Function at 0x101eece
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x1027018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [ebp - 0x138], eax
mov eax, dword [ebp + 0x1c]
push 0x103
mov dword [ebp - 0x134], eax
lea eax, [ebp - 0x107]
push ebx
push eax
mov dword [ebp - 0x130], edi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x12c], ebx
mov byte [ebp - 0x108], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push esi
mov dword [ebp - 0x120], 0x104
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, dword [ebp - 0x11c]
mov ecx, esi
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x128], 1
call fcn.0101d394
test eax, eax
jne 0x101ef89
mov dword [ebp - 0x10c], 0x8007000e
jmp 0x101f0f1
cmp dword [esi + 0x1c], 7
jge 0x101ef9e
mov dword [ebp - 0x10c], 0x8007139f
jmp 0x101f0f1
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x101f0e7
cmp edi, ebx
je 0x101f0e7
mov eax, dword [esi + 0x24]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x101efda
cmp dx, bx
je 0x101efd6
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x101efda
add ecx, 4
add eax, 4
cmp dx, bx
jne 0x101efb4
xor eax, eax
jmp 0x101efdf
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x101eff2
mov dword [ebp - 0x10c], 0x80070005
jmp 0x101f0f1
lea eax, [ebp - 0x124]
push eax
call fcn.01023c03
mov dword [ebp - 0x10c], eax
cmp eax, ebx
jne 0x101f0f1
lea eax, [ebp - 0x114]
push eax
mov edi, 0x2001f
push edi
push ebx
mov esi, 0x1001798
push esi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x101f04c
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
cmp eax, ebx
jne 0x101f1ff
lea eax, [ebp - 0x110]
push eax
push edi
push ebx
push dword [ebp - 0x130]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x101f08c
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 0x130]
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
jne 0x101f1ff
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x12c]
push eax
push ebx
mov edi, 0x1001790
push edi
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x101f158
push dword [ebp - 0x118]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x101f18c
test byte [ebp + 0x20], 1
je 0x101f18c
mov dword [ebp - 0x10c], 0x80070057
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x110], ebx
je 0x101f107
push dword [ebp - 0x110]
call esi
cmp dword [ebp - 0x114], ebx
je 0x101f117
push dword [ebp - 0x114]
call esi
cmp dword [ebp - 0x128], ebx
pop edi
pop esi
pop ebx
je 0x101f139
push dword [ebp - 0x138]
mov ecx, dword [ebp - 0x11c]
call fcn.0101da83
mov dword [ebp - 0x10c], eax
mov ecx, dword [ebp - 0x11c]
call fcn.0101d3ad
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10c]
xor ecx, ebp
call fcn.0102302f
leave
ret 0x1c
mov eax, dword [ebp + 0x20]
and eax, 1
je 0x101f168
mov ecx, dword [ebp - 0x13c]
jmp 0x101f16b
push 0xe
pop ecx
cmp eax, ebx
mov eax, dword [ebp - 0x118]
jne 0x101f17a
mov eax, 0x1001780
push ecx
push eax
push 1
push ebx
push edi
push dword [ebp - 0x110]
call esi
cmp eax, ebx
jne 0x101f1ff
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x12c]
push eax
push ebx
push dword [ebp - 0x118]
mov dword [ebp - 0x120], 0x104
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x101f1cd
mov dword [ebp - 0x128], ebx
jmp 0x101f0f1
mov edi, dword [ebp - 0x134]
cmp edi, ebx
jne 0x101f1dc
mov edi, 0x100177c
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push ebx
push dword [ebp - 0x118]
push dword [ebp - 0x110]
call esi
cmp eax, ebx
je 0x101f0f1
jle 0x101f20b
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 0x10c], eax
jmp 0x101f0f1