Function at 0x1039917
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push edi
xor edi, edi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp + 0xc], ebx
je 0x10399a3
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test byte [ebp + 0x10], 1
je 0x1039974
cmp eax, 2
je 0x103995f
cmp eax, 3
jne 0x1039974
cmp eax, ebx
jle 0x103996d
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
jmp 0x1039b28
cmp eax, ebx
je 0x10399a9
jle 0x1039984
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0xc]
mov edi, eax
push 0x101f2ac
push 1
push edi
push 0x4000000
call fcn.0102bc31
add esp, 0x14
jmp 0x1039b28
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
cmp eax, ebx
je 0x1039a5f
lea ecx, [ebp - 0x10]
push ecx
push eax
call fcn.01039c6c
mov edi, eax
cmp edi, ebx
jge 0x10399d1
push 0x101f404
push 1
push edi
jmp 0x1039a20
mov eax, dword [ebp - 0x10]
lea eax, [eax + eax - 4]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1039a32
mov dword [ebp - 0x14], 1
cmp dword [ebp - 0xc], 1
je 0x1039aa8
cmp dword [ebp - 0xc], 2
je 0x1039aa8
push 0x101f3dc
mov eax, 0x8007000d
push 1
mov edi, eax
push eax
push 0x4000000
call fcn.0102bc31
add esp, 0x10
jmp 0x1039b27
cmp eax, 0xea
je 0x10399fd
test byte [ebp + 0x10], 1
je 0x1039a44
cmp eax, 2
je 0x1039a80
cmp eax, ebx
jle 0x1039a52
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x101f388
jmp 0x1039afd
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test byte [ebp + 0x10], 1
je 0x1039a8a
cmp eax, 2
jne 0x1039a8a
mov edi, 0x80070002
jmp 0x1039b27
cmp eax, ebx
je 0x10399fd
jle 0x1039a9e
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x101f338
jmp 0x1039afd
cmp dword [ebp - 0x14], ebx
jne 0x1039b11
mov eax, dword [ebp - 8]
shr eax, 1
inc eax
inc eax
push eax
push esi
mov dword [ebp - 0x10], eax
call fcn.01039d32
mov edi, eax
cmp edi, ebx
jge 0x1039ace
push dword [ebp + 0x14]
push 0x101f300
jmp 0x1039aff
lea eax, [ebp - 8]
push eax
push dword [esi]
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x1039b11
jle 0x1039af5
and eax, 0xffff
or eax, 0x80070000
push dword [ebp + 0x14]
push 0x101f2dc
mov edi, eax
push 1
push edi
push 0x4000000
call fcn.0102bc31
add esp, 0x14
jmp 0x1039b27
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
mov word [eax + edx*2 - 4], cx
mov eax, dword [esi]
mov edx, dword [ebp - 0x10]
mov word [eax + edx*2 - 2], cx
pop esi
cmp dword [ebp + 0xc], ebx
je 0x1039b3b
cmp dword [ebp - 4], ebx
je 0x1039b3b
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0x14