Function at 0x1003f98e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007f68f
mov eax, dword fs:[0]
push eax
mov eax, 0x201c
call fcn.10067670
mov eax, dword [0x100b02c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2018], eax
mov eax, dword [ebp + 0xc]
mov edi, ecx
mov dword [ebp - 0x201c], eax
mov eax, dword [ebp + 0x14]
xor esi, esi
mov dword [ebp - 0x2028], eax
cmp dword [edi + 0x418], esi
jne 0x1003fa0a
push 0x410
call fcn.1005fc55
mov dword [eax + 4], esi
mov dword [eax], edi
mov dword [eax + 0x40c], esi
mov dword [eax + 8], esi
mov dword [edi + 0x418], eax
pop ecx
mov byte [eax + 0xc], 0
mov ebx, 0x400
mov eax, dword [edi + 0x418]
cmp dword [eax + 8], 3
jae 0x1003fbd7
mov eax, dword [edi + 0x418]
mov ecx, dword [eax + 4]
mov eax, dword [eax]
push ebx
lea edx, [ebp - 0x2010]
push edx
push ecx
push dword [eax + 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, esi
jne 0x1003fbd7
lea eax, [ebp - 0x810]
push eax
lea eax, [ebp - 0x2010]
push 0x800
push eax
call fcn.10030760
mov eax, dword [edi + 0x418]
add esp, 0xc
inc dword [eax + 4]
mov eax, dword [edi + 0x418]
cmp dword [eax + 8], esi
jne 0x1003fafd
lea eax, [ebp - 0x810]
push str.Business_Objects
push eax
call fcn.10061e97
pop ecx
pop ecx
test eax, eax
je 0x1003fa1f
lea eax, [ebp - 0x810]
push str.classes
push eax
call fcn.10061e97
pop ecx
pop ecx
test eax, eax
je 0x1003fa1f
lea eax, [ebp - 0x810]
push str.clients
push eax
call fcn.10061e97
pop ecx
pop ecx
test eax, eax
je 0x1003fa1f
lea eax, [ebp - 0x810]
push str.Microsoft
push eax
call fcn.10061e97
pop ecx
pop ecx
test eax, eax
je 0x1003fa1f
lea eax, [ebp - 0x810]
push str.Wow6432Node
push eax
call fcn.10061e97
pop ecx
pop ecx
test eax, eax
je 0x1003fa1f
push 0x430
call fcn.1005fc55
pop ecx
mov dword [ebp - 0x2014], eax
mov dword [ebp - 4], esi
cmp eax, esi
je 0x1003fb4c
movzx ecx, byte [edi + 0x42d]
mov eax, dword [edi + 0x418]
mov eax, dword [eax]
mov eax, dword [eax + 0x41c]
push ecx
lea ecx, [ebp - 0x810]
push ecx
push eax
push dword [edi + 0x424]
push dword [ebp - 0x2014]
call fcn.1003f8ca
mov dword [ebp - 0x2014], eax
jmp 0x1003fb52
mov dword [ebp - 0x2014], esi
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x2014], esi
je 0x1003fa1f
push 0x410
call fcn.1005fc55
mov esi, eax
and dword [esi + 4], 0
mov eax, dword [ebp - 0x2014]
mov dword [esi], eax
mov eax, dword [edi + 0x418]
mov eax, dword [eax + 8]
inc eax
mov dword [esi + 8], eax
mov eax, dword [edi + 0x418]
mov dword [esi + 0x40c], eax
lea eax, [ebp - 0x810]
push eax
lea eax, [esi + 0xc]
push ebx
push eax
call fcn.10060151
add esp, 0x10
push dword [ebp - 0x2028]
mov ecx, edi
push 0
push dword [ebp - 0x201c]
mov dword [edi + 0x418], esi
push dword [ebp - 0x2018]
call fcn.1003f98e
test al, al
jne 0x1003fcbb
xor esi, esi
jmp 0x1003fa1f
mov eax, dword [edi + 0x418]
mov ecx, dword [ebp - 0x2018]
mov dword [ebp - 0x2020], 0x1000
mov dword [ebp - 0x2024], esi
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [edi + 0x418]
add eax, 0xc
push eax
lea eax, [edi + 0x18]
push ebx
push eax
call fcn.10060151
mov eax, dword [edi + 0x418]
mov esi, dword [eax + 0x40c]
push eax
call fcn.1005fc20
mov eax, dword [ebp - 0x2018]
add esp, 0x10
mov dword [edi + 0x418], esi
mov esi, dword [eax]
lea eax, [ebp - 0x1810]
push eax
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2020]
push eax
push dword [ebp - 0x2028]
call fcn.1003f7a6
push eax
mov eax, esi
call fcn.1003fe25
test eax, eax
jne 0x1003fc89
cmp dword [ebp - 0x201c], eax
je 0x1003fc85
cmp dword [ebp - 0x2020], eax
je 0x1003fc85
cmp dword [ebp - 0x2024], 1
jne 0x1003fc85
lea eax, [ebp - 0x1810]
push eax
push dword [ebp - 0x201c]
call fcn.1002d1b3
mov al, 1
jmp 0x1003fca1
mov eax, dword [ebp - 0x2018]
mov eax, dword [eax]
cmp eax, edi
je 0x1003fc9f
test eax, eax
je 0x1003fc9f
push eax
call fcn.1002a7e9
xor al, al
cmp byte [ebp + 0x10], 0
je 0x1003fcbd
cmp dword [edi + 0x418], 0
je 0x1003fcbd
test al, al
jne 0x1003fcbd
xor esi, esi
jmp 0x1003fa0f
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005fc2b
leave
ret 0x10