Function at 0x10022343
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x24c
mov eax, 0x10025045
call fcn.10024524
mov ecx, 0x10045c74
call fcn.100223b3
lea eax, [ebp - 0x244]
xor edi, edi
push eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], edi
push eax
push edi
push 2
push 0x10007a88
push 0x10007a10
push 0x80000001
mov dword [ebp - 0x228], edi
mov ebx, edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x244], 0x208
call dword [sym.imp.api_ms_win_downlevel_advapi32_l1_1_0.dll_RegGetValueW]
test eax, eax
je 0x10029594
call fcn.10024476
ret
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x240]
call fcn.1001ee9c
lea ecx, [ebp - 0x240]
mov byte [ebp - 4], 1
call fcn.1001ed08
push dword [ebp - 0x240]
call dword [sym.imp.msvcrt.dll__wcslwr]
mov eax, dword [0x100450a0]
lea ecx, [ebp - 0x224]
push 0x1000bba4
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], edi
call fcn.1001e9ca
lea eax, [ebp - 0x224]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x240]
push eax
lea ecx, [ebp - 0x258]
call fcn.1001ceb7
lea ecx, [ebp - 0x224]
call fcn.1001ef70
mov eax, dword [0x100450a0]
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], edi
mov byte [ebp - 4], 5
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x238]
push eax
lea ecx, [ebp - 0x258]
call fcn.1001cf60
test eax, eax
je 0x100297cc
mov esi, dword [ebp - 0x238]
cmp dword [esi - 0xc], 0
jl 0x10029727
push 0x1000bba8
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x10029674
sub eax, esi
sar eax, 1
js 0x10029674
mov dword [ebp - 0x228], 0x1002f5b0
jmp 0x1002961f
cmp dword [esi - 0xc], 0
jl 0x10029727
push 0x1000bbc0
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x100296a5
sub eax, esi
sar eax, 1
js 0x100296a5
mov dword [ebp - 0x22c], 0x1002f570
jmp 0x1002961f
cmp dword [esi - 0xc], 0
jl 0x10029727
push 0x1000bbdc
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x100296d2
sub eax, esi
sar eax, 1
js 0x100296d2
mov dword [ebp - 0x230], 0x1002f530
jmp 0x1002961f
cmp dword [esi - 0xc], 0
jl 0x10029727
push 0x1000bbf8
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x100296fa
sub eax, esi
sar eax, 1
js 0x100296fa
mov ebx, 0x1002f5f0
jmp 0x1002961f
cmp dword [esi - 0xc], 0
jl 0x10029727
push 0x1000bc1c
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x10029727
sub eax, esi
sar eax, 1
js 0x10029727
mov ecx, 0x10045c74
call fcn.1002f630
jmp 0x1002961f
cmp dword [esi - 0xc], edi
jl 0x1002961f
push 0x1000bc38
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x10029757
sub eax, esi
sar eax, 1
js 0x10029757
mov dword [0x10045ca8], 1
jmp 0x1002961f
cmp dword [esi - 0xc], edi
jl 0x1002961f
push 0x1000bc60
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1002978a
sub eax, esi
sar eax, 1
js 0x1002978a
xor eax, eax
inc eax
mov dword [0x10045c74], eax
mov dword [0x10045c8c], eax
jmp 0x1002961f
cmp dword [esi - 0xc], edi
jl 0x1002961f
push 0x1000bc80
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1002961f
sub eax, esi
sar eax, 1
js 0x1002961f
mov dword [0x10045c74], 1
mov dword [0x10045c8c], 2
jmp 0x1002961f
mov esi, dword [ebp - 0x230]
push ebx
push esi
push dword [ebp - 0x22c]
push dword [ebp - 0x228]
call sym.IEShims.dll_AcRedirNotify
cmp dword [ebp - 0x228], 0
jne 0x100297ff
cmp dword [ebp - 0x22c], 0
jne 0x100297ff
test esi, esi
jne 0x100297ff
test ebx, ebx
je 0x10029802
xor edi, edi
inc edi
lea ecx, [ebp - 0x238]
mov dword [0x100454bc], edi
call fcn.1001ef70
lea ecx, [ebp - 0x24c]
call fcn.1001ef70
lea ecx, [ebp - 0x254]
call fcn.1001ef70
lea ecx, [ebp - 0x240]
call fcn.1001ef70
jmp 0x100223ad