Function at 0x23819945
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1a4
mov eax, 0x23911d90
call fcn.23803221
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0x10
mov esi, ecx
jb 0x23819961
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x9c]
call fcn.238e9363
mov edi, eax
xor ebx, ebx
push 0x23921b70
lea ecx, [ebp - 0x80]
mov dword [ebp - 4], ebx
call fcn.238e9363
push edi
push eax
lea eax, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.238e9363
push 0x23921b6c
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 2
call fcn.238e9363
add esp, 0x18
cmp dword [esi + 0x14], 0x10
mov byte [ebp - 4], 3
jb 0x238199b2
mov esi, dword [esi]
push esi
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.238e9363
add esp, 0xc
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.238e9363
push ebx
push edi
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 6
call fcn.238e9363
push ebx
push edi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 7
call fcn.238e9363
push ebx
push edi
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 8
call fcn.238e9363
mov dword [ebp - 0x1ac], edi
call fcn.238e9363
test eax, eax
je 0x23819b22
mov dword [ebp - 0x1a4], ebx
lea eax, [ebp - 0x1a4]
push eax
push 0x239219ec
push 4
push ebx
push 0x239219fc
mov byte [ebp - 4], 9
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jne 0x23819b0c
push ecx
mov ecx, dword [ebp - 0x1a4]
mov eax, esp
mov dword [eax], ecx
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1b0], esp
cmp eax, ebx
je 0x23819a5e
mov ecx, dword [eax]
push eax
call dword [ecx + 4]
call fcn.238b8e99
pop ecx
mov dword [ebp - 0x1b0], eax
cmp eax, ebx
je 0x23819b0c
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x23819a7e
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x19c]
push 3
mov dword [ebp - 0x1a0], ecx
push eax
lea ecx, [ebp - 0x1a0]
call fcn.238e9363
push dword [ebp - 0x1a0]
mov byte [ebp - 4], 0xa
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov esi, eax
lea eax, [ebp - 0x19c]
mov byte [ebp - 4], 9
cmp dword [ebp - 0x1a0], eax
je 0x23819ac9
push dword [ebp - 0x1a0]
call dword [sym.imp.MSVCR100.dll_free]
pop ecx
mov eax, dword [ebp - 0x1a4]
mov ecx, dword [eax]
lea edx, [ebp - 0x1ac]
push edx
push esi
push dword [ebp - 0x1b0]
push eax
call dword [ecx + 0x80]
test eax, eax
je 0x23819af0
mov dword [ebp - 0x1ac], edi
mov eax, dword [ebp - 0x1a4]
push dword [ebp - 0x1b0]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x8c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x1a4]
mov byte [ebp - 4], 8
cmp eax, ebx
je 0x23819b72
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x23819b72
call fcn.238e9363
mov esi, eax
mov dword [ebp - 0x1b0], 4
cmp esi, ebx
je 0x23819b72
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x23819b43
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x1b0]
push ecx
lea ecx, [ebp - 0x1ac]
push ecx
lea ecx, [ebp - 0x1a4]
push ecx
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x23819b6b
mov dword [ebp - 0x1ac], edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1ac], ebx
push ebx
setne byte [ebp - 0x1a5]
or dword [ebp - 4], 0xffffffff
push edi
lea ecx, [ebp - 0x2c]
call fcn.238e9363
mov al, byte [ebp - 0x1a5]
call fcn.238040e1
ret