Function at 0x10003464
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1006106a
call fcn.100608e8
sub esp, 0x28
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x14], edx
je 0x1000367e
cmp byte [ebp + 0x14], 0
je 0x10003505
mov ebx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov esi, dword [ebx + 4]
mov eax, dword [ecx + 4]
sub esi, dword [ebx]
sub eax, dword [ecx]
sar esi, 2
sar eax, 2
cmp esi, eax
jbe 0x100034bd
push edi
push ecx
push ecx
mov edx, ecx
mov dword [edi], esi
mov ecx, dword [ebp - 0x14]
call fcn.10004c2e
add esp, 0xc
jmp 0x1000369c
push ecx
push ecx
push 0x2fc0
push edi
push 0x531c
push ecx
push 0x445
mov dl, 1
call fcn.10003251
mov ecx, dword [ebp - 0x14]
mov edx, 0x627d
push 0x5065
push 0
push 1
push ebx
push edi
push 0x3b0
push 0x5938
push 1
push 0x30c3
call fcn.10004c60
add esp, 0x40
jmp 0x100034b8
mov dword [ebp - 0x18], 0x1318
xor ebx, ebx
cmp dword [ebp - 0x18], 0x140e
jle 0x1000358d
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp + 0x10], ebx
mov eax, esi
mov esi, ebx
cdq
idiv edi
mov edi, edx
mov eax, edi
lea ecx, [ebp - 0x34]
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003546
mov eax, dword [eax]
push eax
call fcn.10048acd
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.10006880
inc esi
cmp esi, 0x171d
jl 0x1000352a
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp + 0x10], edi
cmp edi, 0x5781
jl 0x10003521
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x8028
jl 0x1000351c
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov byte [ebp + 0x13], bl
cmp dword [ebp - 0x18], 0x10d7
jge 0x100035a4
push str.pfbluwkg_lfctjc_fafy_dkf_mfwdb_wtgruig_wjjgybvaw_vuuietqaa_lmmkv_dml_zfquofvz
call fcn.10048acd
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x13], 0
je 0x100034b8
push ebx
push 0x217e
mov ecx, 0x763
call fcn.10001ae7
mov dword [ebp - 0x1c], 0x75af
cmp dword [ebp - 0x1c], 0x770a
pop ecx
pop ecx
jle 0x1000363c
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov eax, esi
mov ecx, ebx
cdq
idiv edi
mov dword [ebp + 0x10], ecx
mov edi, edx
mov esi, ebx
mov ebx, edi
shl ebx, cl
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1007cdd8
cdq
push edx
push eax
call fcn.10005d27
inc esi
cmp esi, 0x611f
jl 0x100035f0
mov ecx, dword [ebp + 0x10]
inc ecx
mov dword [ebp + 0x10], ecx
push 0
pop ebx
cmp ecx, 0x3ad1
jl 0x100035ea
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1400
jl 0x100035de
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x7396
jl 0x100035d9
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x72f7
jge 0x100034b8
mov edx, str.hgiqcg_hluy_vgqs_rgvyrg_eaiwkoozp_nuezy_gza_usthnipt_vfkyriy
mov ecx, 0x1007cdd8
call fcn.100089dc
jmp 0x100034b8
cmp byte [ebp + 0x18], 0
je 0x1000368c
mov eax, dword [ebp + 0x1c]
and dword [eax], 0
jmp 0x1000369c
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x1000369c
push 0
call dword [sym.imp.USER32.dll_DestroyCursor]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret