Function at 0x1020468
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x1028058]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 5
pop ecx
mov esi, 0x1001914
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x16
pop ecx
mov esi, 0x10018b8
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xb
pop ecx
mov esi, 0x100188c
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0x2b8], edi
cmp dword [ebp + 8], edi
je 0x1020741
lea eax, [ebp - 0x2b0]
push eax
push 0xf003f
push edi
push 0x1001838
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020712
push 0x204
lea eax, [ebp - 0x2a8]
push edi
push eax
mov dword [ebp - 0x2ac], edi
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2ac]
push eax
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
mov dword [ebp - 0x2c0], 0x208
call esi
mov dword [ebp - 0x2b4], eax
cmp eax, edi
jne 0x1020546
cmp dword [ebp - 0x2c0], edi
jne 0x1020546
mov dword [ebp - 0x2b4], 2
push ebx
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10205b0
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x1001828
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x1020582
push 0x100181c
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
jne 0x10205b0
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpICW]
push 0x10017e8
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x10205b0
push 0x10017b0
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x10205b0
xor ebx, ebx
jmp 0x10205b3
xor ebx, ebx
inc ebx
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x10206dd
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x10206dd
cmp ebx, edi
jne 0x10205e8
cmp dword [ebp - 0x2b4], edi
je 0x1020705
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x5a
lea eax, [ebp - 0xa4]
push eax
push 1
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
call ebx
lea eax, [ebp - 0x2bc]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call esi
cmp eax, edi
jne 0x10206c3
mov esi, dword [ebp - 0x2bc]
cmp esi, edi
je 0x10206c3
add esi, 4
shr esi, 1
inc esi
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2b4], eax
cmp eax, edi
je 0x10206c3
lea ecx, [ebp - 0x2bc]
push ecx
push eax
push edi
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x2b4]
mov dword [ebp - 0x2c4], esi
call fcn.010203de
test eax, eax
jl 0x10206b5
mov eax, dword [ebp - 0x2c4]
add eax, eax
push eax
push dword [ebp - 0x2b4]
lea eax, [ebp - 0x48]
push 7
push edi
push eax
push dword [ebp - 0x2b0]
call ebx
push dword [ebp - 0x2b4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1020705
push 4
lea eax, [ebp - 0x2b8]
push eax
push 7
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call ebx
jmp 0x1020705
cmp ebx, edi
jne 0x10206e9
cmp dword [ebp - 0x2b4], edi
je 0x1020705
push 0x5a
lea eax, [ebp - 0xa4]
push eax
push 1
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
cmp dword [ebp + 0xc], edi
jne 0x1020741
push 0x1001798
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x1020741
push 0x1001784
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x102073a
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023ead
leave
ret 8