Function at 0x1002512
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.msvcrt.dll__wcsupr]
xor ebx, ebx
cmp word [esi], 0x2d
pop ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
lea edi, [esi + 2]
jne 0x100296b
mov esi, dword [sym.imp.msvcrt.dll_wcscmp]
push 0x10015c0
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x100265b
push 0x10015b8
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x100265b
push 0x10015ac
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x100265b
push 0x10015a8
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002652
push 0x10015a0
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002652
push 0x1001594
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002652
push 0x100158c
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002649
push 0x1001580
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002649
push 0x1001578
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002640
push 0x1001568
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002640
push 0x1001560
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002637
push 0x1001554
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x1002637
push 0x100154c
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x100262e
push 0x100153c
push edi
call esi
test eax, eax
pop ecx
pop ecx
je 0x100262e
call fcn.010021c8
jmp 0x1002970
mov dword [ebp + 8], 2
jmp 0x1002662
mov dword [ebp + 8], 1
jmp 0x1002662
mov dword [ebp - 4], 2
jmp 0x1002662
mov dword [ebp - 4], 1
jmp 0x1002662
mov dword [ebp + 8], 3
jmp 0x1002662
mov dword [ebp - 4], 3
mov esi, dword [ebp + 0xc]
xor edx, edx
cmp esi, ebx
lea eax, [ebp - 0x74]
je 0x1002694
cmp word [esi], bx
je 0x100268f
mov ecx, esi
lea edi, [ebp - 0x74]
sub ecx, edi
mov di, word [ecx + eax]
mov word [eax], di
inc eax
inc eax
inc edx
cmp edx, 0x20
jge 0x100268f
cmp word [ecx + eax], bx
jne 0x100267a
mov word [eax], bx
jmp 0x10026a6
push 0x65
call fcn.010015fc
push eax
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x34]
push eax
push esi
call fcn.01001b85
test eax, eax
je 0x10026eb
cmp dword [ebp - 4], ebx
je 0x10026c7
push esi
call fcn.01001d4e
lea eax, [ebp - 0x74]
push eax
push 8
jmp 0x10026df
cmp dword [ebp + 8], ebx
je 0x1002970
push dword [ebp + 8]
push esi
call fcn.01001dd2
lea eax, [ebp - 0x74]
push eax
push 4
push 1
call fcn.01002236
jmp 0x1002970
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.010016a7
mov esi, eax
cmp esi, ebx
je 0x100271f
push 0x193
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
mov eax, esi
jmp 0x1002972
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [0x1004004]
mov dword [ebp - 0x18], ebx
push dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x100276f
cmp eax, 0xb7
jne 0x1002759
cmp dword [ebp - 0x28], 2
je 0x1002775
push 0x193
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
jmp 0x100291e
cmp dword [ebp - 0x28], 2
jne 0x10027a2
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push dword [0x1004034]
mov dword [ebp + 0xc], 4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
mov dword [ebp + 0xc], eax
jne 0x10027a2
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call fcn.010018a8
xor esi, esi
test byte [ebp - 4], 1
mov ebx, eax
mov dword [ebp - 0xc], esi
je 0x10027d5
test bl, 1
jne 0x10027d5
push dword [ebp - 0x10]
call fcn.01001926
xor edi, edi
inc edi
test eax, eax
jne 0x10027d8
mov dword [ebp - 0xc], edi
mov esi, edi
jmp 0x10027d8
xor edi, edi
inc edi
test byte [ebp - 4], 2
je 0x10027f3
test bl, 2
jne 0x10027f3
push dword [ebp - 0x14]
call fcn.01001926
test eax, eax
jne 0x10027f3
mov dword [ebp - 0xc], edi
inc esi
test byte [ebp + 8], 1
je 0x100280e
test bl, 1
je 0x100280e
push dword [ebp - 0x10]
call fcn.01001995
test eax, eax
jne 0x100280e
mov dword [ebp - 0xc], edi
dec esi
test byte [ebp + 8], 2
je 0x1002829
test bl, 2
je 0x1002829
push dword [ebp - 0x14]
call fcn.01001995
test eax, eax
jne 0x1002829
mov dword [ebp - 0xc], edi
dec esi
push dword [ebp - 0x14]
and dword [ebp - 8], 0
push dword [ebp - 0x10]
call fcn.010018a8
cmp dword [ebp - 0xc], 0
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
je 0x10028a4
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
push 4
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push 4
push 0
push dword [0x1004028]
push dword [ebp - 0x20]
call edi
cmp dword [ebp + 8], 0
mov dword [ebp + 0xc], eax
je 0x1002881
mov eax, dword [ebp - 0x1c]
add eax, esi
test ebx, ebx
mov dword [ebp - 8], eax
jne 0x10028a0
push 7
jmp 0x1002896
cmp dword [ebp - 4], 0
je 0x10028c1
mov eax, dword [ebp - 0x1c]
add eax, esi
cmp ebx, 3
mov dword [ebp - 8], eax
jne 0x10028a0
push 9
pop ecx
cmp eax, ecx
jge 0x10028c1
mov dword [ebp - 8], ecx
jmp 0x10028c1
push 8
jmp 0x1002896
lea eax, [ebp - 0x74]
push eax
push ebx
push 1
call fcn.01002236
push 0x1a0
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
cmp dword [ebp - 0x18], 0
je 0x100291c
cmp dword [ebp + 0xc], 0
jne 0x100291c
xor esi, esi
cmp dword [ebp - 0xc], esi
je 0x100290d
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push dword [0x1004034]
push dword [ebp - 0x18]
call edi
cmp eax, esi
mov dword [ebp + 0xc], eax
jne 0x10028fc
lea eax, [ebp - 0x74]
push eax
push ebx
push esi
call fcn.01002236
jmp 0x100290d
push 0x195
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
push dword [ebp - 0x18]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
xor ebx, ebx
jmp 0x1002924
xor ebx, ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x20], ebx
je 0x100292e
push dword [ebp - 0x20]
call esi
cmp dword [ebp - 0x10], ebx
je 0x1002938
push dword [ebp - 0x10]
call esi
cmp dword [ebp - 0x14], ebx
je 0x1002942
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x24], ebx
je 0x100294c
push dword [ebp - 0x24]
call esi
cmp dword [ebp + 0xc], ebx
je 0x1002966
push dword [ebp + 0xc]
push 0x198
call fcn.0100165b
push eax
call fcn.01002144
pop ecx
pop ecx
mov eax, dword [ebp + 0xc]
jmp 0x1002972
call fcn.0100215f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8