Function at 0x1036de5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x103d004]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 1
push edi
push edx
push ecx
push ebx
push esi
mov dword [ebp - 0x23c], ecx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x230], edi
mov dword [ebp - 0x248], edi
mov dword [ebp - 0x240], edi
mov dword [ebp - 0x22c], edi
mov dword [eax], edi
call fcn.01036d01
test eax, eax
jne 0x1036e5f
mov dword [ebp - 0x228], 2
jmp 0x103713b
lea eax, [ebp - 0x248]
push eax
push 1
push ebx
push esi
call fcn.010396a8
cmp eax, edi
je 0x1036e7e
mov dword [ebp - 0x228], eax
jmp 0x103713b
lea eax, [ebp - 0x240]
push eax
push 1
push dword [ebp - 0x23c]
push dword [ebp - 0x248]
call fcn.010396a8
cmp eax, edi
jne 0x1036e73
lea eax, [ebp - 0x22c]
push eax
push 1
push dword [ebp - 0x234]
push dword [ebp - 0x240]
call fcn.010396a8
cmp eax, edi
jne 0x1036e73
push edi
push edi
lea eax, [ebp - 0x26c]
push eax
push edi
lea eax, [ebp - 0x268]
push eax
push edi
push edi
push edi
push edi
push edi
push dword [ebp - 0x22c]
call fcn.010396f6
cmp eax, edi
jne 0x1036e73
lea eax, [ebp - 0x238]
push eax
mov eax, dword [ebp - 0x268]
mul dword [ebp - 0x26c]
push edx
push eax
call fcn.0102d16e
test eax, eax
jl 0x103711e
lea eax, [ebp - 0x238]
push eax
push 2
push dword [ebp - 0x238]
call fcn.01036db7
test eax, eax
jl 0x103711e
mov ebx, dword [sym.imp.KERNEL32.dll_RegEnumValueW]
mov esi, dword [ebp - 0x238]
push esi
cmp dword [ebp - 0x230], edi
jne 0x1036f3f
call fcn.0103696e
mov dword [ebp - 0x23c], eax
jmp 0x1036f50
push dword [ebp - 0x230]
call fcn.0103698d
mov dword [ebp - 0x23c], eax
cmp eax, edi
je 0x103718b
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x274]
push eax
push edi
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp - 0x22c]
shr esi, 1
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x244], esi
mov dword [ebp - 0x234], edi
mov dword [ebp - 0x250], 0xb
mov dword [ebp - 0x254], 0x208
call ebx
mov dword [ebp - 0x24c], 1
cmp eax, 0x103
je 0x1037197
cmp eax, 0xea
je 0x103706f
cmp eax, edi
jne 0x10370cc
xor eax, eax
mov word [ebp - 0x1e], ax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
cmp eax, edi
jl 0x10370c5
movzx esi, word [ebp - 0x262]
lea eax, [ebp - 0x234]
push eax
shr esi, 1
push esi
push dword [ebp - 0x234]
call fcn.01036db7
test eax, eax
jl 0x10370d4
cmp dword [ebp - 0x244], esi
jbe 0x103706f
push edi
lea eax, [ebp - 0x264]
push eax
push eax
call dword [sym.imp.ntdll.dll_RtlUpcaseUnicodeString]
push 0x900
push edi
push edi
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 0x244]
push dword [ebp - 0x258]
call fcn.01032d6b
mov eax, dword [ebp - 0x258]
sub dword [ebp - 0x244], esi
lea eax, [eax + esi*2]
mov dword [ebp - 0x258], eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x274]
push eax
push edi
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24c]
mov dword [ebp - 0x250], 0xb
push dword [ebp - 0x22c]
mov dword [ebp - 0x254], 0x208
call ebx
inc dword [ebp - 0x24c]
cmp eax, 0x103
jne 0x1036fcb
jmp 0x10370e6
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov dword [ebp - 0x228], eax
jmp 0x10370de
mov dword [ebp - 0x228], 0xd
cmp dword [ebp - 0x228], edi
jne 0x1037128
mov ecx, dword [ebp - 0x234]
cmp ecx, edi
je 0x1037197
inc ecx
cmp dword [ebp - 0x25c], ecx
jae 0x10371a3
lea eax, [ebp - 0x238]
push eax
push 2
mov eax, ecx
pop ecx
mul ecx
push edx
push eax
call fcn.0102d16e
test eax, eax
jge 0x1036f23
mov dword [ebp - 0x228], 0xd
cmp dword [ebp - 0x230], edi
je 0x103713b
push dword [ebp - 0x230]
call fcn.010369af
cmp dword [ebp - 0x22c], edi
je 0x103714e
push dword [ebp - 0x22c]
call fcn.01039698
cmp dword [ebp - 0x240], edi
je 0x1037161
push dword [ebp - 0x240]
call fcn.01039698
cmp dword [ebp - 0x248], edi
pop edi
pop esi
pop ebx
je 0x1037177
push dword [ebp - 0x248]
call fcn.01039698
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x228]
xor ecx, ebp
call fcn.01034b90
leave
ret 0x14
mov dword [ebp - 0x228], 8
jmp 0x1037128
mov dword [ebp - 0x228], 2
jmp 0x1037128
mov eax, dword [ebp - 0x23c]
xor edx, edx
mov word [eax + ecx*2 - 2], dx
mov ecx, dword [ebp - 0x270]
mov dword [ecx], eax
jmp 0x103713b