Function at 0x100222d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x100c058]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [ebp - 0x340], eax
je 0x100256b
push ebx
push esi
push edi
mov esi, 0x400
push esi
push 0xc
push eax
call dword [sym.imp.USER32.dll_DeleteMenu]
mov edi, dword [sym.imp.USER32.dll_LoadStringA]
push 0xa
lea eax, [ebp - 0x1c]
push eax
push 0x12d
push dword [0x100ce50]
call edi
push 0xa
lea eax, [ebp - 0x10]
push eax
push 0x12e
push dword [0x100ce50]
call edi
push dword [0x100d1a4]
call dword [sym.imp.USER32.dll_GetTopWindow]
mov ebx, eax
xor eax, eax
cmp ebx, dword [0x100d0fc]
sete al
mov edi, eax
shl edi, 2
mov eax, dword [edi + 0x100d100]
test eax, eax
mov dword [ebp - 0x348], eax
je 0x100253f
lea ecx, [ebp - 0x358]
push ecx
push dword [eax + 0x14]
call sub.OLECLI32.dll_OleQueryType
test eax, eax
jne 0x100253f
test ebx, ebx
je 0x100253f
cmp dword [edi + 0x100ce68], 4
jne 0x100253f
cmp dword [ebp - 0x358], 3
je 0x100253f
and dword [ebp - 0x354], eax
cmp dword [ebp - 0x358], 1
movzx eax, word [0x100c534]
je 0x1002317
movzx eax, word [0x100c53c]
lea ecx, [ebp - 0x354]
push ecx
push eax
mov eax, dword [ebp - 0x348]
push dword [eax + 0x14]
call sub.OLECLI32.dll_OleGetData
test eax, eax
jne 0x100253f
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
mov dword [ebp - 0x348], eax
je 0x100253f
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
and dword [ebp - 0x350], 0
lea ecx, [ebp - 0x34c]
push ecx
lea ecx, [ebp - 0x210]
push ecx
push eax
mov ebx, OleLoadFromStream
push ebx
mov dword [ebp - 0x34c], 0x12c
call edi
test eax, eax
je 0x1002398
push dword [ebp - 0x348]
lea eax, [ebp - 0x210]
push 0x12c
push eax
call fcn.01001665
push dword [ebp - 0x354]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
and dword [ebp - 0x344], 0
push 0
push dword [ebp - 0x348]
lea eax, [ebp - 0xe4]
push 0x100145c
push 0xc8
push eax
mov dword [ebp - 0x34c], 0x12c
call fcn.01001b8c
add esp, 0x14
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0xe4]
push eax
push ebx
call edi
test eax, eax
jne 0x100248b
cmp dword [ebp - 0x350], 0
jne 0x100240b
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x350], eax
lea eax, [ebp - 0x33c]
push eax
mov eax, dword [ebp - 0x344]
add eax, 0x221
push eax
push esi
push 0xffffffffffffffff
push dword [ebp - 0x350]
call dword [sym.imp.USER32.dll_InsertMenuA]
inc dword [ebp - 0x344]
push dword [ebp - 0x344]
lea eax, [ebp - 0xe4]
push dword [ebp - 0x348]
mov dword [ebp - 0x34c], 0x12c
push 0x100145c
push 0xc8
push eax
call fcn.01001b8c
add esp, 0x14
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0xe4]
push eax
push ebx
call edi
test eax, eax
je 0x10023f6
cmp dword [ebp - 0x344], 0
jne 0x10024b9
push 0x100c154
lea eax, [ebp - 0x210]
push eax
push 0x100c140
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x10]
call fcn.01001f67
lea eax, [ebp - 0xe4]
push eax
push 0x221
push esi
jmp 0x100252e
cmp dword [ebp - 0x344], 1
lea eax, [ebp - 0x210]
push 0x100c154
push eax
jne 0x100250c
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x10]
call fcn.01001f67
lea eax, [ebp - 0xe4]
push eax
push 0x221
push esi
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_InsertMenuA]
push dword [ebp - 0x350]
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x100253c
push 0
lea eax, [ebp - 0xe4]
lea ecx, [ebp - 0x1c]
call fcn.01001f67
lea eax, [ebp - 0xe4]
push eax
push dword [ebp - 0x350]
push 0x410
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_InsertMenuA]
push esi
jmp 0x100255a
push 0x100c154
push 0
push esi
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_InsertMenuA]
push 0x401
push 0xc
push dword [ebp - 0x340]
call dword [sym.imp.USER32.dll_EnableMenuItem]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.01002f99
leave
ret 4