Function at 0x10003360
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
xor eax, eax
mov ecx, 0x40
lea edi, [ebp - 0x12b]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x12c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x12c]
push eax
push 0x100062d8
push 0x100062d0
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
pushal
test ax, 0xc7b
test ah, ch
or cx, 0x31fd
mov bx, ax
popal
lea edx, [ebp - 4]
lea eax, [ebp - 0x12c]
push edx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, dword [ebp + 0x24]
test eax, eax
jne 0x1000356d
jbe 0x100033f1
push eax
pop eax
ja 0x100033f1
pop esi
fisubr dword [ecx + 0x7a96ed64]
dec esp
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push eax
push 0
push ecx
push edx
mov dword [ebp + 0xc], 4
call edi
test eax, eax
jne 0x1000356d
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, dword [esi]
xor eax, ecx
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
push eax
push ecx
dec cx
xor eax, 0x687c
test dx, cx
test ah, 0x30
mov cx, 0xcd1
pop ecx
pop eax
lea edx, [ebp + 0xc]
lea eax, [ebp - 0x20]
push edx
mov edx, dword [ebp + 0x18]
lea ecx, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push ecx
push 0
push edx
push eax
mov dword [ebp + 0xc], 6
call edi
test eax, eax
jne 0x1000356d
mov cx, word [esi + 4]
mov eax, dword [ebp + 0x1c]
xor cx, word [ebp - 0x20]
mov word [eax], cx
mov dx, word [esi + 6]
xor dx, word [ebp - 0x1e]
mov word [eax + 2], dx
mov cx, word [esi + 8]
xor cx, word [ebp - 0x1c]
mov word [eax + 4], cx
push edx
push cx
push di
or dh, 6
or cl, 0x58
xor dl, dl
inc ch
test ax, cx
dec di
mov edx, 0x33a8
and cx, di
add dx, 0x64c0
pop di
pop cx
pop edx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp + 0xc]
lea eax, [ebp - 0x18]
push edx
mov edx, dword [ebp + 0x20]
lea ecx, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push ecx
push 0
push edx
push eax
mov dword [ebp + 0xc], 6
call edi
test eax, eax
jne 0x1000356d
mov cx, word [esi + 0xa]
xor cx, word [ebp - 0x18]
mov word [ebx], cx
mov dx, word [esi + 0xc]
xor dx, word [ebp - 0x16]
mov word [ebx + 2], dx
mov ax, word [esi + 0xe]
xor ax, word [ebp - 0x14]
mov word [ebx + 4], ax
jle 0x10003511
or ah, byte [esi + 0x56]
push si
mov si, 0xf280
pop si
jg 0x10003511
lea ecx, [ebp + 0xc]
lea edx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 0x28]
lea eax, [ebp - 8]
push edx
mov edx, dword [ebp - 4]
push eax
push 0
push ecx
push edx
mov dword [ebp + 0xc], 4
call edi
test eax, eax
jne 0x1000356d
jb 0x10003559
push di
mov di, 0x4fff
pop di
jae 0x10003559
fdiv dword [esi + 0x6f]
cmp esp, dword [eax]
inc eax
push 0xb7f8c08b
ja 0x10003506
inc ecx
invalid
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0x10]
xor eax, ecx
mov ecx, dword [ebp + 0x2c]
mov edi, 1
mov dword [ecx], eax
jmp 0x10003570
mov edi, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000357e
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jbe 0x100035a0
push si
mov si, 0x5c11
pop si
ja 0x100035a0
jo 0x1000354e
push cs
invalid
test edi, edi
jne 0x100035e7
mov edx, dword [ebp + 0x1c]
mov eax, 8
mov word [ebp - 0x28], 0x7d8
mov word [ebp - 0x26], ax
mov ecx, dword [ebp - 0x28]
mov dword [edx], ecx
mov word [edx + 4], ax
mov dword [ebx], ecx
mov word [ebx + 4], ax
push eax
push edx
push esi
test si, 0x2af8
xor edx, ecx
add ax, bx
or ax, 0x11a9
pop esi
pop edx
pop eax
mov edx, dword [ebp + 0x2c]
mov eax, dword [ebp + 0x14]
mov dword [edx], edi
mov dword [eax], 2
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret