Function at 0x1038143
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x10723e4]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
push 0x20019
xor edi, edi
push edi
push 0x10142ec
push dword [0x10736c0]
call ebx
test eax, eax
jne 0x103825b
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 9
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x103825b
xor edx, edx
mov al, byte [ebp + edx - 0x10]
cmp al, 0x30
jl 0x10381d3
cmp al, 0x39
jg 0x10381d3
movsx eax, al
sub eax, 0x30
jmp 0x10381f6
cmp al, 0x61
jl 0x10381e3
cmp al, 0x66
jg 0x10381e3
movsx eax, al
sub eax, 0x57
jmp 0x10381f6
cmp al, 0x41
jl 0x10381f3
cmp al, 0x46
jg 0x10381f3
movsx eax, al
sub eax, 0x37
jmp 0x10381f6
or eax, 0xffffffff
mov cl, byte [ebp + edx - 0xf]
cmp cl, 0x30
jl 0x103820c
cmp cl, 0x39
jg 0x103820c
movsx ecx, cl
sub ecx, 0x30
jmp 0x1038233
cmp cl, 0x61
jl 0x103821e
cmp cl, 0x66
jg 0x103821e
movsx ecx, cl
sub ecx, 0x57
jmp 0x1038233
cmp cl, 0x41
jl 0x1038230
cmp cl, 0x46
jg 0x1038230
movsx ecx, cl
sub ecx, 0x37
jmp 0x1038233
or ecx, 0xffffffff
cmp eax, edi
jl 0x103854f
cmp ecx, edi
jl 0x103854f
shl al, 4
add al, cl
mov ecx, dword [ebp - 0x28]
inc dword [ebp - 0x28]
inc edx
inc edx
cmp edx, 8
mov byte [ecx], al
jb 0x10381bf
lea eax, [ebp - 0x24]
push eax
push 0x20019
push edi
push 0x10142e0
push dword [0x10736c0]
call ebx
test eax, eax
jne 0x103834c
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 9
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x103834c
xor edx, edx
mov al, byte [ebp + edx - 0x10]
cmp al, 0x30
jl 0x10382c4
cmp al, 0x39
jg 0x10382c4
movsx eax, al
sub eax, 0x30
jmp 0x10382e7
cmp al, 0x61
jl 0x10382d4
cmp al, 0x66
jg 0x10382d4
movsx eax, al
sub eax, 0x57
jmp 0x10382e7
cmp al, 0x41
jl 0x10382e4
cmp al, 0x46
jg 0x10382e4
movsx eax, al
sub eax, 0x37
jmp 0x10382e7
or eax, 0xffffffff
mov cl, byte [ebp + edx - 0xf]
cmp cl, 0x30
jl 0x10382fd
cmp cl, 0x39
jg 0x10382fd
movsx ecx, cl
sub ecx, 0x30
jmp 0x1038324
cmp cl, 0x61
jl 0x103830f
cmp cl, 0x66
jg 0x103830f
movsx ecx, cl
sub ecx, 0x57
jmp 0x1038324
cmp cl, 0x41
jl 0x1038321
cmp cl, 0x46
jg 0x1038321
movsx ecx, cl
sub ecx, 0x37
jmp 0x1038324
or ecx, 0xffffffff
cmp eax, edi
jl 0x103854f
cmp ecx, edi
jl 0x103854f
shl al, 4
add al, cl
mov ecx, dword [ebp - 0x28]
inc dword [ebp - 0x28]
inc edx
inc edx
cmp edx, 8
mov byte [ecx], al
jb 0x10382b0
lea eax, [ebp - 0x24]
push eax
push 0x20019
push edi
push 0x10142d8
push dword [0x10736c0]
call ebx
test eax, eax
jne 0x103843d
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 9
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x103843d
xor edx, edx
mov al, byte [ebp + edx - 0x10]
cmp al, 0x30
jl 0x10383b5
cmp al, 0x39
jg 0x10383b5
movsx eax, al
sub eax, 0x30
jmp 0x10383d8
cmp al, 0x61
jl 0x10383c5
cmp al, 0x66
jg 0x10383c5
movsx eax, al
sub eax, 0x57
jmp 0x10383d8
cmp al, 0x41
jl 0x10383d5
cmp al, 0x46
jg 0x10383d5
movsx eax, al
sub eax, 0x37
jmp 0x10383d8
or eax, 0xffffffff
mov cl, byte [ebp + edx - 0xf]
cmp cl, 0x30
jl 0x10383ee
cmp cl, 0x39
jg 0x10383ee
movsx ecx, cl
sub ecx, 0x30
jmp 0x1038415
cmp cl, 0x61
jl 0x1038400
cmp cl, 0x66
jg 0x1038400
movsx ecx, cl
sub ecx, 0x57
jmp 0x1038415
cmp cl, 0x41
jl 0x1038412
cmp cl, 0x46
jg 0x1038412
movsx ecx, cl
sub ecx, 0x37
jmp 0x1038415
or ecx, 0xffffffff
cmp eax, edi
jl 0x103854f
cmp ecx, edi
jl 0x103854f
shl al, 4
add al, cl
mov ecx, dword [ebp - 0x28]
inc dword [ebp - 0x28]
inc edx
inc edx
cmp edx, 8
mov byte [ecx], al
jb 0x10383a1
lea eax, [ebp - 0x24]
push eax
push 0x20019
push edi
push 0x10142cc
push dword [0x10736c0]
call ebx
test eax, eax
jne 0x1038524
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x24]
mov dword [ebp - 0x2c], 9
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
push dword [ebp - 0x24]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
jne 0x1038524
mov esi, dword [ebp - 0x28]
xor edx, edx
mov al, byte [ebp + edx - 0x10]
cmp al, 0x30
jl 0x10384a9
cmp al, 0x39
jg 0x10384a9
movsx eax, al
sub eax, 0x30
jmp 0x10384cc
cmp al, 0x61
jl 0x10384b9
cmp al, 0x66
jg 0x10384b9
movsx eax, al
sub eax, 0x57
jmp 0x10384cc
cmp al, 0x41
jl 0x10384c9
cmp al, 0x46
jg 0x10384c9
movsx eax, al
sub eax, 0x37
jmp 0x10384cc
or eax, 0xffffffff
mov cl, byte [ebp + edx - 0xf]
cmp cl, 0x30
jl 0x10384e2
cmp cl, 0x39
jg 0x10384e2
movsx ecx, cl
sub ecx, 0x30
jmp 0x1038509
cmp cl, 0x61
jl 0x10384f4
cmp cl, 0x66
jg 0x10384f4
movsx ecx, cl
sub ecx, 0x57
jmp 0x1038509
cmp cl, 0x41
jl 0x1038506
cmp cl, 0x46
jg 0x1038506
movsx ecx, cl
sub ecx, 0x37
jmp 0x1038509
or ecx, 0xffffffff
cmp eax, edi
jl 0x103854f
cmp ecx, edi
jl 0x103854f
shl al, 4
add al, cl
mov byte [esi], al
inc esi
inc edx
inc edx
cmp edx, 8
jb 0x1038495
xor eax, eax
movzx ecx, byte [eax + 0x1072308]
mov dl, byte [ebp + eax - 0x20]
mov esi, dword [ebp - 0x30]
inc eax
cmp eax, 0x10
mov byte [ecx + esi], dl
jb 0x1038526
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0103d24a
leave
ret 4
xor eax, eax
jmp 0x1038540