edi
push ebx
push dword [ebp - 8]
call dword [sym.imp.MSVCRT.dll_memset]
add esp, 0xc
push edi
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], edi
call dword [sym.imp.MSVCRT.dll_memset]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
push ebx
push ebx
push eax
push dword [ebp - 8]
mov dword [ebp - 0x14], edi
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x20], eax
cmp eax, ebx
jne 0x10004394
mov eax, dword [ebp - 0xc]
cmp word [eax], bx
je 0x10004394
push str.IEAK
push eax
call dword [sym.imp.MSVCRT.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x10004394
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [ebp - 4]
push 0x3b
pop edx
mov dword [esp], 0x1000a240
push ecx
mov word [ecx + eax*2 - 2], dx
call dword [sym.imp.MSVCRT.dll_wcscat]
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscat]
push 0x1000a244
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcscat]
add esp, 0x18
inc dword [ebp - 0x18]
cmp dword [ebp - 0x20], 0x103
jne 0x100042f6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
push dword [esi]
call edi
push dword [ebp - 0xc]
push ebx
push dword [esi]
call edi
push 0x1000a248
push 0x179
call fcn.10002038
mov eax, dword [ebp - 4]
pop ecx
pop ecx
pop edi
pop ebx
leave
ret