Function at 0x10038239
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x2bc
mov eax, 0x1010bbd8
call fcn.100c7e75
mov esi, ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], eax
mov byte [ebp - 0x285], bl
mov dword [ebp - 0x27c], ebx
push 0xf
pop edi
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], edi
mov byte [ebp - 0x27c], bl
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x264]
push edx
mov dword [ebp - 0x264], ebx
mov dword [ebp - 0x254], ebx
mov dword [ebp - 0x250], ebx
call fcn.100147f1
mov byte [ebp - 4], 2
cmp dword [esi + 0x10], ebx
je 0x10038593
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], edi
mov byte [ebp - 0x24c], bl
lea edx, [ebp - 0x24c]
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.10015bb3
mov ebx, eax
mov dword [ebp - 0x290], ebx
test ebx, ebx
jne 0x100382ed
lea ecx, [ebp - 0x24c]
call fcn.10002013
jmp 0x10038593
lea edx, [ebp - 0x24c]
lea ecx, [ebp - 0x234]
call fcn.1000e6f0
push eax
lea ecx, [ebp - 0x27c]
call fcn.1000fedd
lea ecx, [ebp - 0x234]
call fcn.10002013
cmp dword [ebp - 0x254], 0
jne 0x1003838a
lea edx, [ebp - 0x24c]
lea ecx, [ebp - 0x2b0]
call fcn.10018e09
mov edx, eax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x234]
call fcn.1000e6f0
push eax
lea ecx, [ebp - 0x27c]
call fcn.1000fedd
lea ecx, [ebp - 0x234]
call fcn.10002013
lea ecx, [ebp - 0x2b0]
mov byte [ebp - 4], 4
call fcn.10002013
mov edx, esi
lea ecx, [ebp - 0x2b0]
call fcn.10015f8e
push eax
lea ecx, [ebp - 0x264]
call fcn.1000fedd
lea ecx, [ebp - 0x2b0]
call fcn.10002013
xor eax, eax
lea edi, [ebp - 0x228]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor edi, edi
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], edi
mov dword [ebp - 0x220], edi
push ecx
push ecx
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 6
call fcn.10014342
push ecx
lea edx, [ebp - 0x27c]
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x2b0]
call fcn.10016675
pop ecx
cmp dword [eax + 0x14], 8
jb 0x100383d9
mov eax, dword [eax]
push 0x20019
push eax
push ebx
lea ecx, [ebp - 0x228]
call fcn.10015dda
lea ecx, [ebp - 0x2b0]
mov esi, eax
call fcn.100145b0
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 6
call fcn.100143bd
test esi, esi
jne 0x10038574
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
push edi
push eax
call fcn.100c95b0
pop ecx
lea ecx, [ebp - 0x298]
call fcn.10014342
push ecx
lea edx, [ebp - 0x264]
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x2b0]
call fcn.10016675
pop ecx
cmp dword [eax + 0x14], 8
jb 0x1003844d
mov eax, dword [eax]
mov ebx, dword [ebp - 0x228]
lea ecx, [ebp - 0x280]
push ecx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x280], esi
push ecx
lea ecx, [ebp - 0x21c]
push ecx
xor ecx, ecx
push ecx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x100384c8
cmp dword [ebp - 0x21c], 1
je 0x10038496
cmp dword [ebp - 0x21c], 2
je 0x10038496
push 0xd
pop esi
jmp 0x100384c8
mov ecx, dword [ebp - 0x280]
test ecx, ecx
je 0x100384b7
test cl, 1
jne 0x10038491
mov eax, ecx
xor edx, edx
shr eax, 1
cmp word [ebp + eax*2 - 0x21a], dx
je 0x100384c0
jmp 0x10038491
xor eax, eax
mov word [ebp - 0x218], ax
mov edi, ecx
shr edi, 1
xor eax, eax
mov esi, eax
lea ecx, [ebp - 0x2b0]
call fcn.100145b0
lea ecx, [ebp - 0x298]
mov byte [ebp - 4], 6
call fcn.100143bd
test esi, esi
jne 0x10038551
push ecx
push ecx
lea ecx, [ebp - 0x298]
call fcn.10014342
push edi
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 9
push eax
lea ecx, [ebp - 0x2c8]
call fcn.1001fbab
push ecx
mov edx, eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x2b0]
call fcn.1001404f
pop ecx
mov ecx, dword [ebp - 0x28c]
push eax
call fcn.1000fedd
lea ecx, [ebp - 0x2b0]
call fcn.10002013
lea ecx, [ebp - 0x2c8]
call fcn.100145b0
lea ecx, [ebp - 0x298]
call fcn.100143bd
mov byte [ebp - 0x285], 1
test ebx, ebx
je 0x10038566
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [ebp - 0x228], eax
jmp 0x10038568
xor eax, eax
mov ebx, dword [ebp - 0x290]
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x228]
lea esi, [ebp - 0x24c]
call fcn.10016044
mov ecx, esi
call fcn.10002013
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x264]
call fcn.10002013
lea ecx, [ebp - 0x27c]
call fcn.10002013
mov al, byte [ebp - 0x285]
call fcn.100c7e24
ret