Function at 0x10030b32
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b603e
mov eax, dword fs:[0]
push eax
sub esp, 0x84c
mov eax, dword [0x102258ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x858], ebx
mov dword [ebp - 0x854], 0
mov dword [ebp - 4], 1
call fcn.10020d50
mov ecx, eax
test ecx, ecx
je 0x10030c93
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebx], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x854], 1
call fcn.10020d50
mov ecx, eax
test ecx, ecx
je 0x10030c9d
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x83c], eax
mov eax, 0x101d0f5c
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x83c]
test eax, 0xffff0000
jne 0x10030723
movzx eax, ax
push eax
call fcn.1001ede0
jmp 0x1003072f
push 0
push 0x101d0f5c
call fcn.1001e110
push dword [ebp + 0xc]
mov dword [ebp - 4], 3
call fcn.10031030
mov edx, dword [0x1022eb44]
add esp, 4
mov esi, eax
mov eax, edx
mov ecx, dword [edx + 4]
cmp byte [ecx + 0xd], 0
jne 0x10030771
cmp dword [ecx + 0x10], esi
jge 0x1003075e
mov ecx, dword [ecx + 8]
jmp 0x10030762
mov eax, ecx
mov ecx, dword [ecx]
cmp byte [ecx + 0xd], 0
je 0x10030754
cmp eax, edx
je 0x10030771
cmp esi, dword [eax + 0x10]
jge 0x10030773
mov eax, edx
cmp edx, eax
je 0x10030786
add eax, 0x14
lea ecx, [ebp - 0x83c]
push eax
call fcn.10020000
call fcn.10020d50
mov ecx, eax
test ecx, ecx
je 0x10030ca7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x838], eax
mov eax, 0x101d1d08
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x838]
test eax, 0xffff0000
jne 0x100307c4
movzx eax, ax
push eax
call fcn.1001ede0
jmp 0x100307d0
push 3
push 0x101d1d08
call fcn.1001e110
dec esi
mov byte [ebp - 4], 5
cmp esi, 0xe
ja case.0x100307e5.4
movzx eax, byte [esi + 0x10030cd8]
jmp dword [eax*4 + 0x10030cc8]
lea ecx, [ebp - 0x844]
call fcn.10021dd0
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov edi, dword [ebp - 0x83c]
lea ecx, [ebp - 0x850]
push 0x20219
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 7
call fcn.100312a0
test eax, eax
jne 0x10030a37
push 0x208
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.10187ab0
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x850]
push eax
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x838]
call fcn.10031380
test eax, eax
jne 0x100308ae
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030890
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.1001e110
push 0x208
lea eax, [ebp - 0x628]
push 0
push eax
call fcn.10187ab0
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x850]
push eax
lea eax, [ebp - 0x628]
push eax
push str.SUBPID
call fcn.10031380
test eax, eax
jne 0x10030922
lea ecx, [ebp - 0x628]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030900
sub ecx, edx
lea eax, [ebp - 0x628]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x844]
call fcn.1001e110
mov esi, dword [ebp - 0x844]
cmp dword [esi - 0xc], 0
jne 0x10030940
push ebx
lea ecx, [ebp - 0x844]
call fcn.10020000
mov esi, dword [ebp - 0x844]
mov eax, dword [ebx]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x10030954
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x10030962
call fcn.10020d50
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 9
test ecx, ecx
je 0x10030cb1
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov byte [ebp - 4], 8
mov dword [ebp - 0x840], eax
mov eax, dword [ebx]
push 2
push 0x101d1d20
mov dword [ebp - 0x854], 3
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x840]
push eax
call fcn.10025f70
add esp, 0x14
mov eax, dword [ebp - 0x840]
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x100309be
mov eax, dword [ecx]
call dword [eax + 0x10]
mov ecx, eax
test ecx, ecx
jne 0x100309cc
call fcn.10020d50
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov ecx, eax
mov byte [ebp - 4], 0xb
test ecx, ecx
je 0x10030cbb
mov eax, dword [ecx]
call dword [eax + 0xc]
push dword [esi - 0xc]
add eax, 0x10
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x840]
push esi
mov dword [ebp - 0x854], 7
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x834]
push eax
call fcn.10025f70
add esp, 0x14
lea eax, [ebp - 0x834]
mov ecx, ebx
push eax
call fcn.10020000
lea ecx, [ebp - 0x834]
call fcn.1001bb00
lea ecx, [ebp - 0x840]
call fcn.1001bb00
jmp 0x10030a3d
mov esi, dword [ebp - 0x844]
mov eax, dword [ebp - 0x850]
test eax, eax
je 0x10030a4e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10030c40
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10030c40
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov edi, dword [ebp - 0x83c]
lea ecx, [ebp - 0x850]
push 0x20219
push edi
push SysReAllocString
mov byte [ebp - 4], 0xc
call fcn.100312a0
test eax, eax
jne 0x10030b1e
push 0x208
push eax
lea eax, [ebp - 0x830]
push eax
call fcn.10187ab0
add esp, 0xc
mov dword [ebp - 0x834], 0x104
lea eax, [ebp - 0x834]
lea ecx, [ebp - 0x850]
push eax
lea eax, [ebp - 0x830]
push eax
push dword [ebp - 0x838]
call fcn.10031380
test eax, eax
jne 0x10030b1e
lea ecx, [ebp - 0x830]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030b00
sub ecx, edx
lea eax, [ebp - 0x830]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.1001e110
mov eax, dword [ebp - 0x850]
test eax, eax
je 0x10030c40
push eax
jmp 0x10030c3a
push 8
push str.VendorID
lea ecx, [ebp - 0x838]
call fcn.1001e110
mov dword [ebp - 0x850], 0
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov edi, dword [ebp - 0x83c]
lea ecx, [ebp - 0x850]
push 0x20219
push edi
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp - 4], 0xd
call fcn.100312a0
mov esi, dword [ebp - 0x850]
test eax, eax
jne 0x10030c35
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10187ab0
add esp, 0xc
mov dword [ebp - 0x834], 0x208
lea eax, [ebp - 0x834]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x840]
push eax
push 0
push dword [ebp - 0x838]
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10030c35
mov eax, dword [ebp - 0x840]
cmp eax, 1
je 0x10030be8
cmp eax, 2
jne 0x10030c35
mov eax, dword [ebp - 0x834]
test eax, eax
je 0x10030c05
test al, 1
jne 0x10030c35
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], 0
je 0x10030c0e
jmp 0x10030c35
xor eax, eax
mov word [ebp - 0x218], ax
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10030c17
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, ebx
call fcn.1001e110
test esi, esi
je 0x10030c40
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x838]
or esi, 0xffffffff
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10030c60
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], esi
dec esi
test esi, esi
jg 0x10030c75
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101454ca
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
nop dword [eax]
xor cl, byte [ebx]
add edx, dword [eax]
in al, dx
pop es
add edx, dword [eax]
outsd dx, dword [esi]
or al, byte [ebx]
adc byte [ebx + ecx + 3], al
adc byte [eax], al
add byte [ecx], al
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add byte [ebx], al
add byte [ebx], al
add eax, dword [edx]
int3