Function at 0x1009855
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x13c8
call fcn.0100d410
mov eax, dword [0x101203c]
push esi
push edi
push 1
push 0x1001cb0
mov dword [ebp - 4], eax
call fcn.0100cbd8
xor eax, eax
push 0x41
pop ecx
lea edi, [ebp - 0x414]
rep stosd dword es:[edi], eax
mov eax, dword [0x1016c8c]
dec eax
dec eax
jne 0x100a23c
push ebx
xor ebx, ebx
cmp dword [0x1016ca0], ebx
je 0x100a22f
cmp dword [0x1016ca4], ebx
je 0x100a22f
lea eax, [ebp - 0x1058]
push eax
push 0x20019
push ebx
push 0x10054b8
mov esi, 0x80000002
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100a23b
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x105c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1005484
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100a221
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x720]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x1005504
push dword [ebp - 0x1058]
mov edi, 0x104
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a215
cmp dword [ebp - 0x1068], 2
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpynA]
jne 0x100942f
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x720]
push eax
call esi
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
jmp 0x1009438
mov eax, dword [ebp - 0x1048]
add eax, 0xfffffffb
mov dword [ebp - 0x1054], eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100a215
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1068]
push eax
push ebx
push 0x10053e4
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x100a215
cmp dword [ebp - 0x1068], 2
jne 0x10094b8
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0xa2c]
push eax
call esi
push edi
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x61c]
push eax
call esi
cmp byte [ebp - 0x61c], bl
lea eax, [ebp - 0x61c]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x100a215
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x10094ff
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x10094e7
cmp dword [ebp - 0x1050], ebx
je 0x100a215
mov ecx, 0x1001ca4
mov dword [ebp - 0x110c], ecx
mov dword [ebp - 0x10cc], ecx
mov ecx, 0x10166cc
lea edx, [ebp - 0x20c]
mov dword [ebp - 0x10b8], ecx
mov dword [ebp - 0x10b0], ecx
lea ecx, [ebp - 0x310]
lea eax, [ebp - 0xb30]
mov dword [ebp - 0x1138], eax
mov dword [ebp - 0x13c4], ecx
mov dword [ebp - 0x13bc], ecx
lea eax, [ebp - 0x20c]
mov ecx, edx
mov dword [ebp - 0x1130], eax
mov dword [ebp - 0x1128], eax
lea eax, [ebp - 0x310]
mov dword [ebp - 0x13b4], ecx
mov dword [ebp - 0x13ac], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1120], eax
mov dword [ebp - 0x1118], eax
mov dword [ebp - 0x1110], eax
mov dword [ebp - 0x1108], eax
mov eax, 0x10165c8
mov dword [ebp - 0x13a4], ecx
mov dword [ebp - 0x139c], ecx
mov dword [ebp - 0x137c], ecx
mov ecx, edx
mov byte [ebp - 0x310], bl
mov byte [ebp - 0xb30], bl
mov byte [ebp - 0x20c], bl
mov byte [ebp - 0x108], bl
mov byte [ebp - 0x518], bl
mov dword [ebp - 0x113c], 0x1001c98
mov dword [ebp - 0x1134], 0x1001c90
mov dword [ebp - 0x112c], 0x1001c88
mov dword [ebp - 0x1124], 0x10014a8
mov dword [ebp - 0x111c], 0x1001c7c
mov dword [ebp - 0x1114], 0x1001c70
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001c60
mov dword [ebp - 0x1100], eax
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001c54
mov dword [ebp - 0x10f8], eax
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001c44
mov dword [ebp - 0x10f0], edx
mov dword [ebp - 0x10ec], 0x1001c38
