Function at 0x100ea63
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
push edi
cmp ebx, eax
mov edi, ecx
mov dword [ebp - 4], eax
je 0x100ea9e
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.01016a50
mov eax, esp
push esi
push ebx
push eax
call sub.MFC42.DLL_AfxA2WHelper
lea ecx, [edi + 8]
push ecx
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push ebx
lea eax, [ebp - 0x110]
push 0x1001b18
push eax
mov dword [edi + 0x48], 1
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100ed9d
push dword [ebp - 4]
call fcn.0100ea0d
mov esi, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
neg eax
sbb eax, eax
mov dword [ebp + 8], 0x104
and eax, 7
inc eax
mov dword [edi + 0x48], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x1002914
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x100ebab
push 3
lea eax, [ebp - 0x110]
push 0x10042d0
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x100ec1f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x10d]
push 0x10042c8
push eax
call ebx
test eax, eax
je 0x100eba2
lea eax, [ebp - 0x10d]
push 0x10042bc
push eax
call ebx
test eax, eax
je 0x100eba2
lea eax, [ebp - 0x10d]
push 0x10042b0
push eax
call ebx
test eax, eax
je 0x100eba2
lea eax, [ebp - 0x10d]
push 0x10042a4
push eax
call ebx
test eax, eax
je 0x100eba2
lea eax, [ebp - 0x10d]
push 0x1004298
push eax
call ebx
test eax, eax
jne 0x100ec1f
mov dword [edi + 0x48], 7
jmp 0x100ec1f
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x1002904
push dword [ebp - 4]
call ebx
test eax, eax
jne 0x100ec1f
push 3
lea eax, [ebp - 0x110]
push 0x10042d0
push eax
call dword [sym.imp.MSVCRT.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x100ec1f
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea eax, [ebp - 0x10d]
push 0x100428c
push eax
call ebx
test eax, eax
je 0x100ec1b
lea eax, [ebp - 0x10d]
push 0x1004284
push eax
call ebx
test eax, eax
je 0x100ec1b
lea eax, [ebp - 0x10d]
push 0x1004278
push eax
call ebx
test eax, eax
jne 0x100ec1f
and dword [edi + 0x48], 0
lea eax, [ebp - 8]
push eax
push 0x100426c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100ec47
neg esi
sbb esi, esi
and esi, 6
add esi, 6
jmp 0x100ec88
lea eax, [ebp - 8]
push eax
push 0x1004264
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100ec69
neg esi
sbb esi, esi
and esi, 7
add esi, 3
jmp 0x100ec88
lea eax, [ebp - 8]
push eax
push 0x1004258
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100ec93
neg esi
sbb esi, esi
and esi, 7
inc esi
inc esi
push dword [ebp - 8]
mov dword [edi + 0x48], esi
jmp 0x100ed37
lea ecx, [ebp + 8]
lea eax, [edi + 0x18]
push ecx
push eax
push 0x1004250
mov dword [ebp + 8], 0x28
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x100ed39
lea eax, [edi + 0x18]
push eax
lea eax, [ebp - 0x110]
push 0x100423c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100ecf5
neg esi
sbb esi, esi
and esi, 7
inc esi
jmp 0x100ed31
lea eax, [edi + 0x18]
push eax
lea eax, [ebp - 0x110]
push 0x100422c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x100ed39
neg esi
sbb esi, esi
and esi, 7
inc esi
inc esi
push dword [ebp - 0xc]
mov dword [edi + 0x48], esi
call ebx
mov eax, dword [edi + 0x48]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dword [edi + 0x44], eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x100421c
push dword [ebp - 4]
mov dword [ebp + 8], 0x104
call esi
test eax, eax
je 0x100ed7e
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x100420c
push dword [ebp - 4]
call esi
test eax, eax
jne 0x100ed8d
lea eax, [ebp - 0x110]
lea ecx, [edi + 0x58]
push eax
call fcn.010162c8
cmp dword [ebp - 4], 0
je 0x100ed98
push dword [ebp - 4]
call ebx
push 1
pop eax
jmp 0x100ed9f
xor eax, eax
lea esp, [ebp - 0x11c]
pop edi
pop esi
pop ebx
leave
ret 4