Function at 0x10317b8
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
inc eax
push edi
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x258]
push eax
xor edi, edi
mov ebx, 0x2001f
push ebx
push edi
push ecx
push 0x80000000
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], edi
call esi
test eax, eax
jne 0x1031d7e
lea eax, [ebp - 0x24c]
push eax
push ebx
push edi
push 0x10064d8
push dword [ebp - 0x258]
mov dword [ebp - 0x24c], edi
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, 0x10064bc
test eax, eax
jne 0x1031984
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103196c
cmp dword [ebp - 0x250], 1
je 0x1031894
cmp dword [ebp - 0x250], 2
jne 0x103196c
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x103196c
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.01031552
test eax, eax
jne 0x10318e1
push dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x258]
call esi
jmp 0x1031d7e
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1031966
cmp dword [ebp - 0x250], 1
je 0x1031924
cmp dword [ebp - 0x250], 2
jne 0x1031966
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103192d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call ebx
jmp 0x103196c
mov dword [ebp - 0x25c], edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x25c], edi
je 0x1031ad9
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x10064a4
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1031ae9
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push 0x1004364
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1031a35
cmp dword [ebp - 0x250], 1
je 0x10319f1
cmp dword [ebp - 0x250], 2
jne 0x1031a35
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1031a35
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x248]
mov dword [esp], 0x10020ac
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1031a35
push 0x1004364
push dword [ebp - 0x24c]
call ebx
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1031ac2
cmp dword [ebp - 0x250], 1
je 0x1031a78
cmp dword [ebp - 0x250], 2
jne 0x1031ac2
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1031ac2
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1031a91
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x1031ac3
push edi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1031ae9
push 0x10064a4
push dword [ebp - 0x258]
call fcn.0102f8ce
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x1006498
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1031c27
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1031b7e
cmp dword [ebp - 0x250], 1
jne 0x1031b7e
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1031b7e
lea eax, [ebp - 0x248]
push 0x100648c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [ebp - 0x260], eax
je 0x1031c0f
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1031bfe
cmp dword [ebp - 0x250], 1
jne 0x1031bfe
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1031bfe
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1031bd1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x1031c07
cmp dword [ebp - 0x25c], edi
jne 0x1031c0f
push edi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x260], edi
je 0x1031d72
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x1006474
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1031cec
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1031ce0
cmp dword [ebp - 0x250], 1
je 0x1031c90
cmp dword [ebp - 0x250], 2
jne 0x1031ce0
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1031ce0
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1031ca9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x258]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1031d72
cmp dword [ebp - 0x250], 1
jne 0x1031d72
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1031d72
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1031d3f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push edi
push edi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x258]
call ebx
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 4