Function at 0x1001d3fa
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x398
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [ebp - 0x118], eax
jmp 0x1001d41f
mov eax, dword [ebp - 0x118]
add eax, 0x43
mov dword [ebp - 0x118], eax
mov eax, dword [ebp + 8]
add eax, 0x163f
cmp dword [ebp - 0x118], eax
ja 0x1001de3b
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 0x79f7
ja 0x1001d49f
cmp dword [ebp - 0x30c], 0x79f7
je 0x1001d605
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x310], eax
sub dword [ebp - 0x310], 0x5995
je 0x1001d5e5
sub dword [ebp - 0x310], 0x43
je 0x1001d4e3
sub dword [ebp - 0x310], 0x43
je 0x1001ddeb
sub dword [ebp - 0x310], 0x43
je 0x1001de10
jmp 0x1001de36
mov eax, dword [ebp - 0x30c]
mov dword [ebp - 0x314], eax
sub dword [ebp - 0x314], 0x7a3a
je 0x1001d4fc
sub dword [ebp - 0x314], 0x43
je 0x1001d61a
sub dword [ebp - 0x314], 0x43
je 0x1001d73c
sub dword [ebp - 0x314], 0x43
je 0x1001ddf0
jmp 0x1001de36
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.10013b53
add esp, 0x14
call fcn.10001815
jmp 0x1001de36
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 4], eax
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 8], eax
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x114], eax
mov byte [ebp - 0x228], 0
push 0xff
push 0
lea eax, [ebp - 0x227]
push eax
call fcn.1004d4c0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.10037730
add esp, 0xc
push 0x425d
push 0
call fcn.1001cb99
pop ecx
pop ecx
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x318], eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x31c], eax
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x318]
mov al, byte [eax]
mov byte [ebp - 0x321], al
mov eax, dword [ebp - 0x31c]
mov cl, byte [ebp - 0x321]
mov byte [eax], cl
mov eax, dword [ebp - 0x318]
inc eax
mov dword [ebp - 0x318], eax
mov eax, dword [ebp - 0x31c]
inc eax
mov dword [ebp - 0x31c], eax
cmp byte [ebp - 0x321], 0
jne 0x1001d5a1
jmp 0x1001de36
push 4
mov eax, 0x1001de10
call fcn.10034f88
xor eax, eax
push eax
push dword [0x1005d4e0]
push dword [0x100574c0]
jmp 0x1001de36
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0xc], eax
jmp 0x1001de36
lea eax, [ebp - 0x110]
dec eax
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x328]
mov al, byte [eax + 1]
mov byte [ebp - 0x329], al
inc dword [ebp - 0x328]
cmp byte [ebp - 0x329], 0
jne 0x1001d627
mov edi, dword [ebp - 0x328]
mov esi, 0x10053b54
movsw word es:[edi], word [esi]
push 0
push 0
push 0
push 0
push 0
push 0
push 0x328b
call fcn.100328c5
add esp, 0x1c
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x330]
mov al, byte [eax]
mov byte [ebp - 0x335], al
inc dword [ebp - 0x330]
cmp byte [ebp - 0x335], 0
jne 0x1001d689
mov eax, dword [ebp - 0x330]
sub eax, dword [ebp - 0x334]
mov ecx, dword [ebp - 0x334]
mov dword [ebp - 0x33c], ecx
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x110]
dec eax
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x344]
mov al, byte [eax + 1]
mov byte [ebp - 0x345], al
inc dword [ebp - 0x344]
cmp byte [ebp - 0x345], 0
jne 0x1001d6d1
mov edi, dword [ebp - 0x344]
mov esi, dword [ebp - 0x33c]
mov eax, dword [ebp - 0x340]
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0xc]
push eax
push 2
push 0
lea eax, [ebp - 0x110]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1001d737
jmp 0x1001dddf
jmp 0x1001de36
push 0x167a
call fcn.10032f54
pop ecx
mov dword [ebp - 0x2d8], eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x2d8]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x1001d76e
jmp 0x1001dddf
and dword [ebp - 8], 0
push 0x7993
push 0
call fcn.100339c4
pop ecx
pop ecx
mov dword [ebp - 0x2dc], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [ebp - 0x2dc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jne 0x1001d883
