Function at 0x100247d8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
jmp 0x100247f2
mov eax, dword [ebp - 8]
add eax, 0x23
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
add eax, 0x2bc
cmp dword [ebp - 8], eax
ja 0x10024bbb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x46e2
ja 0x100248d0
cmp dword [ebp - 0x14], 0x46e2
je 0x10024b87
cmp dword [ebp - 0x14], 0x45ed
ja 0x10024886
cmp dword [ebp - 0x14], 0x45ed
je 0x10024a80
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
sub dword [ebp - 0x18], 0x107
je 0x10024a4b
sub dword [ebp - 0x18], 0x23
je 0x100249dd
sub dword [ebp - 0x18], 0x4437
je 0x10024add
sub dword [ebp - 0x18], 0x23
je 0x10024b0b
sub dword [ebp - 0x18], 0x23
je 0x100249cc
sub dword [ebp - 0x18], 0x23
je 0x10024b2f
jmp 0x10024bb6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
sub dword [ebp - 0x1c], 0x4610
je 0x10024aea
sub dword [ebp - 0x1c], 0x23
je 0x10024aa8
sub dword [ebp - 0x1c], 0x23
je 0x100249ae
sub dword [ebp - 0x1c], 0x23
je 0x10024aca
sub dword [ebp - 0x1c], 0x23
je 0x10024976
sub dword [ebp - 0x1c], 0x23
je 0x10024b43
jmp 0x10024bb6
cmp dword [ebp - 0x14], 0x47d7
ja 0x10024930
cmp dword [ebp - 0x14], 0x47d7
je 0x1002498f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
sub dword [ebp - 0x20], 0x4705
je 0x10024a18
sub dword [ebp - 0x20], 0x23
je 0x10024af9
sub dword [ebp - 0x20], 0x23
je 0x10024b6b
sub dword [ebp - 0x20], 0x23
je 0x10024ba6
sub dword [ebp - 0x20], 0x23
je 0x10024b4d
sub dword [ebp - 0x20], 0x23
je 0x10024a9c
jmp 0x10024bb6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
sub dword [ebp - 0x24], 0x7287
je 0x10024997
sub dword [ebp - 0x24], 0x23
je 0x10024b1e
sub dword [ebp - 0x24], 0x23
je 0x10024b57
sub dword [ebp - 0x24], 0x23
je 0x10024a39
sub dword [ebp - 0x24], 0x23
je 0x10024a71
sub dword [ebp - 0x24], 0x23
je 0x10024b3e
jmp 0x10024bb6
mov esi, dword [edx + esi*4]
jmp 0x10024a80
ret 0xc
push 8
push dword [0x10058334]
call fcn.10009b2b
mov eax, dword [ebp + 8]
push dword [eax]
jmp 0x10024bb6
lea edi, [edx + eax*4 + 0xc00]
mov esi, dword [edi]
test esi, esi
je 0x10024b87
test ecx, ecx
je 0x10024b5c
jmp 0x10024bb6
or eax, dword [eax]
sbb dword [0xc98557e6], 0xc033757e
push edi
test ecx, ecx
jle 0x10024a4b
xor eax, eax
jmp 0x10024bb6
movzx eax, byte [ebp - 2]
test eax, eax
jne 0x100249f1
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
jmp 0x10024bbe
push dword [ebp + 0x10]
push 0
push 0
push 0
push dword [ebp + 0x14]
mov eax, dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
jmp 0x10024bbe
add eax, dword [edx + ecx*4 + 0x800]
mov ecx, dword [edx + eax*4]
mov dword [esp + 0x18], ecx
jmp 0x10024aea
dec ebx
jo 0x10024a02
insd dword es:[edi], dx
retf 0xc759
push 0
push dword [ebp + 8]
push 0x2497
call fcn.10024407
add esp, 0xc
mov dword [ebp - 0x10], eax
mov al, byte [ebp - 0x10]
mov byte [ebp - 9], al
mov al, byte [ebp - 9]
mov byte [ebp - 2], al
jmp 0x10024bb6
call fcn.1001324e
call fcn.100031a1
jmp 0x10024bb6
cmp dword [esp + 0x41c], ebx
jle 0x10024b6b
mov eax, dword [edx + 0x2404]
lea ecx, [esp + eax*4 + 0x10]
jmp 0x10024bb6
pop ebx
add esp, 0x408
jmp 0x10024bb6
mov eax, dword [esp + 0x41c]
movzx ecx, byte [ebx + eax]
mov eax, dword [esp + 0x14]
xor ecx, dword [eax]
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x100249dd
jmp 0x10024bb6
mov esi, dword [edx + esi*4 + 0x800]
add esi, dword [edx + ecx*4 + 0x800]
jmp 0x10024bb6
sub esp, 0x408
mov edx, ecx
jmp 0x10024bb6
dec eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
push ebp
jmp 0x10024bb6
cmp ebx, dword [esp + 0x420]
jl 0x10024a71
jmp 0x10024bb6
mov ch, 0x26
jg 0x10024ae5
retf
call fcn.10014422
pop ecx
and dword [ebp - 4], 0
push 0
jmp 0x10024bb6
rcr dword [esi - 0x72de9834], 0x7c
and al, 0x14
rep stosd dword es:[edi], eax
xor ebx, ebx
jmp 0x10024bb6
ret 0xc
dec eax
sub edi, 4
test eax, eax
jg 0x10024b1e
jmp 0x10024bb6
jl 0x100249ae
pop edi
pop esi
jmp 0x10024bb6
push esi
adc bl, bl
salc
sub byte [ebx + 0x8b0c45], cl
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push dword [eax]
call fcn.10003b5f
pop ecx
jmp 0x10024bb6
pop ebp
mov ecx, dword [edx + 0x2404]
xor eax, eax
test ecx, ecx
jle 0x10024aa8
mov esi, dword [esp + 0x420]
sub ecx, eax
jmp 0x10024bb6
mov eax, dword [edx + 0xc00]
test eax, eax
je 0x100249d1
test ecx, ecx
je 0x10024a18
mov eax, dword [edx + eax*4 + 0x800]
jmp 0x10024bb6
mov cl, byte [esp + ecx*4 + 0x10]
mov byte [eax + esi], cl
mov ecx, dword [edx + 0x2404]
inc eax
cmp eax, ecx
jmp 0x100247e9
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret