Function at 0x103ff9e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push 0x130
push 0x10115f8
call fcn.0106bf63
mov eax, dword [0x1099a38]
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x128]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x1040200
mov dword [ebp - 4], ebx
mov dword [ebp - 0x138], 0xfffa
mov byte [0x1106960], bl
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x138]
push eax
mov edi, 0x1106960
push edi
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x104005a
push edi
call dword [sym.imp.msvcrt.dll__strdup]
pop ecx
mov dword [esi + 0xc], eax
cmp eax, ebx
jne 0x1040067
push 0x10115b4
call fcn.01071aad
mov dword [ebp - 0x124], 8
jmp 0x10401e6
push eax
push 0x1011580
call fcn.01071ac0
pop ecx
pop ecx
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x104012b
mov dword [ebp - 0x12c], ebx
lea ecx, [ebp - 0x12c]
push ecx
push ebx
push ebx
push ebx
push eax
push dword [ebp - 0x128]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
call edi
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x104010f
push dword [ebp - 0x12c]
call dword [sym.imp.msvcrt.dll_malloc]
pop ecx
mov dword [esi + 0x14], eax
cmp eax, ebx
jne 0x10400b6
push 0x1011540
jmp 0x1040046
lea ecx, [ebp - 0x12c]
push ecx
push eax
lea eax, [esi + 0x1c]
push eax
push ebx
push dword [esi + 0x10]
push dword [ebp - 0x128]
call edi
mov dword [ebp - 0x124], eax
cmp eax, ebx
je 0x10400fa
push eax
push dword [esi + 0x10]
push 0x1011504
call fcn.01071ac0
push dword [esi + 0x14]
call dword [sym.imp.msvcrt.dll_free]
add esp, 0x10
mov dword [esi + 0x14], ebx
jmp 0x10401e6
mov eax, dword [ebp - 0x12c]
mov dword [esi + 0x18], eax
mov dword [esi + 0x20], 1
jmp 0x10401e6
cmp eax, 2
je 0x104011d
cmp eax, 3
jne 0x10401e6
mov dword [esi + 0x20], ebx
mov dword [ebp - 0x124], ebx
jmp 0x10401e6
mov dword [esi + 0x20], 1
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x130]
push eax
push ebx
push 0x20019
push 4
push ebx
push ebx
push dword [esi + 8]
push dword [esi + 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x1040178
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0x128], eax
push 0x104
lea eax, [ebp - 0x120]
push eax
push dword [esi + 0x14]
push dword [ebp - 0x13c]
call fcn.01070fc9
push dword [ebp - 0x134]
lea eax, [ebp - 0x120]
push eax
call fcn.0107c243
push ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x128]
call dword [sym.imp.ADVAPI32.dll_RegSaveKeyA]
mov dword [ebp - 0x124], eax
cmp eax, ebx
jne 0x10401d1
lea eax, [ebp - 0x120]
push eax
push ebx
call fcn.01034d42
jmp 0x10401e6
push eax
lea eax, [ebp - 0x120]
push eax
push 0x10114cc
call fcn.01071ac0
add esp, 0xc
or dword [ebp - 4], 0xffffffff
call fcn.010401f3
jmp 0x1040213
cmp eax, 2
je 0x104020a
cmp eax, 3
jne 0x1040213
mov dword [esi + 0x20], ebx
mov dword [ebp - 0x124], ebx
push dword [ebp - 0x124]
call fcn.01037f35
xor eax, eax
cmp dword [ebp - 0x124], ebx
sete al
mov ecx, dword [ebp - 0x1c]
call fcn.0106bc50
call fcn.0106bf9e
ret 0xc