Function at 0x1000a5df
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x1b8
mov eax, dword [0x100436e0]
xor eax, esp
mov dword [esp + 0x1b4], eax
cmp dword [0x10043820], 0
mov edx, dword [esp + 0x1bc]
mov ecx, dword [esp + 0x1c4]
mov eax, dword [esp + 0x1cc]
push ebx
mov ebx, dword [esp + 0x1d8]
push ebp
mov ebp, dword [esp + 0x1d8]
push esi
mov esi, dword [esp + 0x1d4]
push edi
mov edi, dword [esp + 0x1e8]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], ebp
je 0x1000a827
mov eax, dword [esi]
push 1
push 0
lea ecx, [esp + 0xdc]
push ecx
push eax
push 0
push 0x78
lea ecx, [esp + 0x68]
mov dword [esp + 0x3c], eax
call sym.EXPSRV.dll___vbaInStr
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x18], ecx
test ecx, ecx
je 0x1000a6da
test edi, edi
je 0x1000a690
test ebx, ebx
je 0x1000a685
mov eax, dword [edi]
mov dword [esp + 0x10], eax
jmp 0x1000a68a
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
jmp 0x1000a692
xor eax, eax
push eax
push ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x50]
push esi
push ecx
push dword [esp + 0x1e8]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
test esi, esi
jne 0x1000a81a
push dword [esp + 0x24]
mov esi, dword [sym.imp.kernel32.dll_MultiByteToWideChar]
push dword [esp + 0x38]
push 0xffffffffffffffff
push dword [esp + 0x24]
push eax
push eax
call esi
test eax, eax
jne 0x1000a6e4
mov esi, 0x8007000e
jmp 0x1000a81a
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1000a805
cmp ecx, 2
jbe 0x1000a6fe
cmp ecx, 7
jne 0x1000a805
test edi, edi
je 0x1000a811
push 1
push 0
lea eax, [esp + 0x64]
push eax
push dword [esp + 0x1c]
lea ecx, [esp + 0x38]
push 0
push 0x78
call sym.EXPSRV.dll___vbaInStr
mov ebp, dword [esp + 0x2c]
test ebp, ebp
jne 0x1000a733
lea ecx, [esp + 0x28]
call fcn.100089b8
jmp 0x1000a6da
test ebx, ebx
je 0x1000a775
push dword [esp + 0x10]
push ebx
push ebp
call sub.msvcr100.dll_memcpy
mov eax, dword [edi]
add esp, 0xc
shr eax, 1
push eax
push ebx
push 0xffffffffffffffff
push ebp
xor ebx, ebx
push ebx
push ebx
call esi
mov esi, eax
test esi, esi
je 0x1000a728
lea eax, [esi + esi]
lea ecx, [esp + 0x28]
mov dword [edi], eax
call fcn.100089b8
mov ecx, dword [esp + 0x20]
mov ebp, dword [esp + 0x48]
jmp 0x1000a811
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esp + 0x14]
push eax
push ebp
xor ebx, ebx
push ebx
push ebx
push ecx
push dword [esp + 0x2c]
push dword [esp + 0x1e8]
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov esi, eax
test esi, esi
je 0x1000a7b0
lea ecx, [esp + 0x28]
call fcn.100089b8
jmp 0x1000a81a
push 1
push ebx
lea eax, [esp + 0x154]
push eax
mov eax, dword [esp + 0x1c]
add eax, eax
push eax
push ebx
push 0x78
lea ecx, [esp + 0x50]
call sym.EXPSRV.dll___vbaInStr
cmp dword [esp + 0x3c], ebx
jne 0x1000a7e2
lea ecx, [esp + 0x38]
call fcn.100089b8
jmp 0x1000a728
push dword [esp + 0x10]
push dword [esp + 0x40]
push 0xffffffffffffffff
push ebp
push ebx
push ebx
call dword [sym.imp.kernel32.dll_MultiByteToWideChar]
lea ecx, [esp + 0x38]
mov esi, eax
call fcn.100089b8
jmp 0x1000a756
test edi, edi
je 0x1000a811
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
mov dword [edi], eax
test ebp, ebp
je 0x1000a818
mov dword [ebp], ecx
xor esi, esi
lea ecx, [esp + 0x50]
call fcn.100089b8
mov eax, esi
jmp 0x1000a83b
push edi
push ebx
push ebp
push eax
push esi
push ecx
push dword [esp + 0x1e8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10029dae
add esp, 0x1b8
ret 0x20