Function at 0x10003f40
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x229c
call fcn.1000b940
mov dword [ebp - 0x229c], ecx
lea ecx, [ebp - 0x7e8]
call fcn.10008e50
mov dword [ebp - 0xc], 1
mov byte [ebp - 5], 0
mov dword [ebp - 4], 0
push 0x1000e368
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov eax, dword [ebp - 0x229c]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
mov ecx, dword [ebp - 0x229c]
call fcn.10005e40
push 0x78
push 0x1000e358
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov ecx, dword [ebp - 0x229c]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0x229c]
call fcn.10006890
movzx edx, al
test edx, edx
je 0x10004282
push 0
push 0
movzx eax, byte [ebp - 5]
push eax
lea ecx, [ebp - 0x7e8]
push ecx
mov ecx, dword [ebp - 0x229c]
call fcn.10004460
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x100041e2
push 0x1000e380
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
mov dword [ebp - 0x2268], eax
mov edx, dword [ebp - 0x229c]
add edx, 0x20
mov dword [ebp - 0x2264], edx
mov dword [ebp - 0x225c], 4
mov dword [ebp - 0x2258], 0
mov dword [ebp - 0x2260], 4
lea eax, [ebp - 0x2260]
push eax
lea ecx, [ebp - 0x7ec]
push ecx
lea edx, [ebp - 0x225c]
push edx
mov eax, dword [ebp - 0x2268]
push eax
mov ecx, dword [ebp - 0x2264]
push ecx
mov edx, dword [ebp - 0x2264]
mov eax, dword [edx + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov dword [ebp - 0x2258], eax
xor ecx, ecx
cmp dword [ebp - 0x2258], 0
sete cl
movzx edx, cl
test edx, edx
jne 0x10004163
mov dword [ebp - 0x227c], 1
push 0x1000e380
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
mov dword [ebp - 0x2278], eax
mov eax, dword [ebp - 0x229c]
add eax, 0x20
mov dword [ebp - 0x2274], eax
mov dword [ebp - 0x226c], 0
mov dword [ebp - 0x2270], 4
mov ecx, dword [ebp - 0x2270]
push ecx
lea edx, [ebp - 0x227c]
push edx
push 4
mov eax, dword [ebp - 0x2278]
push eax
mov ecx, dword [ebp - 0x2274]
push ecx
mov edx, dword [ebp - 0x2274]
mov eax, dword [edx + 0x100]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov dword [ebp - 0x226c], eax
push 1
push 1
push 0
push 5
mov ecx, dword [ebp - 0x229c]
call fcn.10006360
push 0x1000e370
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov ecx, dword [ebp - 0x229c]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
mov edx, dword [ebp - 0x7e4]
mov dword [ebp - 0x2280], edx
mov eax, dword [ebp - 0x2280]
push eax
mov ecx, dword [ebp - 0x229c]
call fcn.10003660
mov byte [ebp - 5], 0
push 0x1000e358
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov ecx, dword [ebp - 0x229c]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
push 0x1000e368
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov edx, dword [ebp - 0x229c]
add edx, 0x20
push edx
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
jmp 0x10004282
mov byte [ebp - 5], 0
cmp dword [ebp - 0xc], 0x17
jne 0x10004256
push 0x5a0
push 0x1000e368
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov eax, dword [ebp - 0x229c]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x229c]
call fcn.10006890
movzx ecx, al
test ecx, ecx
je 0x10004254
mov byte [ebp - 5], 1
push 0x1000e368
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov edx, dword [ebp - 0x229c]
add edx, 0x20
push edx
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
jmp 0x10004282
push 0x1000e358
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov eax, dword [ebp - 0x229c]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
xor ecx, ecx
shl ecx, 4
mov edx, dword [ebp - 0x229c]
lea eax, [edx + ecx + 0xb20]
mov ecx, dword [eax]
mov dword [ebp - 0x7fc], ecx
mov edx, dword [eax + 4]
mov dword [ebp - 0x7f8], edx
mov ecx, dword [eax + 8]
mov dword [ebp - 0x7f4], ecx
mov edx, dword [eax + 0xc]
mov dword [ebp - 0x7f0], edx
mov eax, dword [ebp - 0x7f8]
push eax
push 0x1000e360
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov ecx, dword [ebp - 0x229c]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0x229c]
call fcn.10006890
movzx edx, al
test edx, edx
je 0x10004421
mov ecx, dword [ebp - 0x229c]
call fcn.10006b70
test eax, eax
jne 0x10004339
push 0x1000e360
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov eax, dword [ebp - 0x229c]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
mov dword [ebp - 4], 0
jmp 0x1000439b
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x229c]
mov eax, dword [edx + 0xb1c]
mov dword [ebp - 0x2284], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x2284]
jb 0x1000439b
mov edx, dword [ebp - 0x229c]
add edx, 0xc
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push 0x1000e360
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov eax, dword [ebp - 0x229c]
add eax, 0x20
push eax
mov ecx, dword [ebp - 0x229c]
call fcn.10006990
mov ecx, dword [ebp - 0x229c]
add ecx, 0xb1c
call fcn.10008130
mov ecx, dword [ebp - 0x229c]
add ecx, 0x1200
call fcn.10008130
push 0x1000e324
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov ecx, dword [ebp - 0x229c]
add ecx, 0x20
push ecx
mov ecx, dword [ebp - 0x229c]
add ecx, 0xb1c
call fcn.10007f00
push 0x1000e32c
mov ecx, dword [ebp - 0x229c]
add ecx, 0x128
call fcn.10002a50
push eax
mov edx, dword [ebp - 0x229c]
add edx, 0x20
push edx
mov ecx, dword [ebp - 0x229c]
add ecx, 0x1200
call fcn.10007f00
push 0x1d4c0
mov eax, dword [ebp - 0x229c]
mov ecx, dword [eax + 0x428]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10003fa7
lea ecx, [ebp - 0x7e8]
call fcn.10009180
mov esp, ebp
pop ebp
ret