Function at 0x10035c70
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x1005de6c
call fcn.1005c588
sub esp, 0xe8
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x34], dl
je 0x10035cd3
test dl, dl
je 0x10035ca7
push 0x21
push 0x1f88
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x1003620f
mov edx, dword [ebp + 0x24]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003620f
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x10035cbc
jmp 0x1003620f
cmp byte [ebp + 0xc], 0
je 0x10035cf0
mov eax, dword [ebp + 0x10]
mov esi, dword [ecx]
mov edx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [ecx + esi*4]
mov dword [ecx + edx*4], eax
jmp 0x1003620f
mov dword [ebp - 0x14], 0xffffffff
xor ebx, ebx
mov dword [ebp - 0x24], 0xe60f951f
mov dword [ebp - 0x14], ebx
jmp 0x10035d12
mov ecx, 0x600
call fcn.10037176
dec dword [ebp - 0x14]
xor dl, dl
cmp dword [ebp - 0x14], 0xfffffffc
jl 0x10035d05
lea eax, [ebp + 0x1b]
mov byte [ebp + 0x1b], bl
push eax
push 0x5bd6
push ecx
call fcn.10039893
movdqa xmm0, xmmword [0x1006bec0]
lea eax, [ebp - 0x9c]
add esp, 0xc
mov dword [ebp - 0x40], ebx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x3c], ebx
movdqu xmmword [ebp - 0xac], xmm0
mov dword [ebp - 0x38], ebx
push dword [ebp + 0x18]
push eax
lea eax, [ebp - 0xac]
push eax
push ebx
call fcn.100111f2
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x40]
push 3
mov dword [ebp - 0x24], ebx
pop edi
mov dword [eax], 0xffffffea
push 2
lea ecx, [ebp - 0x50]
call fcn.1000ddb2
xor ecx, ecx
inc ecx
mov byte [ebp - 4], cl
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x10035da6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10035d8d
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ebx
jmp 0x10035db9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x78], 0xd86e52d8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10035dab
mov dword [ebp - 0x70], ecx
cmp dword [ebp - 0x70], ebx
jl 0x10035eaa
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x10035ea1
mov dword [ebp - 0x2c], 0xaf8b5131
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], ebx
jl 0x10035e91
mov dword [ebp - 0x20], 0xa92bd42c
mov dword [ebp - 0x20], ebx
jmp 0x10035e7f
push edi
lea ecx, [ebp - 0x5c]
call fcn.1000ddb2
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 2
push eax
push ecx
lea eax, [ebp - 0x5c]
mov edx, 0x1631
push 0x2a10
push eax
xor cl, cl
call fcn.10038ace
mov esi, dword [ebp - 0x5c]
add esp, 0x10
mov dword [esi], ebx
lea eax, [ebp - 0x20]
push eax
sub esp, 0xc
lea edx, [ebp - 0x2c]
lea ecx, [ebp - 0x50]
call fcn.100371f0
add esp, 0x10
mov edx, 0x6c75
push 1
push ecx
mov ecx, 0x6d5b
call fcn.1003573f
inc dword [esi]
cmp dword [esi], 1
pop ecx
pop ecx
jle 0x10035e2e
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ebx
mov byte [ebp - 4], 1
call fcn.1000de35
inc dword [ebp - 0x20]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x20], ecx
jle 0x10035dfc
dec dword [ebp - 0x2c]
jns 0x10035ded
mov eax, dword [ebp - 0x50]
cmp dword [eax], ebx
jne 0x10035ea1
dec dword [ebp - 0x14]
jns 0x10035dda
dec dword [ebp - 0x70]
jns 0x10035dcb
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], bl
call fcn.1000de35
mov eax, dword [ebp - 0x40]
inc dword [eax]
cmp dword [eax], 9
jle 0x10035d74
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10035ed8
xor dl, dl
mov ecx, 0x267b
call fcn.100398bf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1000de35
mov eax, dword [ebp + 0x14]
mov esi, ebx
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0x68]
push 4
call fcn.1000ddb2
push 0x377b
push 1
lea eax, [ebp - 0x68]
mov dword [ebp - 4], edi
push eax
push ebx
lea eax, [ebp - 0x7c]
mov edx, 0x5f8c
push eax
push 0x61e2
push 0xb30
push 0x169e
push 0x67e5
mov cl, 1
call fcn.1003828f
mov eax, dword [ebp - 0x14]
add esp, 0x24
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov dword [eax + 0xc], ecx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10035f58
push ecx
push ecx
xor dl, dl
call fcn.100368ee
pop ecx
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.1000de35
mov cl, byte [ebp + esi - 0x30]
mov dl, 0xeb
call fcn.1003dee8
mov byte [ebp + esi - 0x30], al
inc esi
cmp esi, 4
jb 0x10035eee
push edi
lea ecx, [ebp - 0x88]
call fcn.1000ddb2
mov dword [ebp - 4], 4
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x14], 0x4cfc
cmp dword [ebp - 0x14], 0x4f74
jle 0x10035ff8
push 0x550
push 0x2491
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10079cf8
cdq
push edx
push eax
call fcn.1000dad0
inc edi
cmp edi, 0x41c5
jl 0x10035fca
inc esi
cmp esi, 0x4ab1
jl 0x10035fc8
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x24], 0x1795
cmp dword [ebp - 0x24], 0x5bc
jge 0x100360b5
push 0x3f
lea eax, [ebp - 0xf3]
mov byte [ebp - 0xf4], bl
push ebx
push eax
call fcn.10044510
add esp, 0xc
mov edi, ebx
mov esi, ebx
lea eax, [ebp - 0x25]
push eax
push 0x10065cfc
call fcn.1004416b
cmp byte [ebp - 0x25], 0x42
pop ecx
pop ecx
jne 0x10036049
lea eax, [esi + edi*8]
mov byte [ebp + eax - 0xf4], 1
inc esi
cmp esi, 8
jl 0x10036028
push 0x10065d00
call fcn.1004416b
pop ecx
push 8
inc edi
pop eax
cmp edi, eax
jl 0x10036026
push 0x10
pop ecx
lea esi, [ebp - 0xf4]
mov edi, eax
mov edx, ebx
cmp byte [edx + esi], 0
je 0x1003607c
inc edx
cmp edx, eax
jl 0x1003606f
jmp 0x1003607d
dec ecx
add esi, eax
dec edi
jne 0x1003606d
mov edx, ebx
lea esi, [ebp - 0xf4]
mov edi, ebx
add esi, edx
cmp byte [esi], 0
je 0x1003609c
inc edi
add esi, eax
cmp edi, eax
jl 0x1003608e
jmp 0x1003609d
dec ecx
inc edx
cmp edx, eax
jl 0x10036084
cmp ecx, 0x10
cmove ecx, eax
push ecx
push 0x10069d90
call fcn.10044453
pop ecx
pop ecx
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], 0x49c6
jge 0x100360ef
mov edx, str.shuttvgs_wqgawu_lxg
mov ecx, 0x10079cf8
call fcn.1001081c
jmp 0x100360ef
mov dword [ebp - 4], 4
mov dword [ebp - 0x14], 0x4a4e
cmp dword [ebp - 0x14], 0x4dc9
jle 0x1003612b
mov esi, ebx
mov edi, esi
mov ebx, 0x7d4
mov eax, edi
mov ecx, 0x10079cf8
cdq
push edx
push eax
call fcn.1000dad0
dec edi
dec ebx
jne 0x1003610f
inc esi
cmp esi, 0x1161
jl 0x10036108
push 2
lea ecx, [ebp - 0x94]
call fcn.1000ddb2
mov byte [ebp - 4], 8
cmp dword [ebp - 0x14], 0x46dd
jge 0x10036172
mov edx, str.kpyhqxxvn_zjhprmukq_taxyawqn_nuiemottc_vwc_nil_slld_drkf_howayr
mov ecx, 0x10079cf8
call fcn.1001081c
jmp 0x10036172
push 0x5abe
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 7
push eax
mov dword [ebp - 0x44], 0x9d73df2e
lea edx, [ebp - 0x88]
push ebx
mov ecx, 0x6964
call fcn.1003a753
add esp, 0xc
mov dword [ebp - 0x1c], ebx
jmp 0x100361b3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100361a2
mov dword [ebp - 0x1c], ebx
jmp 0x100361cf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9c], 0xecc2443a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100361be
push ecx
lea eax, [ebp - 0x94]
push eax
push ecx
lea edx, [ebp - 0x1c]
call fcn.10036ecb
pop ecx
pop ecx
lea ecx, [ebp - 0x44]
call fcn.10036ded
pop ecx
lea ecx, [ebp - 0x94]
call fcn.1000de35
lea ecx, [ebp - 0x88]
call fcn.1000de35
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret