Function at 0x1003999
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.01005730
mov eax, dword [0x1007028]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x13f4]
push eax
xor edi, edi
push 0x20019
push edi
mov esi, ecx
push 0x10014e0
push 0x80000002
mov dword [ebp - 0x13f4], edi
mov dword [esi + 0x6a0], edi
mov dword [esi + 0x6a4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1004507
push 0x104
lea eax, [ebp - 0x390]
push eax
xor ebx, ebx
push edi
jmp 0x1003a0d
push 0x104
lea eax, [ebp - 0x390]
inc ebx
push eax
push ebx
push dword [ebp - 0x13f4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x10039ff
imul ebx, ebx, 0x248
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [esi + 0x6a4], eax
jne 0x1003a4c
push dword [ebp - 0x13f4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x100451e
push 0x104
lea eax, [ebp - 0x390]
push eax
push edi
push dword [ebp - 0x13f4]
mov dword [ebp - 0x141c], edi
mov dword [ebp - 0x1410], edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
je 0x10044fb
xor ebx, ebx
mov dword [ebp - 0x1414], edi
mov eax, dword [esi + 0x6a4]
lea eax, [eax + ebx + 0x18]
push eax
push 0x2000000
push edi
lea eax, [ebp - 0x390]
push eax
push dword [ebp - 0x13f4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100452b
lea eax, [ebp - 0x390]
push eax
mov eax, dword [esi + 0x6a4]
lea eax, [eax + ebx + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x140c]
push eax
lea eax, [ebp - 0x9a8]
push eax
lea eax, [ebp - 0x13ec]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push edi
mov dword [ebp - 0x140c], 0x208
mov dword [ebp - 0x13ec], 1
push dword [eax + ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100452b
push 0x27
lea eax, [ebp - 0x9a8]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, dword [esi + 0x6a4]
lea eax, [eax + ebx + 4]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
mov eax, dword [esi + 0x6a4]
mov dword [eax + ebx + 0x14], edi
mov eax, dword [esi + 0x6a4]
add eax, ebx
lea ecx, [eax + 0x14]
push ecx
push 0x100172c
push 1
push edi
add eax, 4
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x100452b
mov eax, dword [esi + 0x6a4]
mov dword [eax + ebx + 0x230], edi
test byte [esi + 0x65c], 1
je 0x1003b8f
mov eax, dword [esi + 0x6a4]
lea eax, [eax + ebx + 0x230]
or dword [eax], 0x20
cmp dword [esi + 0x664], edi
je 0x1003ba7
mov eax, dword [esi + 0x6a4]
lea eax, [eax + ebx + 0x230]
or dword [eax], 0x40
push 0x104
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x598]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, dword [esi + 0x6a4]
mov eax, dword [eax + ebx + 0x14]
mov ecx, dword [eax]
lea edx, [ebp - 0x1418]
push edx
push 0x100171c
push eax
call dword [ecx]
test eax, eax
jl 0x1003c4c
push 0x104
lea eax, [ebp - 0x390]
push eax
lea eax, [ebp - 0xbb0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1418]
mov ecx, dword [ecx]
add eax, ebx
lea edx, [eax + 0x230]
push edx
lea edx, [eax + 0x22c]
push edx
lea edx, [eax + 0x224]
push edx
lea edx, [eax + 0x228]
push edx
lea edx, [ebp - 0xbb0]
push edx
lea edx, [ebp - 0x598]
push edx
push dword [eax + 0x18]
push dword [ebp - 0x1418]
call dword [ecx + 0x20]
mov dword [ebp - 0x13f0], eax
mov eax, dword [ebp - 0x1418]
jmp 0x10042cf
push 0x400
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov dword [ecx + ebx + 0x224], eax
mov eax, dword [esi + 0x6a4]
add eax, ebx
mov ecx, dword [eax + 0x224]
cmp ecx, edi
mov dword [ebp - 0x13e4], ecx
je 0x1003a45
mov ecx, dword [eax + 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x13f0], ecx
lea ecx, [eax + 0x230]
push ecx
lea ecx, [eax + 0x224]
push ecx
lea ecx, [eax + 0x228]
push ecx
lea ecx, [ebp - 0x598]
push ecx
push dword [eax + 0x18]
push dword [ebp - 0x13f0]
call dword [edx + 0xc]
mov ecx, dword [ebp - 0x13e4]
mov dword [ebp - 0x13f0], eax
mov eax, dword [esi + 0x6a4]
cmp ecx, dword [eax + ebx + 0x224]
je 0x1003cd5
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
cmp dword [ebp - 0x13f0], edi
jne 0x10042db
lea eax, [ebp - 0x1408]
push eax
mov dword [ebp - 0x13f8], edi
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [ebp - 0x140c]
push eax
lea eax, [ebp - 0xdb8]
push eax
lea eax, [ebp - 0x13ec]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x100162c
mov dword [ebp - 0x140c], 0x208
mov dword [ebp - 0x13ec], 1
push dword [eax + ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003d7d
push 0x27
lea eax, [ebp - 0xdb8]
push eax
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
lea eax, [ebp - 0x13e0]
push eax
lea eax, [ebp - 0xb8]
push eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea eax, [ebp - 0x13f8]
push eax
push 0x100170c
push 1
push edi
lea eax, [ebp - 0x13e0]
push eax
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov eax, dword [esi + 0x6a4]
cmp dword [eax + ebx + 0x228], edi
jne 0x1003f47
cmp dword [ebp - 0x13f8], edi
je 0x1003e35
push 0x104
lea eax, [ebp - 0xfc0]
push eax
push 0x100161c
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
mov eax, dword [ebp - 0x13f8]
push edi
lea edx, [ebp - 0x1408]
push edx
lea edx, [ebp - 0xfc0]
push edx
mov word [ebp - 0x1408], 8
mov dword [ebp - 0x1400], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1003e35
cmp word [ebp - 0x1408], 8
jne 0x1003e28
push dword [ebp - 0x1400]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov dword [ecx + ebx + 0x228], eax
push dword [ebp - 0x1400]
mov eax, dword [esi + 0x6a4]
push dword [eax + ebx + 0x228]
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x1408]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esi + 0x6a4]
add eax, ebx
cmp dword [eax + 0x228], edi
jne 0x1003f47
lea ecx, [ebp - 0x13e8]
push ecx
push edi
lea ecx, [ebp - 0x13ec]
push ecx
push edi
push 0x100161c
mov dword [ebp - 0x13e8], edi
mov dword [ebp - 0x13ec], 1
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
mov eax, dword [ebp - 0x13e8]
inc ecx
cmp eax, ecx
ja 0x1003e9f
lea eax, [ebp - 0x390]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add eax, eax
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 0x13e4], eax
je 0x1003f47
lea eax, [ebp - 0x13e8]
push eax
push dword [ebp - 0x13e4]
lea eax, [ebp - 0x13ec]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x100161c
push dword [eax + ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1003ef9
lea eax, [ebp - 0x390]
push eax
push dword [ebp - 0x13e4]
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [ebp - 0x13e4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov dword [ecx + ebx + 0x228], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [eax + ebx + 0x228]
cmp eax, edi
je 0x1003f3b
push dword [ebp - 0x13e4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [ebp - 0x13e4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi + 0x6a4]
cmp dword [eax + ebx + 0x224], edi
jne 0x10040da
cmp dword [ebp - 0x13f8], edi
je 0x1003fff
push 0x104
lea eax, [ebp - 0x13d0]
push eax
push 0x1001604
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
mov eax, dword [ebp - 0x13f8]
push edi
lea edx, [ebp - 0x1408]
push edx
lea edx, [ebp - 0x13d0]
push edx
mov word [ebp - 0x1408], 8
mov dword [ebp - 0x1400], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x1003fff
cmp word [ebp - 0x1408], 8
jne 0x1003ff2
push dword [ebp - 0x1400]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov dword [ecx + ebx + 0x224], eax
push dword [ebp - 0x1400]
mov eax, dword [esi + 0x6a4]
push dword [eax + ebx + 0x224]
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x1408]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esi + 0x6a4]
add eax, ebx
cmp dword [eax + 0x224], edi
jne 0x10040da
lea ecx, [ebp - 0x13e8]
push ecx
push edi
lea ecx, [ebp - 0x13ec]
push ecx
push edi
push 0x1001604
mov dword [ebp - 0x13e8], edi
mov dword [ebp - 0x13ec], 1
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [ebp - 0x13e8]
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 0x13e4], eax
je 0x10040da
lea eax, [ebp - 0x13e8]
push eax
push dword [ebp - 0x13e4]
lea eax, [ebp - 0x13ec]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x1001604
push dword [eax + ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10040ce
push dword [ebp - 0x13e4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov dword [ecx + ebx + 0x224], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [eax + ebx + 0x224]
cmp eax, edi
je 0x10040ce
push dword [ebp - 0x13e4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [ebp - 0x13e4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esi + 0x6a4]
mov dword [eax + ebx + 0x22c], edi
mov eax, dword [esi + 0x6a4]
test byte [eax + ebx + 0x230], 1
je 0x10042c5
cmp dword [ebp - 0x13f8], edi
je 0x10041a0
push 0x104
lea eax, [ebp - 0x11c8]
push eax
push 0x10015dc
call dword [sym.imp.SHLWAPI.dll_SHUnicodeToUnicode]
mov eax, dword [ebp - 0x13f8]
push edi
lea edx, [ebp - 0x1408]
push edx
lea edx, [ebp - 0x11c8]
push edx
mov word [ebp - 0x1408], 8
mov dword [ebp - 0x1400], edi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x10041a0
cmp word [ebp - 0x1408], 8
jne 0x1004193
