Function at 0x10035f8
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x1005010]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
push eax
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x234], ecx
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x22c], edi
mov dword [ebp - 0x220], edi
mov dword [ebp - 0x210], edi
mov dword [ebp - 0x218], edi
mov dword [ebp - 0x21c], edi
call fcn.01002f66
call fcn.01002ee6
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x238], eax
lea eax, [ebp - 0x220]
push eax
mov ebx, 0x20019
push ebx
push edi
push 0x100122c
push 0x80000002
call esi
test eax, eax
jne 0x10036c2
mov eax, 0x100134c
cmp dword [0x1005040], edi
jne 0x100368f
mov eax, 0x1001344
lea ecx, [ebp - 0x210]
push ecx
push ebx
push edi
push eax
push dword [ebp - 0x220]
call esi
test eax, eax
jne 0x10036c2
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x21c]
push eax
push edi
push edi
push edi
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov eax, dword [ebp - 0x21c]
imul eax, eax, 0x14
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [0x1005034], eax
cmp eax, edi
je 0x1003936
mov dword [ebp - 0x214], edi
mov dword [ebp - 0x230], 0x104
cmp dword [ebp - 0x21c], edi
jbe 0x1003940
xor esi, esi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1003940
cmp dword [ebp - 0x238], edi
je 0x100374d
push 0x100133c
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x1003912
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1003756
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x1005034]
mov dword [esi + ecx], eax
mov eax, dword [0x1005034]
mov ecx, dword [esi + eax]
cmp ecx, edi
je 0x1003912
lea eax, [ebp - 0x20c]
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1003793
sub eax, ebx
sar eax, 1
lea edx, [ebp - 0x20c]
push edx
inc eax
push eax
push ecx
call fcn.01001825
lea eax, [ebp - 0x218]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003912
mov eax, dword [0x1005034]
lea eax, [esi + eax + 4]
push eax
push 0x1001274
push dword [ebp - 0x218]
call fcn.01002ac6
mov eax, dword [0x1005034]
lea eax, [esi + eax + 8]
push eax
push 0x100128c
push dword [ebp - 0x218]
call fcn.010030a1
mov eax, dword [0x1005034]
lea eax, [esi + eax + 0xc]
push eax
push 0x1001290
push dword [ebp - 0x218]
call fcn.010030a1
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x1005034]
cmp dword [esi + eax + 4], edi
jne 0x100389e
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1003846
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ecx, dword [0x1005034]
mov dword [esi + ecx + 4], eax
mov eax, dword [0x1005034]
mov ecx, dword [esi + eax + 4]
cmp ecx, edi
je 0x100389e
lea eax, [ebp - 0x20c]
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x1003881
sub eax, ebx
sar eax, 1
lea edx, [ebp - 0x20c]
push edx
inc eax
push eax
push ecx
call fcn.01001825
push dword [ebp - 0x228]
mov eax, dword [0x1005034]
push dword [esi + eax + 4]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push edi
push 0x180
push dword [ebp - 0x224]
call ebx
push eax
push 0x19a
push dword [ebp - 0x224]
call ebx
cmp dword [ebp - 0x234], edi
je 0x1003909
mov eax, dword [0x1005034]
mov eax, dword [esi + eax + 4]
cmp eax, edi
je 0x1003909
push dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1003909
push edi
push dword [ebp - 0x214]
push 0x186
push dword [ebp - 0x224]
call ebx
inc dword [ebp - 0x228]
add esi, 0x14
inc dword [ebp - 0x214]
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x230], 0x104
cmp eax, dword [ebp - 0x21c]
jb 0x10036ff
jmp 0x1003940
mov dword [ebp - 0x22c], 0x8007000e
cmp dword [ebp - 0x210], edi
je 0x1003954
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x220], edi
pop edi
pop esi
pop ebx
je 0x100396b
push dword [ebp - 0x220]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x22c]
xor ecx, ebp
call fcn.01003d2d
leave
ret 8