Function at 0x1008318
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.01001c0d
mov eax, dword [0x101d044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
push eax
mov dword [ebp - 0x101c], eax
call dword [sym.imp.USER32.dll_GetMenu]
xor edi, edi
cmp eax, edi
je 0x100859f
push ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, eax
mov dword [ebp - 0x1010], ebx
cmp ebx, edi
je 0x100859e
push esi
push 0x30
pop esi
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1050]
push eax
push edi
push 0x500
push ebx
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 1
mov dword [ebp - 0x1044], 3
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 0x400
push 2
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
test eax, eax
jne 0x10083aa
lea eax, [ebp - 0x100c]
push eax
push 0x1005438
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1008591
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x804]
push eax
push edi
push dword [ebp - 0x100c]
mov dword [ebp - 0x1008], edi
mov dword [ebp - 0x1014], 0x400
mov dword [ebp - 0x1018], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1008585
mov ebx, dword [sym.imp.USER32.dll_InsertMenuItemW]
cmp dword [ebp - 0x1008], edi
jne 0x10084ba
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1050]
push eax
push edi
push 0x500
push dword [ebp - 0x1010]
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 1
mov dword [ebp - 0x1044], edi
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x1050]
push eax
push 2
push 0xffffffffffffffff
push dword [ebp - 0x1010]
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 0x10
mov dword [ebp - 0x1048], 0x800
call ebx
push esi
lea eax, [ebp - 0x1050]
push edi
push eax
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 0x1008]
add eax, 0x502
mov dword [ebp - 0x1040], eax
lea eax, [ebp - 0x804]
add esp, 0xc
push eax
mov dword [ebp - 0x1050], esi
mov dword [ebp - 0x104c], 0x13
mov dword [ebp - 0x1048], edi
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1044], edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x1028], eax
lea eax, [ebp - 0x1050]
push eax
mov eax, dword [ebp - 0x1008]
push edi
add eax, 0x502
push eax
push dword [ebp - 0x1010]
call ebx
inc dword [ebp - 0x1008]
lea eax, [ebp - 0x1018]
push eax
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x1020]
push eax
push edi
lea eax, [ebp - 0x1014]
push eax
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x1008]
mov dword [ebp - 0x1014], 0x400
push dword [ebp - 0x100c]
mov dword [ebp - 0x1018], 0x800
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1008434
push dword [ebp - 0x100c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x101c]
call dword [sym.imp.USER32.dll_DrawMenuBar]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100160d
leave
ret 8