Function at 0x100039a0
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x90
mov ecx, dword [ebp + 0x10]
mov eax, dword [0x1000c00c]
xor eax, ebp
mov dword [esp + 0x88], eax
test ecx, ecx
je 0x10003a8f
mov esi, dword [ebp + 8]
mov dword [ecx], 0
push str.kernel32
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
test eax, eax
je 0x10003a33
push str.GetCurrentPackageId
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [esp + 0x70], 0
test eax, eax
je 0x10003a33
mov ecx, eax
call dword [section..00cfg]
lea eax, [esp + 0x70]
push 0
push eax
call ecx
cmp eax, 0x7a
jne 0x10003a33
movdqu xmm0, xmmword [esi]
pcmpeqb xmm0, xmmword [0x10009270]
pmovmskb eax, xmm0
mov edi, 0x80040111
cmp eax, 0xffff
jne 0x100041e9
jmp 0x10003e5f
xor eax, eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], 7
mov word [esp + 0x40], 0
lea eax, [esp + 0x70]
push eax
push esi
call dword [sym.imp.ole32.dll_StringFromCLSID]
test eax, eax
js 0x10003a99
mov esi, dword [esp + 0x70]
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov ecx, dword [esp + 0x50]
mov edx, dword [esp + 0x54]
mov edi, edx
sub edi, ecx
cmp edi, eax
jb 0x10003c06
lea edi, [ecx + eax]
mov dword [esp + 0x50], edi
cmp edx, 8
jb 0x10003aa0
mov ebx, dword [esp + 0x40]
jmp 0x10003aa4
mov edi, 0x80070057
jmp 0x100041e9
xor ebx, ebx
jmp 0x10003e13
lea ebx, [esp + 0x40]
lea ecx, [ebx + ecx*2]
add eax, eax
push eax
push esi
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [ebx + edi*2], 0
push dword [esp + 0x70]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], 6
mov dword [esp + 0x28], 0x4c0043
mov dword [esp + 0x2c], 0x490053
mov dword [esp + 0x30], 0x5c0044
mov word [esp + 0x34], 0
mov esi, dword [esp + 0x50]
cmp dword [esp + 0x54], 8
jb 0x10003b04
mov eax, dword [esp + 0x40]
jmp 0x10003b08
lea eax, [esp + 0x40]
cmp esi, 1
ja 0x10003c1b
lea ecx, [esp + 0x34]
lea edx, [esi + 6]
mov dword [ecx + 4], edx
lea edx, [esi + esi]
push edx
push eax
push ecx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [esp + esi*2 + 0x34], 0
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov edx, ecx
sub edx, eax
cmp edx, 0xf
jb 0x10003c30
lea edx, [eax + 0xf]
mov dword [esp + 0x38], edx
cmp ecx, 8
jb 0x10003b57
mov ecx, dword [esp + 0x28]
jmp 0x10003b5b
lea ecx, [esp + 0x28]
movups xmm0, xmmword [0x10009d9e]
movups xmmword [ecx + eax*2 + 0xe], xmm0
movdqu xmm0, xmmword [str.InprocServer32]
movdqu xmmword [ecx + eax*2], xmm0
mov word [ecx + eax*2 + 0x1e], 0
xor ebx, ebx
mov dword [esp + 0xc], ebx
cmp dword [esp + 0x3c], 8
jb 0x10003b8e
mov eax, dword [esp + 0x28]
jmp 0x10003b92
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
push ebx
push ebx
push 2
push 0x10009f80
push eax
push 0x80000000
call dword [sym.imp.advapi32.dll_RegGetValueW]
test eax, eax
jne 0x10003dd4
mov ebx, dword [esp + 0xc]
xor edi, edi
mov esi, 0
cmp ebx, 2
jb 0x10003c62
mov edi, ebx
and edi, 0xfffffffe
cmp edi, 0x1000