mov byte [ebp - 0x250], 0
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24f]
rep stosd dword es:[edi], eax
push 0x4f4d
lea eax, [ebp - 0x250]
push eax
call fcn.1000978e
pop ecx
pop ecx
mov dword [ebp - 0x2e0], eax
movzx eax, byte [ebp - 0x2e0]
test eax, eax
jne 0x1001d7f4
jmp 0x1001dddf
lea eax, [ebp - 0x250]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x34c]
inc eax
mov dword [ebp - 0x350], eax
mov eax, dword [ebp - 0x34c]
mov al, byte [eax]
mov byte [ebp - 0x351], al
inc dword [ebp - 0x34c]
cmp byte [ebp - 0x351], 0
jne 0x1001d80d
mov eax, dword [ebp - 0x34c]
sub eax, dword [ebp - 0x350]
mov dword [ebp - 0x358], eax
push 0x7993
push 0
call fcn.100339c4
pop ecx
pop ecx
mov dword [ebp - 0x2e4], eax
push dword [ebp - 0x358]
lea eax, [ebp - 0x250]
push eax
push 2
push 0
push dword [ebp - 0x2e4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1001d87e
jmp 0x1001dddf
jmp 0x1001db4a
cmp dword [ebp - 0x114], 0
jne 0x1001db40
mov dword [ebp - 0x27c], 0x37ce
jmp 0x1001d8ab
mov eax, dword [ebp - 0x27c]
add eax, 0x63
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 0x3a20
ja 0x1001db3e
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov dword [ebp - 0x360], eax
sub dword [ebp - 0x360], 0x37ce
je 0x1001da8a
sub dword [ebp - 0x360], 0x63
je 0x1001d93c
sub dword [ebp - 0x360], 0x63
je 0x1001d965
sub dword [ebp - 0x360], 0x63
je 0x1001da73
sub dword [ebp - 0x360], 0x63
je 0x1001d92a
sub dword [ebp - 0x360], 0x63
je 0x1001d9f7
sub dword [ebp - 0x360], 0x63
je 0x1001db21
jmp 0x1001db39
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x270]
rep stosd dword es:[edi], eax
jmp 0x1001db39
push 0x10053b50
push dword [ebp - 0x274]
call section..text
pop ecx
pop ecx
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x280]
mov dword [ebp - 0x278], eax
jmp 0x1001db39
cmp dword [ebp - 0x278], 0
je 0x1001d97f
mov eax, dword [ebp - 0x278]
sub eax, dword [ebp - 0x274]
cmp eax, 0x20
jl 0x1001d99c
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2ac], eax
push dword [ebp - 0x2ac]
call fcn.100351b3
pop ecx
jmp 0x1001de3b
mov byte [ebp - 0x2a0], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x29f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x2a0]
push eax
call fcn.10037730
add esp, 0xc
mov eax, dword [ebp - 0x278]
sub eax, dword [ebp - 0x274]
push eax
push dword [ebp - 0x274]
lea eax, [ebp - 0x270]
push eax
call fcn.1004cab0
add esp, 0xc
jmp 0x1001db39
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x364], eax
lea eax, [ebp - 0x270]
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x364]
mov al, byte [eax]
mov byte [ebp - 0x36d], al
mov eax, dword [ebp - 0x368]
mov cl, byte [ebp - 0x36d]
mov byte [eax], cl
mov eax, dword [ebp - 0x364]
inc eax
mov dword [ebp - 0x364], eax
mov eax, dword [ebp - 0x368]
inc eax
mov dword [ebp - 0x368], eax
cmp byte [ebp - 0x36d], 0
jne 0x1001da1c
lea eax, [ebp - 0x270]
push eax
call fcn.1004d7bd
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0xc], eax
jmp 0x1001db39
lea eax, [ebp - 0x270]
push eax
call fcn.1004d7bd
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x1001db39
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.1000361d
pop ecx
mov dword [ebp - 0x2b0], eax
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2a4]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 8]
inc eax
push eax
push 0
push dword [ebp - 0x274]
call fcn.1004d4c0
add esp, 0xc
push 0x7993
push 0
call fcn.100339c4
pop ecx
pop ecx
mov dword [ebp - 0x2f0], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x274]
push 0
push 0
push dword [ebp - 0x2f0]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001db1f
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2b4], eax
