Function at 0x1033f15
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x1099a38]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x31c], 0x104
mov dword [ebp - 0x314], ebx
mov dword [ebp - 0x32c], ebx
mov dword [ebp - 0x324], 1
call fcn.010721ad
push 0xd
pop ecx
shr eax, 8
mov esi, 0x100abec
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x330]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x108]
push eax
push SysStringLen
movsb byte es:[edi], byte [esi]
mov byte [0x1106960], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor ecx, ecx
cmp eax, ecx
mov ebx, 0x1106960
je 0x1033fb7
push eax
push 0x100ab88
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x1034207
lea eax, [ebp - 0x34c]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x20c]
push eax
push ecx
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1034207
lea eax, [ebp - 0x20c]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1033fec
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x1033ffc
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x318]
push eax
and ecx, 3
push 0x20019
rep movsb byte es:[edi], byte [esi]
xor edi, edi
push edi
lea eax, [ebp - 0x108]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10341a0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x334]
push eax
lea eax, [ebp - 0x338]
push eax
push edi
push 0x100ab78
push dword [ebp - 0x318]
mov dword [ebp - 0x32c], 1
mov dword [ebp - 0x328], 4
call esi
test eax, eax
jne 0x1034194
cmp dword [ebp - 0x334], 1
jne 0x1034194
lea eax, [ebp - 0x328]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x338]
push eax
push edi
push 0x100a3b8
push dword [ebp - 0x318]
call esi
test eax, eax
jne 0x1034194
mov eax, dword [ebp - 0x320]
cmp eax, dword [ebp - 0x340]
jb 0x1034194
cmp dword [ebp - 0x324], edi
je 0x10340e9
push 0xfffa
push ebx
push 0xf086
push edi
call fcn.010312a2
mov dword [ebp - 0x324], edi
push dword [ebp - 0x320]
lea eax, [ebp - 0x344]
push 0x100ab74
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
mov edi, ebx
add esp, 0xc
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1034107
mov esi, 0x100ab68
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x20c]
movsb byte es:[edi], byte [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x103411f
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x103412b
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1034146
mov esi, 0x100ab60
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x344]
movsw word es:[edi], word [esi]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x103415e
mov edi, ebx
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x103416a
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x1034185
mov esi, 0x100ab5c
movsw word es:[edi], word [esi]
push dword [ebp - 0x318]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x314]
push 0xd
pop ecx
lea eax, [ebp - 0x34c]
push eax
xor eax, eax
push eax
push eax
push eax
mov esi, 0x100abec
lea edi, [ebp - 0x108]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x314]
movsb byte es:[edi], byte [esi]
push dword [ebp - 0x330]
mov dword [ebp - 0x31c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1033fe4
cmp dword [ebp - 0x32c], 0
je 0x1034207
cmp byte [0x1106960], 0
jne 0x1034220
push 0xfffa
push ebx
push 0xf087
push 0
mov byte [0x1106960], 0
call fcn.010312a2
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0xf00f
push 0
mov byte [ebp - 0x310], 0
call fcn.010312a2
push 0x10040
lea eax, [ebp - 0x310]
push eax
push ebx
push dword [ebp - 0x33c]
call fcn.0107473f
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 4