mov dword [ebp - 0x10e8], edx
mov dword [ebp - 0x10e4], 0x1001c2c
mov dword [ebp - 0x10e0], edx
mov dword [ebp - 0x10dc], 0x1001c24
mov dword [ebp - 0x10d8], edx
mov dword [ebp - 0x10d4], 0x1001c98
mov dword [ebp - 0x10d0], eax
mov dword [ebp - 0x10c8], eax
mov dword [ebp - 0x10c4], 0x1001c70
mov dword [ebp - 0x10c0], eax
mov dword [ebp - 0x10bc], 0x10014a8
mov dword [ebp - 0x10b4], 0x1001c7c
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001c18
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001c0c
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001c00
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001bf4
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001be8
mov dword [ebp - reloc.USER32.dll_ExitWindowsEx], 0x1001bd8
mov dword [ebp - reloc.KERNEL32.dll_VirtualProtect], 0x1001bc8
mov dword [ebp - 0x1394], eax
mov dword [ebp - reloc.KERNEL32.dll_VirtualProtect], 0x1001bbc
mov dword [ebp - 0x138c], eax
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001bac
mov dword [ebp - 0x1384], eax
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001ba0
mov dword [ebp - reloc.KERNEL32.dll_VirtualProtect], 0x1001b90
mov dword [ebp - 0x1374], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b84
mov dword [ebp - 0x136c], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b78
mov dword [ebp - 0x1364], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b6c
mov dword [ebp - 0x135c], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b60
mov dword [ebp - 0x131c], eax
lea eax, [ebp - 0x518]
mov dword [ebp - 0x1354], ecx
lea ecx, [ebp - 0x310]
mov dword [ebp - 0x1314], eax
mov dword [ebp - 0x130c], eax
mov dword [ebp - 0x1304], eax
mov dword [ebp - 0x12fc], eax
mov dword [ebp - 0x12f4], eax
mov dword [ebp - 0x12ec], eax
lea eax, [ebp - 0x108]
mov dword [ebp - reloc.KERNEL32.dll_HeapFree], 0x1001b54
mov dword [ebp - 0x134c], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b48
mov dword [ebp - 0x1344], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b3c
mov dword [ebp - 0x133c], ecx
mov dword [ebp - reloc.KERNEL32.dll_FreeEnvironmentStringsA], 0x1001b2c
mov dword [ebp - 0x1334], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b1c
mov dword [ebp - 0x132c], ecx
mov dword [ebp - reloc.KERNEL32.dll_TerminateProcess], 0x1001b10
mov dword [ebp - 0x1324], 0x10169d8
mov dword [ebp - reloc.KERNEL32.dll_GetCurrentThreadId], 0x1001b04
mov dword [ebp - reloc.KERNEL32.dll_GetFileSize], 0x1001af8
mov dword [ebp - reloc.KERNEL32.dll_GetWindowsDirectoryA], 0x1001ae8
mov dword [ebp - reloc.KERNEL32.dll_SetFilePointer], 0x1001adc
mov dword [ebp - reloc.KERNEL32.dll_GlobalFree], 0x1001acc
mov dword [ebp - reloc.KERNEL32.dll_GlobalFree], 0x1001abc
mov dword [ebp - reloc.KERNEL32.dll_GetPrivateProfileStringA], 0x1001aac
mov dword [ebp - reloc.KERNEL32.dll_DeleteFileA], 0x1001a9c
mov dword [ebp - 0x12e4], eax
mov dword [ebp - reloc.KERNEL32.dll_GetModuleFileNameA], 0x1001a7c
mov dword [ebp - 0x12dc], eax
mov dword [ebp - reloc.KERNEL32.dll_GetProcAddress], 0x1001a68
mov dword [ebp - 0x12d4], eax
mov dword [ebp - 0x12d0], 0x1001a50
mov dword [ebp - 0x12cc], eax
mov dword [ebp - reloc.ADVAPI32.dll_FreeSid], 0x1001a40
mov dword [ebp - 0x12c4], eax
mov dword [ebp - reloc.ADVAPI32.dll_LookupPrivilegeValueA], 0x1001a34
mov dword [ebp - 0x12bc], eax
mov dword [ebp - reloc.ADVAPI32.dll_RegOpenKeyExA], 0x1001a20
mov dword [ebp - 0x12b4], eax
mov dword [ebp - reloc.ADVAPI32.dll_RegEnumValueA], 0x1001a14
mov dword [ebp - 0x12ac], eax
mov dword [ebp - 0x12a8], 0x10019fc
mov dword [ebp - 0x12a4], eax
mov dword [ebp - 0x12a0], 0x10019ec
mov dword [ebp - 0x129c], eax
mov dword [ebp - 0x1298], 0x10019dc
mov dword [ebp - 0x1294], eax
mov dword [ebp - 0x1290], 0x10019d4
mov dword [ebp - 0x128c], eax
mov dword [ebp - 0x1288], 0x10019bc
mov dword [ebp - 0x1284], eax
mov dword [ebp - reloc.KERNEL32.dll_DeleteFileA], 0x10019a8
mov dword [ebp - 0x127c], eax
mov dword [ebp - 0x1278], 0x100199c
mov dword [ebp - 0x1274], eax
mov dword [ebp - reloc.KERNEL32.dll_GetProcAddress], 0x1001984
mov dword [ebp - 0x126c], eax
mov dword [ebp - 0x1268], 0x1001964
mov dword [ebp - 0x1264], eax
mov dword [ebp - reloc.ADVAPI32.dll_FreeSid], 0x1001950
mov dword [ebp - 0x125c], eax
mov dword [ebp - 0x1258], 0x1001944
mov dword [ebp - 0x1254], eax
mov dword [ebp - reloc.ADVAPI32.dll_RegOpenKeyExA], 0x1001928
mov dword [ebp - 0x124c], eax
mov dword [ebp - reloc.ADVAPI32.dll_RegEnumValueA], 0x100191c
mov dword [ebp - 0x1244], eax
mov dword [ebp - reloc.ADVAPI32.dll_RegEnumValueA], 0x1001910
mov dword [ebp - 0x123c], eax
mov dword [ebp - 0x1238], 0x1001904
mov dword [ebp - 0x1234], eax
mov dword [ebp - 0x1230], 0x10018f0
mov dword [ebp - 0x122c], eax
mov dword [ebp - reloc.KERNEL32.dll_GetSystemDirectoryA], 0x10018e0
mov dword [ebp - 0x1224], eax
mov dword [ebp - 0x1220], 0x10018d0
mov ecx, 0x1001894
mov dword [ebp - 0x121c], eax
mov dword [ebp - 0x1214], eax
mov dword [ebp - 0x120c], eax
mov dword [ebp - 0x1204], eax
mov dword [ebp - 0x11fc], eax
mov dword [ebp - 0x11f4], eax
mov dword [ebp - 0x11ec], eax
mov dword [ebp - 0x11e4], eax
mov dword [ebp - 0x11dc], eax
mov eax, 0x1005530
mov dword [ebp - 0x10a8], ecx
mov dword [ebp - 0x109c], ecx
mov ecx, 0x1001854
mov dword [ebp - 0x10ac], eax
mov dword [ebp - 0x10a0], eax
mov edx, 0x10022cc
mov dword [ebp - 0x1094], eax
mov dword [ebp - 0x1090], ecx
mov dword [ebp - 0x1088], eax
mov dword [ebp - 0x1084], ecx
mov ecx, 0x1001810
mov dword [ebp - 0x107c], eax
mov dword [ebp - 0x11d8], eax
mov dword [ebp - 0x11cc], eax
mov dword [ebp - 0x11c0], eax
mov dword [ebp - 0x11b4], eax
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x1190], eax
mov dword [ebp - 0x1184], eax
mov dword [ebp - 0x1178], eax
mov dword [ebp - 0x116c], eax
mov dword [ebp - 0x1160], eax
mov dword [ebp - 0x1154], eax
mov dword [ebp - 0x1148], eax
lea eax, [ebp - 0x518]
sub eax, dword [ebp - 0x1050]
mov dword [ebp - 0x1098], edx
mov dword [ebp - 0x1080], edx
mov edx, 0x10017c8
mov dword [ebp - 0x11c8], ecx
mov dword [ebp - 0x11bc], ecx
mov dword [ebp - 0x11b0], ecx
mov dword [ebp - 0x11a4], ecx
mov ecx, 0x10017a0
mov dword [ebp - 0x1218], 0x1001790
mov dword [ebp - 0x1210], 0x1001784
mov dword [ebp - 0x1208], 0x1001770
mov dword [ebp - 0x1200], 0x1001768
mov dword [ebp - reloc.KERNEL32.dll_GetModuleFileNameA], 0x1001744
mov dword [ebp - 0x11f0], 0x1001734
mov dword [ebp - 0x11e8], 0x1001728
mov dword [ebp - 0x11e0], 0x100171c
mov dword [ebp - 0x10a4], 0x100257c
mov dword [ebp - 0x108c], 0x100257c
mov dword [ebp - 0x1078], edx
mov dword [ebp - 0x1074], ebx
mov dword [ebp - 0x11d4], 0x10016c8
mov dword [ebp - 0x11d0], 0x10016b8
mov dword [ebp - 0x11c4], 0x10016ac
mov dword [ebp - 0x11b8], 0x100169c
mov dword [ebp - 0x11ac], 0x1001684
mov dword [ebp - 0x11a0], 0x100554c
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x1194], 0x1001678
mov dword [ebp - 0x118c], 0x100164c
mov dword [ebp - 0x1188], 0x1001644
mov dword [ebp - 0x1180], ecx
mov dword [ebp - 0x117c], 0x100163c
mov dword [ebp - 0x1174], 0x1001614
mov dword [ebp - 0x1170], ebx
mov dword [ebp - 0x1168], 0x10015ec
mov dword [ebp - 0x1164], ebx
mov dword [ebp - 0x115c], 0x10015bc
mov dword [ebp - 0x1158], ebx
mov dword [ebp - 0x1150], 0x100158c
mov dword [ebp - 0x114c], ebx
mov dword [ebp - 0x1144], edx
mov dword [ebp - 0x1140], ebx
push eax
push 0x10057b0
push dword [ebp - 0x1050]
call esi
push ebx
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0xa2c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryExA]
push dword [ebp - 0x105c]
push dword [ebp - 0x1058]
call fcn.0100691f
cmp dword [0x1016bf8], 1
jne 0x1009d6d
lea eax, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
push ebx
push 0x10054f0
push dword [ebp - 0x1058]
mov dword [ebp - 0x1048], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1009d6d
cmp byte [ebp - 0x414], bl
lea eax, [ebp - 0x414]
mov dword [ebp - 0x104c], eax
mov dword [ebp - 0x1050], ebx
je 0x1009d6d
mov eax, dword [ebp - 0x104c]
cmp byte [eax], 0x5c
jne 0x1009cdd
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x1050], eax
push dword [ebp - 0x104c]
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], bl
mov dword [ebp - 0x104c], eax
jne 0x1009cc5
cmp dword [ebp - 0x1050], ebx
je 0x1009d6d
push dword [ebp - 0x1050]
lea eax, [ebp - 0x61c]
push eax
push 0x100247c
lea eax, [ebp - 0x928]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
push edi
lea eax, [ebp - 0x928]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x928]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x928]
push eax
push 1
push ebx
push 0x10054f0
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
lea eax, [ebp - 0x928]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push edi
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x824]
push eax
call esi
push edi
push 0x10057cc
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatBuffA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 0x104c], edi
sub dword [ebp - 0x104c], eax
push dword [ebp - 0x104c]
lea eax, [ebp + eax - 0x824]
push 0x1005914
push eax
mov dword [ebp - 0x1070], eax
call esi
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x61c]
push eax
push 1
push ebx
push 0x10053e4
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
mov dword [ebp - 0x1048], eax
lea eax, [ebp - 0x824]
push eax
push 1
push ebx
push 0x1005504
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0xb30]
push eax
lea eax, [ebp - 0x310]
push eax
push 0xf
call fcn.0100900f
cmp dword [0x1016bf8], 1
mov dword [ebp - 0x1050], eax
jne 0x1009eb2
test al, 1
je 0x1009e6a
push edi
lea eax, [ebp - 0x310]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 2
je 0x1009e82
push edi
lea eax, [ebp - 0xb30]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 4
je 0x1009e9a
push edi
lea eax, [ebp - 0x518]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test byte [ebp - 0x1050], 8
je 0x1009eb2
push edi
lea eax, [ebp - 0x108]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push edi
push 0x10166cc
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, edi
sub ecx, eax
push ecx
mov dword [ebp - 0x1048], eax
lea eax, [ebp + eax - 0x20c]
push eax
push 0x40a
push dword [0x1016cac]
call dword [sym.imp.USER32.dll_LoadStringA]
cmp dword [0x1016bf8], 1
jne 0x1009f0a
push edi
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, dword [ebp - 0x1054]
mov ecx, edi
sub ecx, eax
push ecx
push 0x1005904
lea eax, [ebp + eax - 0x720]
push eax
call esi
push dword [ebp - 0x104c]
push 0x1005904
push dword [ebp - 0x1070]
call esi
push 1
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x720]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor esi, esi
cmp esi, 0x12
mov dword [ebp - 0x1048], ebx
jae 0x1009fcd
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x1009fcd
push dword [ebp + esi*8 - 0x113c]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x1138]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x1005970
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x12
jb 0x1009f76
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x10057bc
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016ca0]
cmp esi, 0x12
jb 0x1009f65
xor esi, esi
cmp esi, 0x3e
mov dword [ebp - 0x1048], ebx
jae 0x100a068
mov dword [ebp - 0x104c], ebx
cmp dword [ebp - 0x104c], 5
jge 0x100a068
push dword [ebp + esi*8 - 0x13c8]
mov eax, dword [ebp - 0x1048]
push dword [ebp + esi*8 - 0x13c4]
inc dword [ebp - 0x1048]
mov ecx, 0x514
sub ecx, dword [ebp - 0x1048]
push 0x1005970
lea eax, [ebp + eax - 0x1044]
push ecx
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add dword [ebp - 0x1048], eax
add esp, 0x14
inc esi
inc dword [ebp - 0x104c]
cmp esi, 0x3e
jb 0x100a011
mov eax, dword [ebp - 0x1048]
push 2
mov byte [ebp + eax - 0x1044], bl
push 0x10057b0
lea eax, [ebp - 0x61c]
push eax
lea eax, [ebp - 0x1044]
push eax
call dword [0x1016ca0]
cmp esi, 0x3e
jb 0x100a000
cmp dword [0x1016bf8], 1
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1060], ebx
je 0x100a0ea
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x1064]
push eax
push 0x2001f
push ebx
push 0x1005540
push dword [ebp - 0x1058]
call esi
lea eax, [ebp - 0x1060]
push eax
push 0x2001f
push ebx
push 0x1005540
push dword [ebp - 0x105c]
call esi
jmp 0x100a102
mov eax, dword [ebp - 0x1058]
mov dword [ebp - 0x1064], eax
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x1064], ebx
je 0x100a155
lea esi, [ebp - 0x10a8]
mov dword [ebp - 0x1054], 5
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1064]
push ebx
push ebx
call dword [0x1016ca4]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a11a
cmp dword [0x1016bf8], 1
je 0x100a155
push dword [ebp - 0x1064]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1060], ebx
je 0x100a1a8
lea esi, [ebp - 0x11d4]
mov dword [ebp - 0x1054], 0xd
push 0x1009
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
push dword [ebp - 0x1060]
push ebx
push ebx
call dword [0x1016ca4]
add esi, 0xc
dec dword [ebp - 0x1054]
jne 0x100a16d
cmp dword [0x1016bf8], 1
je 0x100a1a8
push dword [ebp - 0x1060]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x106c]
push eax
push ebx
call fcn.0100c68d
cmp dword [ebp - 0x106c], 1
je 0x100a1c7
cmp dword [ebp - 0x106c], 2
jne 0x100a215
push dword [0x1016be4]
mov esi, 0x10169d8
push esi
push 0x1005970
lea eax, [ebp - 0x414]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x14
cmp dword [ebp - 0x106c], 2
mov eax, 0x1005860
je 0x100a1fc
mov eax, 0x100587c
push ebx
push 0xd
push ebx
push 0x10167d0
push esi
push eax
lea eax, [ebp - 0x414]
push eax
push ebx
call dword [0x1016c94]
push dword [ebp - 0x105c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x1058]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100a23b
push 1
push 0x1001540
call fcn.0100cbd8
pop ebx
push 1
push 0x1001520
call fcn.0100cbd8
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100d058
leave
ret