Function at 0x1003d770
Capabilities:
Query or enumerate registry key

Disassembly:
push 0xffffffffffffffff
push 0x1004384e
mov eax, dword fs:[0]
push eax
sub esp, 0x85c
mov eax, dword [0x10054020]
xor eax, esp
mov dword [esp + 0x858], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10054020]
xor eax, esp
push eax
lea eax, [esp + 0x870]
mov dword fs:[0], eax
mov eax, dword [esp + 0x880]
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], edx
xor ebx, ebx
mov dword [esp + 0x878], ebx
mov edx, dword [esp + 0x888]
mov ebp, 8
cmp dword [esp + 0x89c], ebp
jae 0x1003d7e3
lea edx, [esp + 0x888]
mov eax, edx
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1003d800
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0x38]
call fcn.100025e0
cmp dword [esp + 0x48], ebp
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], ebx
jae 0x1003d82c
lea eax, [esp + 0x34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
push eax
push 0x80000001
call esi
cmp eax, ebx
jne 0x1003d858
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x1003d85a
xor al, al
cmp al, bl
sete byte [esp + 0x17]
cmp dword [esp + 0x48], ebp
jb 0x1003d874
mov eax, dword [esp + 0x34]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
cmp byte [esp + 0x17], bl
je 0x1003d89a
cmp dword [esp + 0x89c], ebp
jb 0x1003d893
mov ecx, dword [esp + 0x888]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, 1
jmp 0x1003dae3
push 0x7fe
lea edx, [esp + 0x72]
push ebx
push edx
mov byte [esp + 0x23], 1
mov dword [esp + 0x24], ebx
xor edi, edi
mov word [esp + 0x78], bx
call sub.MSVCR80.dll_memset
mov eax, dword [esp + 0x894]
add esp, 0xc
cmp dword [esp + 0x89c], ebp
mov dword [esp + 0x20], 0x800
jae 0x1003d8dc
lea eax, [esp + 0x888]
lea ecx, [esp + 0x18]
push ecx
push 0x20019
push ebx
push eax
push 0x80000001
call esi
test eax, eax
je 0x1003d913
cmp dword [esp + 0x89c], ebp
jb 0x1003d90c
mov edx, dword [esp + 0x888]
push edx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor al, al
jmp 0x1003dae3
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push eax
lea ecx, [esp + 0x888]
push ecx
push edx
mov edx, dword [esp + 0x30]
mov ecx, 0x80000001
call fcn.1003c3f0
test al, al
jne 0x1003d93b
mov byte [esp + 0x17], bl
mov edx, dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x80]
push ecx
push ebx
push edx
call ebp
cmp eax, 0x103
je 0x1003dab6
jmp 0x1003d970
lea eax, [esp + 0x6c]
mov dword [esp + 0x48], 7
mov dword [esp + 0x44], ebx
mov word [esp + 0x34], bx
lea edx, [eax + 2]
jmp 0x1003d990
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1003d990
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x70]
push eax
lea esi, [esp + 0x38]
call fcn.100025e0
mov ecx, esi
push ecx
lea edx, [esp + 0x888]
push edx
lea ecx, [esp + 0x58]
mov byte [esp + 0x880], 1
call fcn.10024290
add esp, 8
mov byte [esp + 0x878], 3
cmp dword [esp + 0x48], 8
jb 0x1003d9e9
mov eax, dword [esp + 0x34]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1c]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x78]
push edx
mov esi, 7
push eax
mov dword [esp + 0x5c], esi
mov dword [esp + 0x58], ebx
mov word [esp + 0x48], bx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003da6c
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x1003da2d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x24]
push ecx
push edx
sub esp, 0x1c
mov ecx, esp
mov dword [esp + 0x70], esp
push 0xffffffffffffffff
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x14], ebx
push ebx
lea eax, [esp + 0x7c]
mov word [ecx + 4], bx
call fcn.100020a0
mov ecx, dword [esp + 0x4c]
push 0x80000001
call fcn.1003d240
cmp al, bl
jne 0x1003da6c
mov byte [esp + 0x17], bl
add edi, 1
mov byte [esp + 0x878], bl
cmp dword [esp + 0x68], 8
mov dword [esp + 0x20], 0x800
jb 0x1003da92
mov eax, dword [esp + 0x54]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esp + 0x18]
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
push ecx
lea edx, [esp + 0x80]
push edx
push edi
push eax
call ebp
cmp eax, 0x103
jne 0x1003d970
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x1003dac5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x89c], 8
jb 0x1003dadf
mov ecx, dword [esp + 0x888]
push ecx
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov al, byte [esp + 0x17]
mov ecx, dword [esp + 0x870]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x858]
xor ecx, esp
call fcn.1003ec9d
add esp, 0x868
ret 0x20