Function at 0x1069174
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
inc eax
push edi
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x258]
push eax
xor edi, edi
mov ebx, 0x2001f
push ebx
push edi
push ecx
push SysReAllocString
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], edi
call esi
test eax, eax
jne 0x106973a
lea eax, [ebp - 0x24c]
push eax
push ebx
push edi
push 0x100ebd0
push dword [ebp - 0x258]
mov dword [ebp - 0x24c], edi
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, 0x100ebb4
jne 0x1069340
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1069328
cmp dword [ebp - 0x250], 1
je 0x1069250
cmp dword [ebp - 0x250], 2
jne 0x1069328
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x1069328
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.01068e7c
test eax, eax
jne 0x106929d
push dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x258]
call esi
jmp 0x106973a
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1069322
cmp dword [ebp - 0x250], 1
je 0x10692e0
cmp dword [ebp - 0x250], 2
jne 0x1069322
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10692e9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call ebx
jmp 0x1069328
mov dword [ebp - 0x25c], edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x25c], edi
je 0x1069495
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x100eb9c
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10694a5
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push 0x100eb8c
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10693f1
cmp dword [ebp - 0x250], 1
je 0x10693ad
cmp dword [ebp - 0x250], 2
jne 0x10693f1
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x10693f1
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x248]
mov dword [esp], 0x100eb70
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x10693f1
push 0x100eb8c
push dword [ebp - 0x24c]
call ebx
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106947e
cmp dword [ebp - 0x250], 1
je 0x1069434
cmp dword [ebp - 0x250], 2
jne 0x106947e
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106947e
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106944d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x106947f
push edi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10694a5
push 0x100eb9c
push dword [ebp - 0x258]
call fcn.01058684
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x100eb64
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10695e3
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106953a
cmp dword [ebp - 0x250], 1
jne 0x106953a
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106953a
lea eax, [ebp - 0x248]
push 0x100bd78
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [ebp - 0x260], eax
je 0x10695cb
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10695ba
cmp dword [ebp - 0x250], 1
jne 0x10695ba
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x10695ba
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106958d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x10695c3
cmp dword [ebp - 0x25c], edi
jne 0x10695cb
push edi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x260], edi
je 0x106972e
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x100eb4c
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10696a8
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106969c
cmp dword [ebp - 0x250], 1
je 0x106964c
cmp dword [ebp - 0x250], 2
jne 0x106969c
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106969c
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1069665
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x258]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106972e
cmp dword [ebp - 0x250], 1
jne 0x106972e
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106972e
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10696fb
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push edi
push edi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x258]
call ebx
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 4