Function at 0x103994c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x24b8
call fcn.01047540
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x1003f08
lea edi, [ebp - 0x2084]
movsd dword es:[edi], dword [esi]
xor ebx, ebx
movsd dword es:[edi], dword [esi]
push 0x1fc
lea eax, [ebp - 0x2078]
push ebx
push eax
mov dword [ebp - 0x249c], ebx
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
mov esi, 0x1003ef4
lea edi, [ebp - 0x1e7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1f6
lea eax, [ebp - 0x1e6a]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
mov esi, 0x1003ee4
lea edi, [ebp - 0x1c74]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1fa
lea eax, [ebp - 0x1c66]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x1a58]
push ebx
mov esi, 0x1003ed0
lea edi, [ebp - 0x1a6c]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
push 5
pop ecx
mov esi, 0x1003eb8
lea edi, [ebp - 0x1864]
rep movsd dword es:[edi], dword [esi]
push 0x1f2
lea eax, [ebp - 0x184e]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
mov esi, 0x1003ea4
lea edi, [ebp - 0x165c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1f6
lea eax, [ebp - 0x164a]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
mov esi, 0x1003e98
lea edi, [ebp - 0x1454]
movsd dword es:[edi], dword [esi]
add esp, 0x48
movsd dword es:[edi], dword [esi]
push 0x1fc
push ebx
lea eax, [ebp - 0x1448]
movsd dword es:[edi], dword [esi]
push eax
call sub.msvcrt.dll_memset
mov esi, 0x1003e8c
lea edi, [ebp - 0x124c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1fc
lea eax, [ebp - 0x1240]
push ebx
push eax
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
push 5
pop ecx
mov esi, 0x1003e74
lea edi, [ebp - 0x1044]
rep movsd dword es:[edi], dword [esi]
push 0x1f2
lea eax, [ebp - 0x102e]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0xe28]
push ebx
mov esi, 0x1003e60
lea edi, [ebp - 0xe3c]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
mov esi, 0x1003e54
lea edi, [ebp - 0xc34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x1fc
lea eax, [ebp - 0xc28]
push ebx
push eax
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
push 8
pop ecx
mov esi, 0x1003e30
lea edi, [ebp - 0xa2c]
rep movsd dword es:[edi], dword [esi]
push 0x1e6
lea eax, [ebp - 0xa0a]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.msvcrt.dll_memset
mov esi, 0x1003e54
lea edi, [ebp - 0x824]
movsd dword es:[edi], dword [esi]
add esp, 0x48
movsd dword es:[edi], dword [esi]
push 0x1fc
lea eax, [ebp - 0x818]
push ebx
push eax
movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
push 5
pop ecx
push 0x1f4
lea eax, [ebp - 0x608]
push ebx
mov esi, 0x1003e1c
lea edi, [ebp - 0x61c]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.msvcrt.dll_memset
push 7
pop ecx
mov esi, 0x1003e00
lea edi, [ebp - 0x414]
push 0x1ec
rep movsd dword es:[edi], dword [esi]
push ebx
lea eax, [ebp - 0x3f8]
push eax
call sub.msvcrt.dll_memset
add esp, 0x24
push ebx
push ebx
push ebx
push 6
call fcn.0105989e
test eax, eax
jne 0x1039d58
call fcn.0105749a
test eax, eax
je 0x1039d58
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x24a0], eax
mov dword [ebp - 0x24b4], 2
push dword [ebp - 0x24a0]
mov esi, 0x104
push 0x1001750
push 0x1002b4c
lea eax, [ebp - 0x2494]
push esi
push eax
call fcn.01034d76
add esp, 0x14
test eax, eax
jl 0x1039d42
lea eax, [ebp - 0x249c]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x2494]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1039d42
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24a8]
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0x2498], ebx
mov dword [ebp - 0x24a8], esi
push ebx
jmp 0x1039d22
lea eax, [ebp - 0x24a4]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x249c]
mov dword [ebp - 0x24ac], ebx
mov dword [ebp - 0x24a4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1039cfa
lea eax, [ebp - 0x24b8]
push eax
lea eax, [ebp - 0x228c]
push eax
lea eax, [ebp - 0x24b0]
push eax
push ebx
push 0x1003de4
push dword [ebp - 0x24a4]
xor esi, esi
inc esi
mov dword [ebp - 0x24b8], 0x208
mov dword [ebp - 0x24b0], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1039cd0
cmp dword [ebp - 0x24b0], esi
jne 0x1039cd0
xor edi, edi
lea esi, [ebp - 0x2084]
lea eax, [ebp - 0x228c]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1039cc6
inc edi
add esi, 0x208
cmp edi, 0xd
jl 0x1039ca4
jmp 0x1039cd0
mov dword [ebp - 0x24ac], 1
push dword [ebp - 0x24a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x24ac], ebx
je 0x1039cfa
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x249c]
call fcn.01058684
test eax, eax
je 0x1039d00
inc dword [ebp - 0x2498]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24a8]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x2498]
mov dword [ebp - 0x24a8], 0x104
push dword [ebp - 0x249c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x1039c22
push dword [ebp - 0x249c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [ebp - 0x24a0], 0x208
dec dword [ebp - 0x24b4]
jne 0x1039baa
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret