Function at 0x10082e9
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 5
pop ecx
mov esi, 0x1008764
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x16
pop ecx
mov esi, 0x1008708
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xb
pop ecx
mov esi, 0x10086dc
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0x2b8], edi
cmp dword [ebp + 8], edi
je 0x10085c3
lea eax, [ebp - 0x2b0]
push eax
push 0xf003f
push edi
push 0x1008688
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1008594
push 0x204
lea eax, [ebp - 0x2a8]
push edi
push eax
mov dword [ebp - 0x2ac], edi
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2ac]
push eax
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
mov dword [ebp - 0x2c0], 0x208
call esi
mov dword [ebp - 0x2b4], eax
cmp eax, edi
jne 0x10083c7
cmp dword [ebp - 0x2c0], edi
jne 0x10083c7
mov dword [ebp - 0x2b4], 2
push ebx
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1008431
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x1008678
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x1008403
push 0x100866c
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
jne 0x1008431
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpICW]
push 0x1008638
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x1008431
push 0x1008600
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x1008431
xor ebx, ebx
jmp 0x1008434
xor ebx, ebx
inc ebx
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x100855f
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x100855f
cmp ebx, edi
jne 0x1008469
cmp dword [ebp - 0x2b4], edi
je 0x1008587
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x5a
lea eax, [ebp - 0xa4]
push eax
push 1
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
call ebx
lea eax, [ebp - 0x2bc]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call esi
cmp eax, edi
jne 0x1008545
mov esi, dword [ebp - 0x2bc]
cmp esi, edi
je 0x1008545
add esi, 4
shr esi, 1
add esi, 2
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x2b4], eax
cmp eax, edi
je 0x1008545
lea ecx, [ebp - 0x2bc]
push ecx
push eax
push edi
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x2b4]
mov dword [ebp - 0x2c4], esi
call fcn.0100825f
test eax, eax
js 0x1008537
mov eax, dword [ebp - 0x2c4]
add eax, eax
push eax
push dword [ebp - 0x2b4]
lea eax, [ebp - 0x48]
push 7
push edi
push eax
push dword [ebp - 0x2b0]
call ebx
push dword [ebp - 0x2b4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x1008587
push 4
lea eax, [ebp - 0x2b8]
push eax
push 7
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call ebx
jmp 0x1008587
cmp ebx, edi
jne 0x100856b
cmp dword [ebp - 0x2b4], edi
je 0x1008587
push 0x5a
lea eax, [ebp - 0xa4]
push eax
push 1
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
cmp dword [ebp + 0xc], edi
jne 0x10085c3
push 0x10085e8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x10085c3
push 0x10085d4
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x10085bc
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0100305d
leave
ret 8