Function at 0x1003f48
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x100a018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x240], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
push edi
mov edi, dword [sym.imp.msvcrt.dll_fprintf]
add eax, 0x20
xor esi, esi
push 0x1001598
push eax
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], esi
call edi
pop ecx
pop ecx
lea eax, [ebp - 0x230]
push eax
push 0x20019
push esi
push dword [0x100a02c]
mov ebx, 0x80000002
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x100401a
push 1
push 0x1001580
push dword [0x100a058]
push dword [ebp - 0x230]
call fcn.010039ef
push 1
push 0x1001554
push dword [0x100a060]
push dword [ebp - 0x230]
call fcn.010039ef
push 1
push 0x1001530
push dword [0x100a068]
push dword [ebp - 0x230]
call fcn.010039ef
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x100152c
push eax
call edi
pop ecx
pop ecx
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1004034
push eax
push dword [0x100a02c]
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x10014f0
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x230]
push eax
push 0x20019
push esi
push dword [section..data]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
cmp ebx, esi
jne 0x1004251
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x238], 0x104
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
jmp 0x100422d
cmp dword [ebp - 0x240], esi
je 0x10040b8
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x240]
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10041f0
push 0x10014ec
mov ebx, 0x114
push ebx
lea eax, [ebp - 0x22c]
push eax
call fcn.01003e8f
push dword [0x100a004]
lea eax, [ebp - 0x22c]
push ebx
push eax
call fcn.01003e8f
lea eax, [ebp - 0x234]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10041f0
mov ecx, dword [ebp - 0x238]
mov word [ebp + ecx*2 - 0x22c], ax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x234]
call fcn.01003b7b
push esi
push 0x10014d8
push 0x10014c8
push dword [ebp - 0x234]
call fcn.01003a8c
push esi
push 0x10014a8
push 0x100149c
push dword [ebp - 0x234]
call fcn.01003a8c
push esi
push 0x1001478
push 0x1001468
push dword [ebp - 0x234]
call fcn.01003a8c
push esi
push 0x1001448
push 0x100143c
push dword [ebp - 0x234]
call fcn.01003a8c
push esi
push 0x1001418
push dword [0x100a05c]
push dword [ebp - 0x234]
call fcn.010039ef
push esi
push 0x10013f8
push dword [0x100a060]
push dword [ebp - 0x234]
call fcn.010039ef
push esi
push 0x10013dc
push dword [0x100a064]
push dword [ebp - 0x234]
call fcn.010039ef
push esi
push 0x10013c0
push dword [0x100a068]
push dword [ebp - 0x234]
call fcn.010039ef
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
push 0x100152c
push eax
call edi
pop ecx
pop ecx
inc dword [ebp - 0x23c]
push 0x228
lea eax, [ebp - 0x22c]
push esi
push eax
mov dword [ebp - 0x238], 0x104
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x238]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x23c]
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov ebx, eax
cmp ebx, esi
je 0x1004095
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100426b
mov eax, dword [sym.imp.msvcrt.dll__iob]
push ebx
push dword [section..data]
add eax, 0x20
push 0x10014f0
push eax
call edi
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.010055b7
leave
ret 4