Function at 0x1063a5b
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
xor esi, esi
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x28], ecx
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], esi
call fcn.01062fb7
cmp dword [ebp - 0x1c], esi
je 0x1063dcd
cmp dword [ebp - 0x10], esi
je 0x1063dcd
push esi
lea eax, [ebp - 0xc]
push eax
push esi
push 3
push esi
push esi
push esi
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
cmp ebx, esi
mov dword [ebp + 8], ebx
jne 0x1063dcd
cmp dword [ebp + 0x10], esi
je 0x1063dad
cmp dword [ebp - 4], esi
jne 0x1063b10
cmp dword [ebp - 0x14], esi
jne 0x1063b10
push 2
push 0x1001e8c
push 1
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1063dbe
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
shr eax, 1
not eax
and eax, 1
jne 0x1063b36
push esi
push esi
push esi
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x1063dc1
mov ecx, dword [ebp - 0x18]
mov eax, 0x10003
cmp ecx, eax
ja 0x1063b91
je 0x1063b5d
mov eax, ecx
dec eax
je 0x1063b7b
dec eax
dec eax
je 0x1063b7b
sub eax, 5
je 0x1063bd7
sub eax, 0xfff9
jne 0x1063bad
cmp dword [ebp - 4], esi
je 0x1063dc1
push dword [ebp - 4]
call fcn.01056ec2
mov dword [ebp + 8], eax
push 4
lea eax, [ebp + 8]
push eax
push 4
jmp 0x1063afe
cmp dword [ebp - 0x14], esi
je 0x1063dc1
push dword [ebp - 0x24]
push dword [ebp - 0x14]
push 3
jmp 0x1063afe
mov eax, ecx
sub eax, 0x20000
je 0x1063d85
dec eax
dec eax
je 0x1063d85
sub eax, 0x20006
je 0x1063bd7
cmp dword [ebp - 4], esi
je 0x1063dc1
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063bbc
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 4]
jmp 0x1063afc
cmp dword [ebp - 4], esi
je 0x1063dc1
test dword [ebp - 0x18], 0x40000
push 7
pop ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
je 0x1063d01
lea eax, [ebp - 0x20]
push eax
push esi
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x1063d01
cmp dword [ebp - 0x24], ebx
jne 0x1063d01
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063c1f
mov ecx, dword [ebp - 0x20]
sub eax, edx
shr ecx, 1
sar eax, 1
lea eax, [ecx + eax + 3]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x18], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
jne 0x1063c60
mov dword [ebp + 8], 0xe
jmp 0x1063cfd
lea eax, [ebp - 0x20]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x1063cf4
cmp word [ebx], si
mov edi, ebx
je 0x1063ca9
push dword [ebp - 4]
push edi
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1063cd6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063c92
sub eax, edx
sar eax, 1
lea edi, [edi + eax*2 + 2]
cmp word [edi], si
jne 0x1063c7d
push dword [ebp - 4]
mov eax, dword [ebp - 0x18]
dec eax
push eax
push edi
call fcn.01034c79
test eax, eax
jl 0x1063cf4
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063cc1
sub eax, edx
sar eax, 1
mov word [edi + eax*2 + 2], si
jmp 0x1063cfd
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063cdc
sub eax, edx
sar eax, 1
or ecx, 0xffffffff
sub ecx, eax
add dword [ebp - 0x18], ecx
jmp 0x1063cfd
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
xor ebx, ebx
pop ecx
cmp ebx, esi
jne 0x1063d5f
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063d07
sub eax, edx
sar eax, 1
lea edi, [eax + 2]
xor ecx, ecx
push 2
pop edx
mov eax, edi
mul edx
seto cl
mov dword [ebp - 0x18], edi
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new___unsigned_int_
mov ebx, eax
cmp ebx, esi
pop ecx
je 0x1063dc1
push dword [ebp - 4]
dec edi
push edi
push ebx
call fcn.01034c79
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063d4c
sub eax, edx
sar eax, 1
mov word [ebx + eax*2 + 2], si
mov eax, dword [ebp - 0x18]
add eax, eax
push eax
push ebx
push 7
push esi
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp ebx, esi
mov dword [ebp + 8], eax
je 0x1063dc1
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
jmp 0x1063dc1
cmp dword [ebp - 4], esi
je 0x1063dc1
mov eax, dword [ebp - 4]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1063d90
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 4]
push 2
jmp 0x1063afe
cmp dword [ebp - 8], esi
je 0x1063dc1
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp + 8], eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
cmp edi, esi
jne 0x1063df3
cmp dword [ebp - 8], esi
jne 0x1063df3
cmp dword [ebp - 4], esi
jne 0x1063df3
cmp dword [ebp - 0x10], esi
je 0x1063df3
cmp dword [ebp - 0x1c], esi
je 0x1063df3
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
call fcn.01058684
cmp ebx, esi
je 0x1063e20
cmp edi, esi
jne 0x1063e04
cmp ebx, 2
jne 0x1063e04
xor ebx, ebx
jmp 0x1063e29
push ebx
push 0x100d974
push 2
call fcn.0105e5ad
mov ecx, dword [ebp - 0x28]
add esp, 0xc
push edi
push dword [ebp + 0xc]
call fcn.01063085
cmp edi, esi
mov eax, 0x100d358
jne 0x1063e2e
mov eax, 0x100d368
push ebx
push dword [ebp + 0xc]
push eax
push 0x100d948
push 4
call fcn.0105e5ad
add esp, 0x14
cmp dword [ebp - 0x14], esi
je 0x1063e50
push dword [ebp - 0x14]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
cmp dword [ebp - 0x10], esi
je 0x1063e5e
push dword [ebp - 0x10]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 8], esi
je 0x1063e6c
push dword [ebp - 8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp dword [ebp - 4], esi
je 0x1063e7a
push dword [ebp - 4]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
pop ecx
cmp ebx, esi
jle 0x1063e8a
and ebx, 0xffff
or ebx, 0x80070000
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc