Function at 0x1003ef9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push esi
push 1
call fcn.01002f00
pop ecx
pop ecx
lea eax, [ebp - 4]
push eax
push 0x20019
xor edi, edi
push edi
add esi, 0x618
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, edi
mov esi, dword [ebp + 8]
jne 0x1003f6f
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push edi
push 0x100175c
push dword [ebp - 4]
mov dword [ebp - 8], 0xf90
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov ebx, eax
mov word [esi + 0xf8e], di
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, edi
je 0x100419c
push 0x1001748
mov edi, 0x84
push edi
lea eax, [esi + 4]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x1001730
push edi
lea eax, [esi + 0x10c]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
mov eax, dword [ebp + 0xc]
add eax, 0x820
push eax
push edi
lea eax, [esi + 0x21c]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x1001720
push edi
lea eax, [esi + 0x324]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x1001710
push edi
lea eax, [esi + 0x42c]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10016fc
push edi
lea eax, [esi + 0x534]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10016dc
push edi
lea eax, [esi + 0x648]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x1001720
push edi
lea eax, [esi + 0x768]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x1001690
push 0x28
lea eax, [esi + 0x870]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x1001640
push 0x28
lea eax, [esi + 0x8c0]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10015f0
push 0x28
lea eax, [esi + 0x910]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10014d4
push edi
lea eax, [esi + 0x960]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10014d4
push edi
lea eax, [esi + 0xa68]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10014d4
push edi
lea eax, [esi + 0xc78]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10014d4
push edi
lea eax, [esi + 0xb70]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10014d4
push edi
lea eax, [esi + 0xd80]
push eax
call fcn.010039ea
mov ebx, eax
test ebx, ebx
jl 0x10041b9
push 0x10014d4
push edi
lea eax, [esi + 0xe88]
push eax
call fcn.010039ea
mov ebx, eax
xor eax, eax
cmp ebx, eax
jl 0x10041b9
mov dword [esi + 0x214], 8
mov dword [esi + 0x218], eax
mov dword [esi + 0x63c], eax
mov dword [esi + 0x640], eax
mov dword [esi + 0x644], eax
mov dword [esi + 0x750], eax
mov dword [esi + 0x754], eax
mov dword [esi + 0x758], eax
mov dword [esi + 0x75c], eax
mov dword [esi + 0x760], eax
mov dword [esi + 0x764], eax
xor ebx, ebx
jmp 0x10041b9
add esi, 0x324
cmp word [esi], di
jne 0x10041b9
push 0x1001720
push 0x84
push esi
call fcn.010039ea
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret