Function at 0x100032f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10055cb2
mov eax, dword fs:[0]
push eax
sub esp, 0x950
mov eax, dword [0x10076008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x95c], ecx
mov dword [ebp - 0x934], 0
lea ecx, [ebp - 0x8a0]
call fcn.10005620
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x828]
call fcn.10005620
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x888]
call fcn.10005620
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x870]
call fcn.10005620
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x858]
call fcn.10005620
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x840]
call fcn.10005620
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
add ecx, 0xc0
call fcn.100057f0
mov edx, eax
lea ecx, [ebp - 0x8b8]
call fcn.1002ede0
mov dword [ebp - 0x944], eax
mov eax, dword [ebp - 0x944]
push eax
lea ecx, [ebp - 0x888]
call fcn.100054a0
lea ecx, [ebp - 0x8b8]
call fcn.10005450
mov ecx, dword [ebp + 0xc]
add ecx, 0xa8
call fcn.100057f0
mov edx, eax
lea ecx, [ebp - 0x8d0]
call fcn.1002ede0
mov dword [ebp - 0x948], eax
mov ecx, dword [ebp - 0x948]
push ecx
lea ecx, [ebp - 0x870]
call fcn.100054a0
lea ecx, [ebp - 0x8d0]
call fcn.10005450
mov ecx, dword [ebp + 0xc]
add ecx, 0xd8
call fcn.100057f0
mov edx, eax
lea ecx, [ebp - 0x8e8]
call fcn.1002ede0
mov dword [ebp - 0x94c], eax
mov edx, dword [ebp - 0x94c]
push edx
lea ecx, [ebp - 0x858]
call fcn.100054a0
lea ecx, [ebp - 0x8e8]
call fcn.10005450
mov ecx, dword [ebp + 0xc]
add ecx, 0xf0
call fcn.100057f0
mov edx, eax
lea ecx, [ebp - 0x900]
call fcn.1002ede0
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
push eax
lea ecx, [ebp - 0x840]
call fcn.100054a0
lea ecx, [ebp - 0x900]
call fcn.10005450
lea ecx, [ebp - 0x888]
call fcn.10005340
movzx ecx, al
test ecx, ecx
jne 0x100034cc
lea ecx, [ebp - 0x870]
call fcn.10005340
movzx edx, al
test edx, edx
jne 0x100034cc
lea ecx, [ebp - 0x858]
call fcn.10005340
movzx eax, al
test eax, eax
jne 0x100034cc
lea ecx, [ebp - 0x840]
call fcn.10005340
movzx ecx, al
test ecx, ecx
je 0x1000354f
lea edx, [ebp - 0x828]
push edx
mov ecx, dword [ebp + 8]
call fcn.10005530
mov eax, dword [ebp - 0x934]
or eax, 1
mov dword [ebp - 0x934], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x840]
call fcn.10005450
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x858]
call fcn.10005450
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x870]
call fcn.10005450
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x888]
call fcn.10005450
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x828]
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a0]
call fcn.10005450
mov eax, dword [ebp + 8]
jmp 0x1000372f
lea ecx, [ebp - 0x840]
call fcn.10005370
push eax
lea ecx, [ebp - 0x858]
call fcn.10005370
push eax
lea ecx, [ebp - 0x870]
call fcn.10005370
push eax
lea ecx, [ebp - 0x888]
call fcn.10005370
push eax
push 0x10066e10
lea ecx, [ebp - 0x918]
push ecx
call fcn.1002eaa0
add esp, 0x18
mov dword [ebp - 0x954], eax
mov edx, dword [ebp - 0x954]
push edx
lea ecx, [ebp - 0x8a0]
call fcn.100054a0
lea ecx, [ebp - 0x918]
call fcn.10005450
mov dword [ebp - 0x938], 0
mov dword [ebp - 0x93c], 0
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.10033d10
add esp, 0xc
lea ecx, [ebp - 0x938]
push ecx
push 1
push 0
lea ecx, [ebp - 0x8a0]
call fcn.10005370
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x940], eax
cmp dword [ebp - 0x940], 0
jne 0x10003652
mov dword [ebp - 0x93c], 0x800
lea edx, [ebp - 0x93c]
push edx
lea eax, [ebp - 0x810]
push eax
push 0
push 0
push str.SerialNumber
mov ecx, dword [ebp - 0x938]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x940], eax
mov edx, dword [ebp - 0x938]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x810]
test edx, edx
je 0x10003678
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.100053c0
lea ecx, [ebp - 0x828]
push ecx
lea edx, [ebp - 0x930]
push edx
call fcn.10006df0
add esp, 8
mov dword [ebp - 0x958], eax
mov eax, dword [ebp - 0x958]
push eax
lea ecx, [ebp - 0x828]
call fcn.100054a0
lea ecx, [ebp - 0x930]
call fcn.10005450
lea ecx, [ebp - 0x828]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10005530
mov edx, dword [ebp - 0x934]
or edx, 1
mov dword [ebp - 0x934], edx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x840]
call fcn.10005450
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x858]
call fcn.10005450
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x870]
call fcn.10005450
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x888]
call fcn.10005450
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x828]
call fcn.10005450
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8a0]
call fcn.10005450
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1002fa64
mov esp, ebp
pop ebp
ret 8