jb 0x10003bf5
cmp edi, 0xffffffdd
jae 0x1000426e
lea eax, [edi + 0x23]
push eax
call fcn.10006c53
add esp, 4
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x10003c4f
test edi, edi
je 0x10003c4d
push edi
call fcn.10006c53
add esp, 4
mov esi, eax
jmp 0x10003c4f
lea ecx, [esp + 0x40]
mov edx, eax
push eax
push esi
call fcn.10007de0
add esp, 8
jmp 0x10003aba
lea ecx, [esp + 0x28]
mov edx, esi
push esi
push eax
call fcn.10007de0
add esp, 8
jmp 0x10003b30
lea ecx, [esp + 0x28]
mov edx, 0xf
push 0xf
push str.InprocServer32
call fcn.10007de0
add esp, 8
jmp 0x10003b7b
xor esi, esi
shr ebx, 1
lea eax, [esi + ebx*2]
push edi
mov edi, eax
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
sub edi, esi
mov dword [esp + 0xc], edi
cmp dword [esp + 0x3c], 8
jb 0x10003c75
mov eax, dword [esp + 0x28]
jmp 0x10003c79
lea eax, [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
push esi
push 0
push 2
push 0x10009f80
push eax
push 0x80000000
call dword [sym.imp.advapi32.dll_RegGetValueW]
xor ebx, ebx
test eax, eax
jne 0x10003da8
mov dword [esp + 4], edi
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add esp, 4
mov edi, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 7
mov word [esp + 0x10], 0
cmp eax, 7
ja 0x10004222
lea eax, [esp + 0x10]
mov dword [eax + 0x10], edi
mov ecx, edi
add ecx, edi
push ecx
push esi
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [esp + edi*2 + 0x10], 0
mov eax, 0x1000c528
cmp dword [0x1000c53c], 8
jb 0x10003cfd
mov eax, dword [0x1000c528]
mov edi, dword [esp + 0x10]
mov ebx, dword [esp + 0x24]
push eax
lea eax, [esp + 0x74]
push eax
call fcn.10006c53
test eax, eax
jne 0x10004263
cmp ebx, 8
lea eax, [esp + 0x10]
cmovae eax, edi
lea ecx, [esp + 0x58]
push eax
push ecx
call fcn.10006c53
test eax, eax
jne 0x10004263
movdqu xmm0, xmmword [esp + 0x70]
movdqu xmm1, xmmword [esp + 0x78]
movdqu xmm2, xmmword [esp + 0x58]
pcmpeqb xmm2, xmm0
movdqu xmm0, xmmword [esp + 0x60]
pcmpeqb xmm0, xmm1
pand xmm0, xmm2
pmovmskb eax, xmm0
cmp eax, 0xffff
sete bl
mov eax, dword [esp + 0x24]
cmp eax, 8
jb 0x10003da4
mov ecx, dword [esp + 0x10]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x10003d9a
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1000425d
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.10006c53
add esp, 8
mov edi, dword [esp + 4]
test esi, esi
je 0x10003dd4
cmp edi, 0x1000
jb 0x10003dca
mov eax, dword [esi - 4]
add esi, 0xfffffffc
sub esi, eax
cmp esi, 0x20
jae 0x1000425d
add edi, 0x23
mov esi, eax
push edi
push esi
call fcn.10006c53
add esp, 8
mov eax, dword [esp + 0x3c]
cmp eax, 8
jb 0x10003e13
mov ecx, dword [esp + 0x28]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x10003e09
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1000425d
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.10006c53
add esp, 8
mov eax, dword [esp + 0x54]
cmp eax, 8
jb 0x10003e52
mov ecx, dword [esp + 0x40]
