Function at 0x10003082
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
push dword [ebp + 8]
xor esi, esi
push dword [ebp + 0x18]
lea ecx, [ebp - 4]
mov dword [ebp - 4], esi
call fcn.1000178c
push eax
call fcn.10001a80
mov edi, eax
cmp edi, esi
jge 0x100030cd
push edi
call fcn.100023b5
push esi
mov ebx, eax
mov eax, 0x1001be90
push eax
push esi
push esi
push ebx
push eax
call fcn.10002591
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1000313d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0x18]
push eax
push esi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
mov dword [ebp + 0x18], esi
push dword [ebp - 4]
mov dword [ebp - 8], 3
call ebx
push eax
call fcn.10001a80
mov edi, eax
cmp edi, esi
jl 0x100030ac
lea eax, [ebp + 8]
push eax
push 1
push esi
mov dword [ebp + 8], esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov edi, eax
cmp edi, esi
jge 0x10003144
push edi
call fcn.100023b5
push esi
mov ebx, eax
mov eax, 0x1001be90
push eax
push esi
push esi
push ebx
push eax
call fcn.10002591
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1000313d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, edi
jmp 0x10003250
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov edi, dword [ecx]
xor edx, edx
push edx
push eax
push ecx
call dword [edi + 0x18]
mov edi, eax
cmp edi, esi
jl 0x10003111
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_GetHGlobalFromStream]
mov edi, eax
cmp edi, esi
jl 0x10003111
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
lea eax, [ebp + 0x18]
push eax
push edi
lea eax, [ebp - 8]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call ebx
push eax
call fcn.10001a80
cmp eax, esi
mov dword [ebp + 0xc], eax
jge 0x100031da
push eax
call fcn.100023b5
push esi
mov ebx, eax
mov eax, 0x1001be90
push eax
push esi
push esi
push ebx
push eax
call fcn.10002591
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, esi
je 0x100031c8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x100031d5
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, dword [ebp + 0xc]
jmp 0x10003250
mov eax, dword [ebp + 0x18]
cmp eax, 8
lea ebx, [edi + eax - 8]
jb 0x1000322c
add eax, 0xfffffffc
push eax
push edi
push esi
call fcn.10001421
add esp, 0xc
cmp dword [ebx + 4], eax
jne 0x1000322c
mov eax, dword [ebx]
cmp eax, dword [ebp + 0x10]
jne 0x1000322c
cmp edi, esi
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov dword [ebp + 8], esi
mov dword [ecx], eax
je 0x10003250
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x10003250
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10003250
cmp edi, esi
je 0x1000323e
push edi
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [ebp + 8]
cmp eax, esi
je 0x1000324b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov esi, 0x8007000b
lea ecx, [ebp - 4]
call fcn.10001727
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x14