Function at 0x10093e00
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1022aa8e
mov eax, dword fs:[0]
push eax
sub esp, 0x158
mov eax, dword [0x102db080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
cmp dword [edi + 0x7c], 7
lea esi, [edi + 0x68]
mov bl, byte [ebp + 8]
mov byte [ebp - 0x131], bl
mov dword [ebp - 4], 0
jbe 0x10093e4e
mov esi, dword [esi]
lea eax, [ebp - 0x140]
mov dword [ebp - 0x13c], eax
call fcn.10088a70
mov ecx, eax
test ecx, ecx
je 0x1009430a
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x140], eax
mov byte [ebp - 4], 1
test esi, esi
je 0x10093eb1
test esi, 0xffff0000
jne 0x10093e98
movzx eax, si
lea ecx, [ebp - 0x140]
push eax
call fcn.10087a30
jmp 0x10093ec0
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10093ea0
sub ecx, edx
sar ecx, 1
jmp 0x10093eb3
xor ecx, ecx
push ecx
push esi
lea ecx, [ebp - 0x140]
call fcn.10088120
push str.Settings
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 2
call fcn.1004e380
xor esi, esi
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x144], esi
movzx eax, bl
sub eax, 0x7fffffff
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x138], esi
push ecx
lea ecx, [ebp - 0x138]
push ecx
push esi
push 0x20106
push esi
push esi
push esi
push dword [ebp - 0x140]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10093f34
mov esi, dword [ebp - 0x138]
mov dword [ebp - 0x14c], esi
mov dword [ebp - 0x148], 0x100
xor ebx, ebx
mov byte [ebp - 4], 3
test eax, eax
cmovne ebx, eax
test ebx, ebx
jne 0x10094314
mov eax, dword [edi]
push 4
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x138]
push eax
push 4
push ebx
push str.Server_Mode
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
sete bl
cmp byte [ebp - 0x131], 0
mov dword [ebp - 0x138], ebx
je 0x10093f90
cmp dword [edi], 0
jne 0x10093f90
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push str.LocalCacheFolder
push esi
call ebx
jmp 0x10094000
cmp dword [edi + 0x18], 7
lea edx, [edi + 4]
jbe 0x10093f9b
mov edx, dword [edx]
test edx, edx
je 0x10093fe6
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x138], eax
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10093fb0
sub ecx, dword [ebp - 0x138]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.LocalCacheFolder
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x138], ebx
test eax, eax
je 0x10093fed
mov byte [ebp - 0x138], 0
cmp byte [ebp - 0x131], 0
je 0x10094093
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [edi], 0
je 0x10094050
add edi, 0x1c
cmp dword [edi + 0x14], 7
jbe 0x10094010
mov edi, dword [edi]
test edi, edi
je 0x1009404c
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10094020
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push str.alist_path
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x10094058
xor bl, bl
jmp 0x1009405e
push str.alist_path
push esi
call ebx
mov ebx, dword [ebp - 0x138]
test esi, esi
je 0x10094069
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 0x140]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100942ea
lfence
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x100942ea
mov eax, dword [edi + 0x4c]
push 4
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x13c]
push eax
push 4
push 0
push str.Check_for_Updates
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x138]
xor ebx, ebx
test eax, eax
movzx ecx, cl
mov eax, dword [edi + 0x5c]
push 4
mov dword [ebp - 0x13c], eax
cmove ebx, ecx
lea eax, [ebp - 0x13c]
push eax
push 4
push 0
push str.AllowAgentsSearch
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
movzx ecx, bl
test eax, eax
mov eax, dword [edi + 0x50]
push 4
mov dword [ebp - 0x13c], eax
cmove edx, ecx
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x138], edx
push eax
push 4
push 0
push str.Application_Look
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x138]
xor ebx, ebx
test eax, eax
movzx ecx, cl
mov eax, dword [edi + 0x54]
push 4
mov dword [ebp - 0x13c], eax
cmove ebx, ecx
lea eax, [ebp - 0x13c]
push eax
push 4
push 0
push str.Restore_Windows
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
movzx ecx, bl
test eax, eax
mov eax, dword [edi + 0x58]
push 4
mov dword [ebp - 0x13c], eax
cmove edx, ecx
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x138], edx
push eax
push 4
push 0
push str.Minimize_To_Tray
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x138]
xor ebx, ebx
mov edx, dword [edi + 0x60]
test eax, eax
mov eax, dword [edi + 0x64]
movzx ecx, cl
cmove ebx, ecx
cmp edx, 0xfffffffe
jne 0x1009419f
cmp eax, 0x7fffffff
je 0x100941b6
cmp edx, 0xffffffff
jne 0x100941ab
cmp eax, 0x7fffffff
je 0x100941b6
test edx, edx
jne 0x100941ba
cmp eax, 0x80000000
jne 0x100941ba
mov cl, 1
jmp 0x100941bc
xor cl, cl
test cl, cl
jne 0x10094282
push eax
push edx
lea eax, [ebp - 0x2c]
push eax
call fcn.1008e2e0
add esp, 0xc
cmp dword [ebp - 0x18], 0xf
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 5
cmova eax, dword [ebp - 0x2c]
push 3
mov dword [ebp - 0x130], ecx
lea ecx, [ebp - 0x130]
push eax
call fcn.100907c0
mov edx, dword [ebp - 0x130]
test edx, edx
jne 0x10094211
mov dword [ebp - 0x138], 0xd
jmp 0x10094258
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x13c], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10094220
sub ecx, dword [ebp - 0x13c]
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push str.LastSalogSrvErrorCheckTime
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 0x130]
mov dword [ebp - 0x138], eax
lea eax, [ebp - 0x12c]
cmp edx, eax
je 0x1009426c
push edx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor ecx, ecx
movzx ebx, bl
cmp dword [ebp - 0x138], ecx
cmovne ebx, ecx
lea ecx, [ebp - 0x2c]
call fcn.100895a0
add edi, 0x34
cmp dword [edi + 0x14], 7
jbe 0x1009428d
mov edi, dword [edi]
test edi, edi
je 0x1009404c
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100942a0
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edi
push 1
push 0
push str.Webapp_Url
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1009405e
xor bl, bl
jmp 0x1009405e
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100b9f43
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10088c90
call fcn.10081d80
push eax
push ebx
lea ecx, [ebp - 0x160]
call fcn.1007e450
push 0x102ca4a8
lea eax, [ebp - 0x160]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3