push dword [ebp - 0x2b4]
call fcn.100351b3
pop ecx
jmp 0x1001dddf
jmp 0x1001db39
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0x2b8], eax
push dword [ebp - 0x2b8]
call fcn.100351b3
pop ecx
jmp 0x1001d89c
jmp 0x1001db4a
jmp 0x1001dddf
and dword [ebp - 8], 0
push 0xbab
call fcn.1001bf25
pop ecx
mov dword [ebp - 0x2f4], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push dword [ebp - 0x2f4]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
add dh, byte [ebp + 0x4c]
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x10], 1
push 0x185f
push 0
call fcn.10033aae
pop ecx
pop ecx
mov dword [ebp - 0x2f8], eax
push 0xbab
call fcn.1001bf25
pop ecx
mov dword [ebp - 0x2fc], eax
push 4
push dword [ebp - 0x2f8]
push 1
push 0
push dword [ebp - 0x2fc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1001dddf
cmp dword [ebp - 0x114], 0
jne 0x1001dddf
mov eax, dword [ebp - 8]
inc eax
push eax
call fcn.1000361d
pop ecx
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x2bc]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 8]
inc eax
push eax
push 0
push dword [ebp - 0x2a8]
call fcn.1004d4c0
add esp, 0xc
push 0xbab
call fcn.1001bf25
pop ecx
mov dword [ebp - 0x300], eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x2a8]
push 0
push 0
push dword [ebp - 0x300]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x1001dc66
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2c0], eax
push dword [ebp - 0x2c0]
call fcn.100351b3
pop ecx
jmp 0x1001dddf
push 0
push 0x59a7
call fcn.10008a25
pop ecx
pop ecx
mov dword [ebp - 0x304], eax
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x374], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x378], eax
mov eax, dword [ebp - 0x378]
mov al, byte [eax]
mov byte [ebp - 0x379], al
mov ecx, dword [ebp - 0x374]
cmp al, byte [ecx]
jne 0x1001dced
cmp byte [ebp - 0x379], 0
je 0x1001dce4
mov eax, dword [ebp - 0x378]
mov al, byte [eax + 1]
mov byte [ebp - 0x37a], al
mov ecx, dword [ebp - 0x374]
cmp al, byte [ecx + 1]
jne 0x1001dced
add dword [ebp - 0x378], 2
add dword [ebp - 0x374], 2
cmp byte [ebp - 0x37a], 0
jne 0x1001dc92
and dword [ebp - 0x380], 0
jmp 0x1001dcf8
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x380], eax
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 0
jne 0x1001dd19
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x10], 0
jmp 0x1001ddc7
push 0x185f
push 0
call fcn.10033aae
pop ecx
pop ecx
mov dword [ebp - 0x308], eax
mov eax, dword [ebp - 0x308]
mov dword [ebp - 0x388], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x38c], eax
mov eax, dword [ebp - 0x38c]
mov al, byte [eax]
mov byte [ebp - 0x38d], al
mov ecx, dword [ebp - 0x388]
cmp al, byte [ecx]
jne 0x1001dda0
cmp byte [ebp - 0x38d], 0
je 0x1001dd97
mov eax, dword [ebp - 0x38c]
mov al, byte [eax + 1]
mov byte [ebp - 0x38e], al
mov ecx, dword [ebp - 0x388]
cmp al, byte [ecx + 1]
jne 0x1001dda0
add dword [ebp - 0x38c], 2
add dword [ebp - 0x388], 2
cmp byte [ebp - 0x38e], 0
jne 0x1001dd45
and dword [ebp - 0x394], 0
jmp 0x1001ddab
sbb eax, eax
sbb eax, 0xffffffff
mov dword [ebp - 0x394], eax
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 0
jne 0x1001ddc7
mov eax, dword [ebp + 0xc]
mov byte [eax + 0x10], 1
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x2c4], eax
push dword [ebp - 0x2c4]
call fcn.100351b3
pop ecx
mov dword [ebp - 0x118], 0x7ac0
jmp 0x1001de36
ret 4
cmp dword [ebp - 0xc], 0
je 0x1001ddff
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
je 0x1001de0e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001de36
mov dword [ebp - 0x118], 0x5a5e
mov edx, dword [esp + 8]
lea eax, [edx + 0xc]
mov ecx, dword [edx - 0x14]
xor ecx, eax
call 0xfb778dc
mov eax, 0x104ab580
jmp 0xfdb79de
jmp 0x1001d410
pop edi
pop esi
leave
ret