Function at 0x10038840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3c8]
sub esp, 0x448
mov eax, dword [0x1024bd20]
xor eax, ebp
mov dword [ebp + 0x3c4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
mov word [ebp + 0x198], ax
lea eax, [ebp + 0x19a]
push eax
call fcn.10179250
push 0x101d7330
mov ebx, 0x104
lea eax, [ebp + 0x198]
push ebx
push eax
call fcn.1017c1f6
mov eax, dword [ebp + 0x3d0]
add esp, 0x18
mov dword [ebp - 0x74], eax
mov ecx, 0x1025c27c
lea eax, [ebp - 0x74]
push eax
call fcn.1003a183
push dword [eax]
lea eax, [ebp + 0x198]
push ebx
push eax
call fcn.1017c18a
add esp, 0xc
mov dword [ebp - 0x7c], 0x22
xor eax, eax
lea edi, [ebp + 0x3a2]
xor bl, bl
push 8
pop ecx
rep stosd dword es:[edi], eax
mov word [ebp + 0x3a0], ax
call fcn.10158e10
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10038997
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push eax
call fcn.10179250
lea eax, [ebp + 0x198]
push eax
lea eax, [ebp - 0x70]
push 0x104
push eax
call fcn.1017c1f6
push 0x101d730c
lea eax, [ebp - 0x70]
push 0x104
push eax
call fcn.1017c18a
and dword [ebp - 0x74], 0
lea eax, [ebp - 0x74]
add esp, 0x24
push eax
push 0xf013f
push 0
lea eax, [ebp - 0x70]
push eax
push connect
call esi
cmp dword [ebp - 0x74], 0
je 0x1003897e
xor ecx, ecx
lea eax, [ebp - 0x80]
push eax
push ecx
push ecx
push ecx
push 0x101d73ac
push dword [ebp - 0x74]
mov dword [ebp - 0x80], ecx
call edi
cmp eax, 0xea
je 0x10038973
test eax, eax
jne 0x10038975
mov bl, 1
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x101d73d0
lea eax, [ebp + 0x198]
push 0x104
push eax
call fcn.1017c18a
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x20019
push 0
lea eax, [ebp + 0x198]
push eax
push connect
call esi
mov eax, dword [ebp - 0x78]
test eax, eax
jne 0x100389e7
xor ecx, ecx
lea eax, [ebp - 0x78]
push ecx
push eax
push ecx
push 0x20019
push ecx
push ecx
push ecx
lea eax, [ebp + 0x198]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [ebp - 0x78]
test eax, eax
jne 0x100389e7
xor al, al
jmp 0x10038aaf
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp + 0x3a0]
push ecx
push 0
push 0
push 0x101d73e8
push eax
call edi
mov esi, eax
test esi, esi
jne 0x10038a5a
lea ecx, [ebp + 0x3a0]
mov eax, 0x101d73f8
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10038a35
test dx, dx
je 0x10038a31
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10038a35
add eax, 4
add ecx, 4
test dx, dx
jne 0x10038a0f
xor eax, eax
jmp 0x10038a3a
sbb eax, eax
or eax, 1
test eax, eax
sete bl
cmp byte [ebp + 0x3d4], 0
jne 0x10038aa4
cmp word [ebp + 0x3a0], 0
je 0x10038a56
test bl, bl
je 0x10038aa2
xor bl, bl
jmp 0x10038aa4
mov bh, byte [ebp + 0x3d4]
cmp esi, 0xea
jne 0x10038a6c
test bh, bh
je 0x10038aa2
call fcn.10158e10
test eax, eax
jne 0x10038aa4
cmp esi, 2
jne 0x10038aa4
test bh, bh
jne 0x10038aa4
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x3a0]
push eax
push 0
push 0
push 0x101d741c
push dword [ebp - 0x78]
call edi
test eax, eax
je 0x10038aa2
cmp eax, 0xea
jne 0x10038aa4
mov bl, 1
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
mov ecx, dword [ebp + 0x3c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1017868e
lea esp, [ebp + 0x3c8]
pop ebp
ret