lea esi, [eax + eax]
add esi, 2
cmp esi, 0x1000
jb 0x10003e48
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1000425d
add eax, eax
add eax, 0x25
mov esi, eax
mov ecx, edx
push esi
push ecx
call fcn.10006c53
add esp, 8
mov edi, 0x80040111
test bl, bl
je 0x100041e9
mov edx, dword [0x1000c538]
mov eax, 0x1000c528
cmp dword [0x1000c53c], 8
jb 0x10003e78
mov eax, dword [0x1000c528]
lea ecx, [eax + edx*2]
mov esi, eax
cmp edx, 2
jl 0x10003f79
mov edi, dword [eax]
mov esi, edi
and esi, 0xffffffdf
add esi, 0xffc5ffbf
cmp esi, 0x19
ja 0x10003ea0
lea esi, [eax + 4]
jmp 0x10003f79
cmp di, 0x5c
je 0x10003eb4
movzx ebx, di
mov esi, eax
cmp ebx, 0x2f
jne 0x10003f79
lea ebx, [edx + edx]
shr edi, 0x10
cmp ebx, 7
jb 0x10003f0d
movzx esi, word [eax + 6]
cmp esi, 0x5c
je 0x10003ecd
cmp esi, 0x2f
jne 0x10003f14
cmp edx, 4
je 0x10003ee0
movzx esi, word [eax + 8]
cmp esi, 0x2f
je 0x10003f14
cmp esi, 0x5c
je 0x10003f14
lea esi, [eax + 6]
movzx ebx, di
cmp bx, 0x2f
mov dword [esp + 4], esi
je 0x10003f5f
cmp ebx, 0x5c
je 0x10003f5f
mov esi, eax
cmp ebx, 0x3f
jne 0x10003f79
movzx edi, word [eax + 4]
cmp di, 0x3f
mov esi, dword [esp + 4]
cmovne esi, eax
jmp 0x10003f79
mov esi, eax
cmp ebx, 5
jb 0x10003f79
cmp di, 0x5c
je 0x10003f24
movzx edi, di
mov esi, eax
cmp edi, 0x2f
jne 0x10003f79
movzx edi, word [eax + 4]
mov esi, eax
cmp edi, 0x2f
je 0x10003f79
mov esi, eax
cmp edi, 0x5c
je 0x10003f79
mov edi, ecx
cmp edx, 3
mov ebx, dword [ebp + 0x10]
je 0x10003f9c
lea esi, [eax + 6]
add edx, edx
add edx, 0xfffffffa
movzx edi, word [esi]
cmp edi, 0x2f
je 0x10003f79
cmp edi, 0x5c
je 0x10003f79
add esi, 2
add edx, 0xfffffffe
jne 0x10003f48
jmp 0x10003f96
movzx esi, word [eax + 4]
cmp esi, 0x2e
je 0x10003f75
mov dword [esp + 8], esi
cmp esi, 0x3f
jne 0x10004236
mov esi, dword [esp + 4]
mov edi, ecx
cmp esi, ecx
mov ebx, dword [ebp + 0x10]
je 0x10003f9c
movzx edx, word [esi]
cmp edx, 0x5c
je 0x10003f8f
cmp edx, 0x2f
jne 0x10003f9a
add esi, 2
cmp esi, ecx
jne 0x10003f82
mov edi, ecx
jmp 0x10003f9c
mov edi, esi
cmp ecx, edi
je 0x10003fc9
movzx edx, word [ecx - 2]
add ecx, 0xfffffffe
cmp edx, 0x5c
je 0x10003fb1
cmp edx, 0x2f
jne 0x10003f9c
add ecx, 2
movzx edx, word [ecx - 2]
cmp edx, 0x5c
je 0x10003fc2
cmp edx, 0x2f
jne 0x10003fcb
add ecx, 0xfffffffe
cmp ecx, edi
jne 0x10003fb4
mov ecx, edi
sub ecx, eax
mov esi, ecx
sar esi, 1
xor edx, edx
mov dword [esp + 0x70], edx
mov dword [esp + 0x80], edx
mov dword [esp + 0x84], 7
mov word [esp + 0x70], 0
cmp ecx, 0xe
ja 0x1000420e
lea edx, [esp + 0x70]
mov dword [edx + 0x10], esi
push ecx
push eax
push edx
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
mov word [esp + esi*2 + 0x70], 0
push 0x10009008
push 0x3c
call fcn.10006c53
add esp, 8
mov esi, eax
test eax, eax
je 0x100040fe
mov dword [esi + 8], 1
mov dword [esi + 0x10], 4
mov dword [esi], 0x100093a0
mov eax, dword [ebp + 8]
movdqu xmm0, xmmword [eax]
