Function at 0x1003c865
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3d0]
sub esp, 0x450
mov eax, dword [0x102bff3c]
xor eax, ebp
mov dword [ebp + 0x3cc], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp + 0x19c]
push 0
push eax
call fcn.101d1720
push 0x1023ae40
mov ebx, 0x104
lea eax, [ebp + 0x19c]
push ebx
push eax
call fcn.101df899
mov eax, dword [ebp + 0x3d8]
add esp, 0x18
mov dword [ebp - 0x70], eax
mov ecx, 0x102d7fd0
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.1003e4ce
mov eax, dword [ebp - 0x80]
push dword [eax + 0x14]
lea eax, [ebp + 0x19c]
push ebx
push eax
call fcn.101df824
add esp, 0xc
mov dword [ebp - 0x78], 0x26
xor eax, eax
lea edi, [ebp + 0x3a6]
xor bl, bl
push 9
pop ecx
rep stosd dword es:[edi], eax
mov word [ebp + 0x3a4], ax
call fcn.1019a8a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1003c9b7
push 0x208
lea eax, [ebp - 0x6c]
push 0
push eax
call fcn.101d1720
lea eax, [ebp + 0x19c]
push eax
lea eax, [ebp - 0x6c]
push 0x104
push eax
call fcn.101df899
push 0x1023ae1c
lea eax, [ebp - 0x6c]
push 0x104
push eax
call fcn.101df824
and dword [ebp - 0x70], 0
lea eax, [ebp - 0x70]
add esp, 0x24
push eax
push 0xf013f
push 0
lea eax, [ebp - 0x6c]
push eax
push connect
call esi
cmp dword [ebp - 0x70], 0
je 0x1003c99e
xor ecx, ecx
lea eax, [ebp - 0x7c]
push eax
push ecx
push ecx
push ecx
push 0x1023aebc
push dword [ebp - 0x70]
mov dword [ebp - 0x7c], ecx
call edi
cmp eax, 0xea
je 0x1003c993
test eax, eax
jne 0x1003c995
mov bl, 1
push dword [ebp - 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x1023aee4
lea eax, [ebp + 0x19c]
push 0x104
push eax
call fcn.101df824
add esp, 0xc
lea eax, [ebp - 0x74]
push eax
push 0x20019
push 0
lea eax, [ebp + 0x19c]
push eax
push connect
call esi
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x1003ca07
xor ecx, ecx
lea eax, [ebp - 0x74]
push ecx
push eax
push ecx
push 0x20019
push ecx
push ecx
push ecx
lea eax, [ebp + 0x19c]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x74]
test eax, eax
jne 0x1003ca07
xor al, al
jmp 0x1003cacf
lea ecx, [ebp - 0x78]
push ecx
lea ecx, [ebp + 0x3a4]
push ecx
push 0
push 0
push 0x1023aefc
push eax
call edi
mov esi, eax
test esi, esi
jne 0x1003ca7a
lea ecx, [ebp + 0x3a4]
mov eax, 0x1023af0c
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1003ca55
test dx, dx
je 0x1003ca51
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1003ca55
add eax, 4
add ecx, 4
test dx, dx
jne 0x1003ca2f
xor eax, eax
jmp 0x1003ca5a
sbb eax, eax
or eax, 1
test eax, eax
sete bl
cmp byte [ebp + 0x3dc], 0
jne 0x1003cac4
cmp word [ebp + 0x3a4], 0
je 0x1003ca76
test bl, bl
je 0x1003cac2
xor bl, bl
jmp 0x1003cac4
mov bh, byte [ebp + 0x3dc]
cmp esi, 0xea
jne 0x1003ca8c
test bh, bh
je 0x1003cac2
call fcn.1019a8a0
test eax, eax
jne 0x1003cac4
cmp esi, 2
jne 0x1003cac4
test bh, bh
jne 0x1003cac4
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x3a4]
push eax
push 0
push 0
push 0x1023af34
push dword [ebp - 0x74]
call edi
test eax, eax
je 0x1003cac2
cmp eax, 0xea
jne 0x1003cac4
mov bl, 1
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp + 0x3cc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101b70aa
lea esp, [ebp + 0x3d0]
pop ebp
ret