Function at 0x1008ad1
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x34], bl
lea edi, [ebp - 0x33]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp dword [ebp + 8], ebx
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
stosb byte es:[edi], al
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], ebx
je 0x1008bab
mov eax, dword [0x1016c8c]
dec eax
je 0x1008b2f
dec eax
jne 0x1008d68
mov esi, 0x10059d4
jmp 0x1008b34
mov esi, 0x10059ac
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1008d68
push 0x14
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.0100c72b
test eax, eax
jne 0x1008b8e
push ebx
push 0x30
push 0x406
push ebx
call fcn.0100cc57
mov esi, 0x10051e4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
jmp 0x1008b9e
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push ebx
push 0x1004fa0
jmp 0x1008d56
lea eax, [ebp - 0x4c]
push eax
push 1
push ebx
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x14
pop esi
jne 0x1008c7b
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x1004fb0
push dword [ebp - 0x4c]
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.010086eb
test eax, eax
jne 0x1008c16
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0100c560
lea eax, [ebp - 0xc]
push eax
call fcn.0100c51a
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], ebx
jne 0x1008c27
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.010087ec
jmp 0x1008c6d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push 0x1004fa0
push dword [ebp - 0x4c]
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.010086eb
test eax, eax
jne 0x1008c70
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0100c560
lea eax, [ebp - 0xc]
push eax
call fcn.0100c51a
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008c88
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.010087ec
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1008d68
cmp dword [ebp - 0x50], 6
je 0x1008d5f
cmp dword [ebp - 0x50], 4
jne 0x1008d2e
push 4
lea eax, [ebp - 0x50]
push eax
push 4
push ebx
push 0x1004fa8
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x60], ebx
je 0x1008ce0
lea esi, [ebp - 0x20]
jmp 0x1008d44
lea eax, [ebp - 0x5c]
push eax
push 1
push ebx
push 0x1005210
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008d41
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x1004fb0
push dword [ebp - 0x5c]
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.010086eb
push dword [ebp - 0x5c]
lea esi, [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008d44
push 0x1004fa8
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea esi, [ebp - 0x34]
jmp 0x1008d44
mov esi, dword [ebp - 0x64]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebx
push 0x1004fb0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d038
leave
ret 4