Function at 0x1003b2f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b70c1
mov eax, dword fs:[0]
push eax
sub esp, 0xa5c
mov eax, dword [0x102258ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xa40], ebx
call fcn.10020d50
mov ecx, eax
test ecx, ecx
je 0x1003b650
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0xa44], eax
push str.20160102123456
lea ecx, [ebp - 0xa44]
mov dword [ebp - 4], 0
call fcn.10022430
test al, al
jne 0x1003b374
push 0xe
push str.20160102123456
lea ecx, [ebp - 0xa44]
call fcn.1001e110
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 1
push 0
push eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
call fcn.10187ab0
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0xa68], ebx
mov dword [ebp - 0xa64], ebx
mov dword [ebp - 0xa60], ebx
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa38], ebx
push eax
push 0x20219
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003b3eb
mov ebx, dword [ebp - 0xa38]
mov dword [ebp - 0xa68], ebx
mov dword [ebp - 0xa64], 0x200
mov byte [ebp - 4], 2
test eax, eax
jne 0x1003b49e
lea eax, [ebp - 0xa38]
mov dword [ebp - 0xa38], 0x800
push eax
lea eax, [ebp - 0xa10]
push eax
lea eax, [ebp - 0xa5c]
push eax
push 0
push str.LastUninstallDate
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003b49e
mov eax, dword [ebp - 0xa5c]
cmp eax, 1
je 0x1003b438
cmp eax, 2
jne 0x1003b49e
mov eax, dword [ebp - 0xa38]
test eax, eax
je 0x1003b455
test al, 1
jne 0x1003b49e
shr eax, 1
cmp word [ebp + eax*2 - 0xa12], 0
je 0x1003b45e
jmp 0x1003b49e
xor eax, eax
mov word [ebp - 0xa10], ax
lea ecx, [ebp - 0x210]
mov edx, 0xff
lea esi, [ebp - 0xa10]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffeff]
test eax, eax
je 0x1003b491
movzx eax, word [esi + ecx]
test ax, ax
je 0x1003b491
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1003b473
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push str.0000_00_00_00:00:00
call edi
mov esi, eax
lea eax, [ebp - 0x210]
push eax
call edi
cmp eax, esi
je 0x1003b507
test ebx, ebx
je 0x1003b4c5
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xa40]
mov edi, dword [ebp - 0xa44]
or eax, 0xffffffff
add edi, 0xfffffff0
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1003b4e9
mov ecx, dword [edi]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101454ca
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xa58]
mov dword [ebp - 0xa3c], 0
push eax
lea eax, [ebp - 0xa54]
mov dword [ebp - 0xa48], 0
push eax
lea eax, [ebp - 0xa50]
mov dword [ebp - 0xa4c], 0
push eax
lea eax, [ebp - 0xa4c]
mov dword [ebp - 0xa50], 0
push eax
lea eax, [ebp - 0xa48]
mov dword [ebp - 0xa54], 0
push eax
lea eax, [ebp - 0xa3c]
mov dword [ebp - 0xa58], 0
push eax
lea eax, [ebp - 0x210]
push str._04d__02d__02d__02d:_02d:_02d
push eax
call fcn.100447c0
add esp, 0x20
cmp dword [ebp - 0xa3c], 0x7b2
jl 0x1003b65a
mov ecx, dword [ebp - 0xa48]
dec ecx
cmp ecx, 0xb
ja 0x1003b664
mov edx, dword [ebp - 0xa4c]
lea eax, [edx - 1]
cmp eax, 0x1e
ja 0x1003b66e
mov eax, dword [ebp - 0xa50]
cmp eax, 0x17
ja 0x1003b678
mov esi, dword [ebp - 0xa54]
cmp esi, 0x3b
ja 0x1003b682
mov edi, dword [ebp - 0xa58]
cmp edi, 0x3b
ja 0x1003b68c
mov dword [ebp - 0xa2c], eax
mov eax, dword [ebp - 0xa3c]
add eax, 0xfffff894
mov dword [ebp - 0xa34], edi
mov dword [ebp - 0xa20], eax
lea eax, [ebp - 0xa34]
push eax
mov dword [ebp - 0xa30], esi
mov dword [ebp - 0xa28], edx
mov dword [ebp - 0xa24], ecx
mov dword [ebp - 0xa14], 0xffffffff
call fcn.10197e51
mov ecx, eax
add esp, 4
and eax, edx
cmp eax, 0xffffffff
je 0x1003b696
mov esi, dword [ebp - 0xa40]
mov dword [esi], ecx
mov dword [esi + 4], edx
test ebx, ebx
je 0x1003b4cb
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1003b4cb
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80004005
call fcn.1001bf60
push 0x80070057
call fcn.1001bf60
int3