Function at 0x100366b
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe70
mov eax, dword [0x1007030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0xe3c], ax
xor ebx, ebx
lea eax, [ebp - 0xe3a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push ebx
push eax
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0xc34], ax
lea eax, [ebp - 0xc32]
push ebx
push eax
call sub.msvcrt.dll_memset
push 2
pop edi
xor eax, eax
push esi
mov word [ebp - 0xa2c], ax
lea eax, [ebp - 0xa2a]
push ebx
push eax
mov dword [ebp - 0xe5c], edi
call sub.msvcrt.dll_memset
xor eax, eax
push esi
mov word [ebp - 0x61c], ax
lea eax, [ebp - 0x61a]
push ebx
push eax
mov dword [ebp - 0xe64], edi
call sub.msvcrt.dll_memset
add esp, 0x3c
lea eax, [ebp - 0xe70]
push eax
lea eax, [ebp - 0xe3c]
push eax
lea eax, [ebp - 0xe48]
push eax
mov dword [ebp - 0xe48], ebx
mov dword [ebp - 0xe6c], ebx
mov dword [ebp - 0xe40], ebx
mov ebx, 0x10021a8
push ebx
mov dword [ebp - 0xe60], edi
push 0x1001f00
lea edi, [esi + 2]
push 0x80000002
mov dword [ebp - 0xe70], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x1003bf9
push 0x1001e3c
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1003785
mov dword [ebp - 0xe6c], 1
jmp 0x100379f
push 0x1001eb8
lea eax, [ebp - 0xe3c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1003bf9
and dword [ebp - 0xe50], 0
xor eax, eax
cmp dword [ebp - 0xe40], eax
jl 0x1003aa3
mov dword [ebp - 0xe68], eax
cmp dword [ebp - 0xe50], eax
jne 0x10037e0
lea ecx, [ebp - 0xc34]
mov dword [ebp - 0xe4c], ecx
mov dword [ebp - 0xe44], 0x100201c
lea ecx, [ebp - 0xe5c]
jmp 0x1003823
cmp dword [ebp - 0xe50], 1
jne 0x1003807
lea ecx, [ebp - 0xa2c]
mov dword [ebp - 0xe4c], ecx
mov dword [ebp - 0xe44], 0x1002028
lea ecx, [ebp - 0xe64]
jmp 0x1003823
lea ecx, [ebp - 0x61c]
mov dword [ebp - 0xe4c], ecx
mov dword [ebp - 0xe44], 0x1002034
lea ecx, [ebp - 0xe60]
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
mov dword [ebp - 0xe54], ecx
mov dword [ebp - 0xe58], edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 1
push dword [ebp - 0xe44]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.010033af
mov dword [ebp - 0xe40], eax
test eax, eax
jl 0x1003a83
mov eax, dword [ebp - 0xe58]
mov dword [ebp - 0xe68], eax
lea eax, [ebp - 0xe58]
push eax
push dword [ebp - 0xe4c]
lea eax, [ebp - 0x20c]
push dword [ebp - 0xe54]
push 0x10000004
push ebx
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0x10038cf
mov eax, dword [ebp - 0xe54]
lea ecx, [ebp - 0xe68]
push ecx
push dword [ebp - 0xe4c]
mov dword [eax], 1
push eax
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
xor eax, eax
cmp dword [ebp + 8], eax
je 0x1003a2f
push esi
push eax
lea eax, [ebp - 0x412]
xor ecx, ecx
push eax
mov word [ebp - 0x414], cx
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp - 0xe6c], 0
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
je 0x1003924
push 0x1001f00
push 0x1001f2c
push 0x104
push eax
call fcn.0100335c
add esp, 0x14
jmp 0x1003937
push 0x1001f68
push 0x104
push eax
call fcn.0100335c
add esp, 0x10
mov dword [ebp - 0xe40], eax
test eax, eax
jl 0x1003a83
xor eax, eax
push esi
push eax
mov word [ebp - 0x824], ax
lea eax, [ebp - 0x822]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0xe44]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xe48]
push eax
push 0x10000004
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x80000002
mov dword [ebp - 0xe44], edi
mov dword [ebp - 0xe48], 2
mov dword [ebp - 0xe4c], edi
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
je 0x10039e6
lea eax, [ebp - 0xe4c]
push eax
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xe48]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x80000002
mov dword [ebp - 0xe48], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10039e6
mov dword [ebp - 0xe40], 0x80004005
cmp dword [ebp - 0xe40], 0
jl 0x1003a83
lea eax, [ebp - 0x824]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10039fc
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x824]
push eax
push dword [ebp - 0xe48]
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x1003a75
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0
push dword [ebp - 0xe44]
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.010033af
mov dword [ebp - 0xe40], eax
test eax, eax
jl 0x1003a83
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
test eax, eax
je 0x1003a83
mov dword [ebp - 0xe40], 0x80004005
inc dword [ebp - 0xe50]
cmp dword [ebp - 0xe50], 3
jl 0x10037a6
cmp dword [ebp - 0xe40], 0
jge 0x1003bf9
xor eax, eax
cmp ax, word [ebp - 0xc34]
je 0x1003b18
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 1
push 0x100201c
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010033af
test eax, eax
jl 0x1003b1d
lea eax, [ebp - 0xc34]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003ae5
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0xc34]
push eax
push dword [ebp - 0xe5c]
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x1003b1d
mov esi, 0x104
xor eax, eax
cmp ax, word [ebp - 0xa2c]
je 0x1003b8b
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 1
push 0x1002028
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010033af
test eax, eax
jl 0x1003b8b
lea eax, [ebp - 0xa2c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003b5a
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0xa2c]
push eax
push dword [ebp - 0xe64]
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor eax, eax
cmp ax, word [ebp - 0x61c]
je 0x1003bf9
push edi
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 1
push 0x1002034
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.010033af
test eax, eax
jl 0x1003bf9
lea eax, [ebp - 0x61c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003bc8
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0xe60]
lea eax, [ebp - 0x20c]
push ebx
push eax
push 0x80000000
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.010055d3
leave
ret 4