Function at 0x1032f80
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
push ebx
push edi
push 0xcd
mov dword [ebp - 4], eax
mov edi, ecx
call fcn.0103aa68
mov ebx, eax
xor eax, eax
cmp ebx, eax
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], ebx
je 0x10331e1
cmp dword [ebp + 8], eax
push esi
je 0x1032ff3
cmp dword [edi + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
je 0x1032fd1
push 0x400
push 1
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x1033006
cmp dword [edi + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
jne 0x1032fe1
cmp dword [edi + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], eax
jne 0x1032fe4
push 3
pop eax
push eax
push 0x1a5
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
jmp 0x1033006
push 2
pop esi
push 0x400
push esi
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
dec esi
jns 0x1032ff6
mov eax, dword [edi + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
neg eax
sbb eax, eax
and eax, 0xfffffff8
add eax, 8
push eax
mov esi, 0x1a8
push esi
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
call fcn.0101b02d
test eax, eax
jne 0x103304f
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
sub eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
je 0x103304f
xor eax, eax
jmp 0x1033052
push 3
pop eax
push eax
push esi
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
cmp dword [edi + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, dword [sym.imp.USER32.dll_ModifyMenuW]
je 0x10330d5
cmp dword [edi + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0
je 0x10330d5
push 0x1e
lea eax, [ebp - 0x40]
push eax
push 0x216
push dword [0x10460c0]
call esi
push 0x1e
lea eax, [ebp - 0x7c]
push eax
mov eax, dword [edi + reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
push dword [eax]
push dword [0x10460c0]
call esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xfc]
push 0x40
push eax
call fcn.0100ae15
add esp, 0x10
lea eax, [ebp - 0xfc]
push eax
mov eax, 0x1a0
push eax
push 0
push eax
push dword [ebp - 0x100]
call ebx
jmp 0x10330e8
push 0
push 0x1a0
push dword [ebp - 0x100]
call dword [sym.imp.USER32.dll_DeleteMenu]
cmp dword [reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 0
je 0x103311f
push 0x40
lea eax, [ebp - 0xfc]
push eax
push 0x352
push dword [0x10460c0]
call esi
lea eax, [ebp - 0xfc]
push eax
mov eax, 0x197
push eax
push 0
push eax
push dword [ebp - 0x100]
call ebx
mov ecx, edi
call fcn.010324bc
test eax, eax
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
jne 0x103315d
push 3
push 0x193
push dword [ebp - 0x100]
call esi
push 3
push 0x194
push dword [ebp - 0x100]
call esi
push 3
push 0x195
push dword [ebp - 0x100]
call esi
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push 0x20019
xor edi, edi
push edi
push 0x1033210
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10331da
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
lea eax, reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification
push eax
push edi
push 0x10331f0
push dword [ebp - 0x108]
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], edi
mov dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification], edi
je 0x10331da
push 3
push 0x1a4
push dword [ebp - 0x100]
call esi
mov eax, dword [ebp - reloc.WINSTA.dll_WinStationUnRegisterConsoleNotification]
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.01001b01
leave
ret 4