Function at 0x1003e4ea
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40c], eax
mov eax, dword [ebp + 0x18]
push eax
push 0
push esi
mov dword [ebp - 0x418], 1
mov dword [ebp - 0x414], eax
call fcn.10007496
add esp, 0xc
push ebx
lea ecx, [ebp - 0x51c]
call fcn.1000c2ef
mov eax, dword [eax]
lea ecx, [ebp - 0x410]
push ecx
push 0x20019
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
lea eax, [ebp - 0x518]
setne byte [ebp - 0x405]
cmp dword [ebp - 0x51c], eax
je 0x1003e578
push dword [ebp - 0x51c]
call fcn.100425b3
pop ecx
cmp byte [ebp - 0x405], 0
je 0x1003e598
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x40c]
call fcn.1003e386
add esp, 0xc
jmp 0x1003e709
lea eax, [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x418]
push eax
push 0
push dword [ebp - 0x40c]
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x410]
test eax, eax
je 0x1003e5cd
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1003e581
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [0x10144f0d], 0
je 0x1003e645
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str.tc_Env_tc_CLIENT
push ebx
call edi
test eax, eax
jne 0x1003e606
push str.tc_Env_tc_COMMUNICATION
push ebx
call edi
test eax, eax
jne 0x1003e606
push str.TC_INSTALL
push ebx
call edi
test eax, eax
je 0x1003e645
push 0x3ff
lea eax, [ebp - 0x403]
push 0
push eax
mov byte [ebp - 0x404], 0
call fcn.10040850
lea eax, [ebp - 0x404]
push eax
push esi
push dword [ebp - 0x40c]
push 0
call fcn.10033337
lea eax, [ebp - 0x404]
push eax
push esi
call fcn.100074d8
add esp, 0x24
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e64a
sub eax, edx
cmp eax, 2
jbe 0x1003e6a6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e65d
sub eax, edx
cmp byte [eax + esi - 1], 0xa
jne 0x1003e67f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e672
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e684
sub eax, edx
cmp byte [eax + esi - 1], 0xd
jne 0x1003e6a6
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e699
sub eax, edx
mov byte [eax + esi - 1], cl
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e6ab
mov ecx, dword [ebp + 0x18]
sub eax, edx
sub ecx, eax
je 0x1003e6ec
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1003e6c0
sub eax, edx
mov edi, eax
mov eax, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1003e6d0
sub eax, ecx
mov ecx, dword [ebp + 0x18]
sub ecx, edi
push ecx
add eax, esi
push 0
push eax
call fcn.10007496
add esp, 0xc
cmp byte [esi], 0
jne 0x1003e703
push dword [ebp + 0x18]
push esi
push dword [ebp - 0x40c]
call fcn.1003e386
add esp, 0xc
mov eax, dword [ebp - 0x414]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
leave
ret