Function at 0x1033d39
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xe98
mov eax, 0x104623a
call fcn.010383ac
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
xor esi, esi
lea eax, [ebp - 0x216]
mov ebx, ecx
push esi
push eax
mov dword [ebp - 0xe4c], ebx
mov dword [ebp - 0xe50], edi
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xea4]
push eax
lea eax, [ebp - 0xe78]
push eax
lea eax, [ebp - 0xe60]
push eax
lea eax, [ebp - 0xe64]
push eax
lea eax, [ebp - 0xe40]
push eax
lea eax, [ebp - 0xe5c]
push eax
lea eax, [ebp - 0xe74]
push eax
lea eax, [ebp - 0xe70]
push eax
push esi
lea eax, [ebp - 0xe6c]
push eax
lea eax, [ebp - 0x218]
push eax
push edi
mov dword [ebp - 0xe6c], 0x104
mov dword [ebp - 0xe70], esi
mov dword [ebp - 0xe74], esi
mov dword [ebp - 0xe5c], esi
mov dword [ebp - 0xe40], esi
mov dword [ebp - 0xe64], esi
mov dword [ebp - 0xe60], esi
mov dword [ebp - 0xe78], esi
mov dword [ebp - 0xe3c], esi
mov dword [ebp - 0xe58], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, esi
je 0x1033e15
mov dword [ebp - 0xe40], esi
cmp dword [ebp - 0xe40], esi
je 0x103403a
lea ecx, [ebp - 0xe38]
mov dword [ebp - 0xe44], 4
call fcn.0100a369
lea ecx, [ebp - 0xe1c]
mov dword [ebp - 4], esi
call fcn.0100a369
mov byte [ebp - 4], 1
mov dword [ebp - 0xe48], esi
cmp dword [ebp - 0xe40], esi
jbe 0x1033f90
mov edi, dword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov ebx, 0x10018f8
push esi
push esi
push esi
xor eax, eax
push esi
mov word [ebp - 0xe00], ax
lea eax, [ebp - 0xe58]
push eax
lea eax, [ebp - 0xe00]
push eax
push dword [ebp - 0xe48]
mov dword [ebp - 0xe58], 0x400
push dword [ebp - 0xe50]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1033f72
lea eax, [ebp - 0xe00]
push eax
lea ecx, [ebp - 0xe1c]
call fcn.0100a6fa
mov dword [ebp - 0xe54], 0x104fc38
mov dword [ebp - 0xe3c], esi
push dword [ebp - 0xe54]
lea ecx, [ebp - 0xe1c]
call fcn.01031461
test eax, eax
je 0x1034048
add dword [ebp - 0xe3c], 0x1c
add dword [ebp - 0xe54], 0x1c
cmp dword [ebp - 0xe3c], 0x8c
jb 0x1033ec6
cmp dword [ebp - 0xe04], 8
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xe44], 0x3e8
jae 0x1033f18
lea eax, [ebp - 0xe18]
lea ecx, [ebp - 0xe44]
push ecx
lea ecx, [ebp - 0x600]
push ecx
push esi
push 0xffff
push eax
push ebx
push dword [ebp - 0xe50]
call edi
test eax, eax
jne 0x1033f72
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0xe38]
call fcn.0100a6fa
mov ecx, dword [ebp - 0xe4c]
lea eax, [ebp - 0xe1c]
push eax
add ecx, 0x48
call fcn.01033b6e
push 0xffffffffffffffff
push esi
lea ecx, [ebp - 0xe38]
push ecx
mov ecx, eax
call fcn.0100a4df
inc dword [ebp - 0xe48]
mov eax, dword [ebp - 0xe48]
cmp eax, dword [ebp - 0xe40]
jb 0x1033e65
mov ebx, dword [ebp - 0xe4c]
push 0x100387c
lea ecx, [ebp - 0xe9c]
call fcn.0100a764
lea eax, [ebp - 0xe9c]
lea edi, [ebx + 0x54]
push eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.01033bec
mov eax, dword [eax]
push esi
push 1
lea ecx, [ebp - 0xe9c]
mov dword [ebp - 0xe80], eax
mov byte [ebp - 4], 1
call fcn.0100a063
push 0x100385c
lea ecx, [ebp - 0xe9c]
call fcn.0100a764
lea eax, [ebp - 0xe9c]
push eax
mov ecx, edi
mov byte [ebp - 4], 3
call fcn.01033bec
mov eax, dword [eax]
xor edi, edi
push esi
inc edi
push edi
lea ecx, [ebp - 0xe9c]
mov dword [ebp - 0xe7c], eax
call fcn.0100a063
add ebx, 0x38
push ebx
lea eax, [ebp - 0xe80]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
push esi
push edi
lea ecx, [ebp - 0xe1c]
mov dword [ebp - 0xe3c], edi
call fcn.0100a063
push esi
push edi
lea ecx, [ebp - 0xe38]
call fcn.0100a063
mov eax, dword [ebp - 0xe3c]
call fcn.0103843e
ret 4
cmp dword [ebp - 0xe04], 8
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0xe44], 4
jae 0x1034067
lea eax, [ebp - 0xe18]
lea ecx, [ebp - 0xe44]
push ecx
lea ecx, [ebp - 0xe68]
push ecx
push esi
push 0xffff
push eax
push ebx
push dword [ebp - 0xe50]
call edi
test eax, eax
jne 0x1033f72
mov ecx, dword [ebp - 0xe4c]
lea eax, [ebp - 0xe1c]
push eax
add ecx, 0x54
call fcn.01033bec
mov ecx, dword [ebp - 0xe68]
mov dword [eax], ecx
jmp 0x1033f72