Function at 0x1003135
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x100923c]
and dword [ebp - 0x44], 0
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x48]
push eax
mov ebx, 0x20019
push ebx
push 0
push 0x1001450
mov edi, 0x80000001
push edi
call esi
test eax, eax
je 0x1003186
lea eax, [ebp - 0x48]
push eax
push ebx
push 0
push 0x10013f0
push edi
call esi
test eax, eax
je 0x1003186
xor eax, eax
jmp 0x10031fa
push 0x32
pop esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0
push 0x1001774
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10031ee
push 0x2c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.01005d6c
push 4
pop eax
cmp word [ebp - 0xc], ax
jne 0x10031d2
cmp word [ebp - 0xa], 0x47
jb 0x10031ee
mov dword [ebp - 0x44], 1
jmp 0x10031ee
cmp word [ebp - 0xc], 5
jne 0x10031e4
cmp word [ebp - 0xa], si
sbb eax, eax
add eax, 3
jmp 0x10031eb
cmp word [ebp - 0xc], 6
jne 0x10031ee
mov dword [ebp - 0x44], eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005857
leave
ret

Function at 0x100320c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100923c]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10014c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003287
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
push esi
push 0x10014e4
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100327e
push 0x2e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.01005d6c
cmp word [ebp - 0xc], 4
jne 0x100327e
cmp word [ebp - 0xa], 0x47
jb 0x100327e
inc esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.01005857
leave
ret

Function at 0x1003299
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100923c]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push 0x20019
xor esi, esi
push esi
push 0x10014c0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1003314
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x40]
push eax
push esi
push esi
push 0x10014f8
push dword [ebp - 0x44]
mov dword [ebp - 0x48], 0x32
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100330b
push 0x2e
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.01005d6c
cmp word [ebp - 0xc], 4
jne 0x100330b
cmp word [ebp - 0xa], 0x47
jb 0x100330b
inc esi
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.01005857
leave
ret