Function at 0x103925c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x974
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor esi, esi
lea ecx, [ebp - 0x938]
mov dword [ebp - 0x908], esi
call fcn.01031eac
mov eax, dword [ebp + 0xc]
mov dword [0x10416ec], eax
mov eax, dword [ebp + 0x10]
mov dword [0x10416e8], eax
call fcn.01036ea3
lea eax, [ebp - 0x938]
push eax
call fcn.0103802c
test eax, eax
je 0x10396d5
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x910]
push eax
push 0x20019
push esi
push dword [0x103f06c]
mov dword [ebp - 0x904], esi
push 0x80000002
mov dword [ebp - 0x90c], esi
mov dword [ebp - 0x910], esi
call ebx
test eax, eax
jne 0x10396d5
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp dword [ebp + 8], esi
jne 0x10393cd
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x10042dc
push dword [ebp - 0x910]
call ebx
test eax, eax
jne 0x10393cd
lea ecx, [ebp - 0x974]
call fcn.01031f63
lea ecx, [ebp - 0x974]
call fcn.01031f99
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
jmp 0x10393a0
inc dword [ebp - 0x90c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x974]
push eax
call fcn.0102fd0e
test eax, eax
jne 0x10393b6
lea eax, [ebp - 0x974]
push eax
call fcn.010383de
test eax, eax
je 0x1039380
lea eax, [ebp - 0x974]
push eax
lea eax, [ebp - 0x938]
push eax
call fcn.0103585a
lea ecx, [ebp - 0x974]
call fcn.01031f99
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], 0x10
call edi
test eax, eax
je 0x1039343
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x974]
call fcn.01031f99
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x1008d3c
push dword [ebp - 0x910]
call ebx
push 0x64
pop ebx
test eax, eax
jne 0x1039461
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x900]
push eax
mov dword [ebp - 0x90c], esi
push esi
jmp 0x1039443
inc dword [ebp - 0x90c]
lea eax, [ebp - 0x900]
push eax
call fcn.01038a97
test eax, eax
je 0x103942b
lea eax, [ebp - 0x900]
push eax
call fcn.0103cc3d
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x900]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], ebx
call edi
test eax, eax
je 0x1039409
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], esi
jne 0x10396c8
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x1008d28
push dword [ebp - 0x910]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1039543
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x90c], esi
push esi
jmp 0x1039521
inc dword [ebp - 0x90c]
push 0x208
lea eax, [ebp - 0x708]
push eax
mov eax, 0x12c
push eax
lea ecx, [ebp - 0x424]
push ecx
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.01038d8d
test eax, eax
je 0x1039509
lea eax, [ebp - 0x708]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x91c]
lea eax, [ebp - 0xec]
push eax
call fcn.01032ec6
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], ebx
call edi
test eax, eax
je 0x10394ab
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x908]
push eax
push 0x20019
push esi
push 0x1008d18
push dword [ebp - 0x910]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10396c8
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
mov dword [ebp - 0x90c], esi
push esi
jmp 0x10396a6
inc dword [ebp - 0x90c]
mov eax, 0x208
push eax
lea ecx, [ebp - 0x708]
push ecx
push eax
lea eax, [ebp - 0x500]
push eax
lea eax, [ebp - 0xec]
push eax
call fcn.01038ffe
test eax, eax
je 0x103968e
lea eax, [ebp - 0x914]
push eax
push 1
push esi
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x908]
mov dword [ebp - 0x914], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1039662
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0x2f8]
push eax
lea eax, [ebp - 0x918]
push eax
push esi
push 0x10066c4
push dword [ebp - 0x914]
mov dword [ebp - 0x904], 0x20a
mov dword [ebp - 0x918], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1039656
cmp dword [ebp - 0x918], 1
jne 0x1039656
mov word [ebp - 0xf0], ax
lea eax, [ebp - 0x2f8]
push 0x1001e30
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1039656
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x103968e
push dword [ebp - 0x914]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x934]
lea eax, [ebp - 0x708]
push dword [ebp - 0x938]
push eax
lea eax, [ebp - 0x500]
push eax
push dword [ebp - 0x91c]
lea eax, [ebp - 0xec]
push eax
call fcn.01033448
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x904]
push eax
lea eax, [ebp - 0xec]
push eax
push dword [ebp - 0x90c]
push dword [ebp - 0x908]
mov dword [ebp - 0x904], ebx
call edi
test eax, eax
je 0x1039587
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x910]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
lea ecx, [ebp - 0x938]
call fcn.01031ecd
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 0xc