movdqu xmmword [esi + 0x14], xmm0
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov edi, dword [esp + 0x80]
cmp dword [esp + 0x84], 8
jb 0x1000406d
mov eax, dword [esp + 0x70]
jmp 0x10004071
lea eax, [esp + 0x70]
lea ecx, [esi + 0x24]
cmp edi, 7
ja 0x10004088
movdqu xmm0, xmmword [eax]
movdqu xmmword [ecx], xmm0
mov ebx, 7
jmp 0x100040f5
mov dword [esp + 4], eax
mov ebx, edi
or ebx, 7
mov eax, 0x7ffffffe
cmp ebx, eax
cmovae ebx, eax
lea eax, [ebx + ebx]
cmp ebx, 0x7ff
mov dword [esp + 8], ecx
jb 0x100040cf
cmp ebx, 0x7fffffee
jae 0x1000426e
add eax, 0x25
push eax
call fcn.10006c53
add esp, 4
mov ecx, eax
add eax, 0x23
and eax, 0xffffffe0
mov dword [eax - 4], ecx
jmp 0x100040db
add eax, 2
push eax
call fcn.10006c53
add esp, 4
mov ecx, dword [esp + 8]
mov dword [ecx], eax
lea ecx, [edi + edi]
add ecx, 2
push ecx
push dword [esp + 8]
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
mov dword [esi + 0x34], edi
mov dword [esi + 0x38], ebx
mov ebx, dword [ebp + 0x10]
mov eax, dword [esp + 0x84]
cmp eax, 8
jb 0x10004140
mov ecx, dword [esp + 0x70]
lea edi, [eax + eax]
add edi, 2
cmp edi, 0x1000
jb 0x10004136
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1000425d
add eax, eax
add eax, 0x25
mov edi, eax
mov ecx, edx
push edi
push ecx
call fcn.10006c53
add esp, 8
mov dword [ebx], 0
mov eax, dword [ebp + 0xc]
mov edi, dword [eax]
mov edx, dword [eax + 4]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 0xc]
test edi, edi
jne 0x1000416b
test edx, edx
jne 0x1000416b
cmp ecx, 0xc0
jne 0x1000416b
cmp eax, 0x46000000
je 0x1000418b
cmp edi, 1
jne 0x10004203
test edx, edx
jne 0x10004203
cmp ecx, 0xc0
jne 0x10004203
cmp eax, 0x46000000
jne 0x10004203
mov dword [ebx], esi
mov eax, dword [esi]
mov ecx, dword [eax + 4]
call dword [section..00cfg]
push esi
call ecx
xor edi, edi
xor eax, eax
dec eax
lock xadd dword [esi + 8], eax
mov ebx, dword [esi + 0x10]
dec eax
je 0x100041b7
cmp eax, 1
jne 0x100041e9
and ebx, 6
je 0x100041d5
jmp 0x100041e9
not ebx
mov eax, dword [esi]
mov ecx, dword [eax + 0x14]
mov dword [esp + 4], ecx
call dword [section..00cfg]
mov ecx, esi
push 1
call dword [esp + 8]
test bl, 5
jne 0x100041e9
mov esi, dword [0x1000c520]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
call dword [section..00cfg]
push esi
call ecx
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.10006b10
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
mov edi, 0x80040111
test esi, esi
jne 0x1000419d
jmp 0x100041e9
lea ecx, [esp + 0x70]
mov edx, esi
push eax
call fcn.10008080
add esp, 4
jmp 0x10004012
lea ecx, [esp + 0x10]
mov edx, edi
push esi
call fcn.10008080
add esp, 4
jmp 0x10003cea
cmp di, 0x2f
mov edi, dword [esp + 8]
je 0x10003f24
cmp ebx, 0x5c
je 0x10003f24
mov esi, eax
cmp ebx, 0x3f
je 0x10003f00
jmp 0x10003f79
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
lea edx, [esp + 0x10]
mov ecx, eax
call fcn.10004c80
call fcn.100077d0
int3