push dword [ebp - 0x1400]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov dword [ecx + ebx + 0x22c], eax
push dword [ebp - 0x1400]
mov eax, dword [esi + 0x6a4]
push dword [eax + ebx + 0x22c]
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp - 0x1408]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esi + 0x6a4]
cmp dword [eax + ebx + 0x22c], edi
jne 0x10042c5
push 0x32
lea eax, [ebp - 0x68]
push eax
push 0x13
push dword [0x1007038]
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x13e8]
push eax
push edi
lea eax, [ebp - 0x13ec]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x10015dc
mov dword [ebp - 0x13e8], edi
mov dword [ebp - 0x13ec], 1
push dword [eax + ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x13e8]
cmp eax, ecx
ja 0x1004222
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
cmp eax, edi
mov dword [ebp - 0x13e4], eax
je 0x10042c5
lea eax, [ebp - 0x13e8]
push eax
push dword [ebp - 0x13e4]
lea eax, [ebp - 0x13ec]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x10015dc
push dword [eax + ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004277
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x13e4]
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [ebp - 0x13e4]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [esi + 0x6a4]
mov dword [ecx + ebx + 0x22c], eax
mov eax, dword [esi + 0x6a4]
mov eax, dword [eax + ebx + 0x22c]
cmp eax, edi
je 0x10042b9
push dword [ebp - 0x13e4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [ebp - 0x13e4]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x13f8]
cmp eax, edi
je 0x10042ed
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x13f0], edi
jl 0x100452b
cmp dword [ebp - 0x13f0], edi
jne 0x100452b
mov eax, dword [esi + 0x6a4]
push 4
mov dword [eax + ebx + 0x240], 1
pop eax
mov dword [ebp - 0x13e8], eax
mov dword [ebp - 0x13ec], eax
mov eax, dword [esi + 0x6a4]
add eax, ebx
lea ecx, [ebp - 0x13e8]
push ecx
lea ecx, [eax + 0x234]
push ecx
lea ecx, [ebp - 0x13ec]
push ecx
push edi
push 0x10015c8
push dword [eax + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x100434e
mov eax, dword [esi + 0x6a4]
mov dword [eax + ebx + 0x234], 0xc8
test byte [esi + 0x65c], 3
lea eax, [ebp - 0x188]
jne 0x100436b
push 0x1001570
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1004385
push dword [esi + 0x660]
push 0x1001570
push 0x1001560
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
test byte [esi + 0x65c], 8
push 4
pop eax
mov dword [ebp - 0x1420], edi
mov dword [ebp - 0x13e8], eax
mov dword [ebp - 0x13ec], eax
je 0x10043bc
mov eax, dword [esi + 0x6a4]
mov ecx, dword [ebp - 0x1414]
mov dword [eax + ecx + 0x244], 1
jmp 0x100443a
lea eax, [ebp - 0x13e8]
push eax
lea eax, [ebp - 0x1420]
push eax
lea eax, [ebp - 0x13ec]
push eax
push edi
lea eax, [ebp - 0x188]
push eax
mov eax, dword [esi + 0x6a4]
push dword [eax + ebx + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004413
test byte [esi + 0x65c], 3
mov ecx, dword [esi + 0x6a4]
mov eax, dword [ebp - 0x1420]
jne 0x100440e
and eax, 1
mov dword [ecx + ebx + 0x244], eax
jmp 0x100443a
and eax, 2
jmp 0x1004405
mov eax, dword [esi + 0x6a4]
add eax, ebx
test byte [esi + 0x65c], 3
mov ecx, dword [eax + 0x230]
jne 0x100442e
shr ecx, 1
jmp 0x1004431
shr ecx, 3
and ecx, 1
mov dword [eax + 0x244], ecx
lea eax, [ebp - 0x13e8]
push eax
lea eax, [ebp - 0x7a0]
push eax
lea eax, [ebp - 0x13ec]
push eax
mov eax, dword [esi + 0x6a4]
push edi
push 0x10015b4
mov dword [ebp - 0x13e8], 0x208
push dword [eax + ebx + 0x18]
mov dword [ebp - 0x13f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1004485
mov dword [ebp - 0x13f0], 1
jmp 0x1004499
lea eax, [ebp - 0x9a8]
push eax
lea eax, [ebp - 0x7a0]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [ebp - 0x13f0]
lea eax, [ebp - 0x7a0]
push eax
mov ecx, esi
call fcn.01003465
mov ecx, dword [esi + 0x6a4]
inc dword [ebp - 0x1410]
mov dword [ebx + ecx], eax
add ebx, 0x248
inc dword [ebp - 0x141c]
add dword [ebp - 0x1414], 0x248
push 0x104
lea eax, [ebp - 0x390]
push eax
push dword [ebp - 0x141c]
push dword [ebp - 0x13f4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, 0x103
jne 0x1003a84
mov eax, dword [ebp - 0x1410]
mov dword [esi + 0x6a0], eax
cmp dword [ebp - 0x13f4], edi
je 0x100451b
push dword [ebp - 0x13f4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01005499
leave
ret
mov eax, dword [esi + 0x6a4]
add eax, ebx
push eax
mov ecx, esi
call fcn.01003244
mov edi, dword [esi + 0x6a4]
xor eax, eax
add edi, ebx
mov ecx, 0x92
rep stosd dword es:[edi], eax
xor edi, edi
jmp 0x10044c2