Function at 0x127284
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0x39
push 0
push 0
dec ecx
jne 0x12728d
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x127c54
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
lea eax, [ebp - 0x34]
mov ecx, dword [ebp + 0xc]
mov edx, 0x127c6c
call fcn.00013ff4
mov eax, dword [ebp - 0x34]
call fcn.00127164
pop ecx
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x3c]
call fcn.00027b40
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.00027578
mov eax, dword [ebp - 0x38]
push eax
lea eax, [ebp - 0x40]
call fcn.00025994
mov ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x2c]
pop edx
call fcn.00013ff4
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, ebx
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov edi, eax
test edi, edi
jne 0x1276a3
lea eax, [ebp - 0xc]
mov edx, 0x19000
call fcn.000271f0
mov dword [ebp - 8], 0x19000
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x127c7c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edi, eax
test edi, edi
jne 0x127487
cmp dword [ebp - 0x1c], 1
jne 0x127459
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
lea edx, [ebp - 0x44]
mov eax, dword [ebp - 0x18]
call fcn.00027408
mov eax, dword [ebp - 0x44]
push eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
call fcn.00027408
mov eax, dword [ebp - 0x48]
pop edx
call fcn.00014294
test eax, eax
jg 0x127448
mov eax, dword [ebp - 0x18]
call fcn.00013fa8
test eax, eax
jle 0x1273c8
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, 0x127c90
call fcn.00013ff4
push dword [ebp - 0x2c]
push 0x127c9c
push dword [ebp - 0x2c]
push dword [ebp - 0x18]
lea eax, [ebp - 0x18]
mov edx, 4
call fcn.00014068
mov eax, dword [ebp - 0x18]
call fcn.00013fa8
inc eax
push eax
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 1
push 0
push 0x127c7c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x12741f
push ebp
mov eax, 0x127ca8
call fcn.00127164
pop ecx
jmp 0x127527
push ebp
lea edx, [ebp - 0x50]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x127cc8
call fcn.00013ff4
mov eax, dword [ebp - 0x4c]
call fcn.001271f4
pop ecx
jmp 0x127527
push ebp
mov eax, 0x127ce8
call fcn.00127164
pop ecx
jmp 0x127527
push ebp
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x58]
call fcn.00027444
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x127d04
call fcn.00013ff4
mov eax, dword [ebp - 0x54]
call fcn.001271f4
pop ecx
jmp 0x127527
cmp edi, 2
jne 0x127503
push dword [ebp - 0x2c]
push 0x127c9c
push dword [ebp - 0x2c]
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00014068
mov eax, dword [ebp - 0x18]
call fcn.00013fa8
inc eax
push eax
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 1
push 0
push 0x127c7c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x1274dd
push ebp
mov eax, 0x127d18
call fcn.00127164
pop ecx
jmp 0x127527
push ebp
lea edx, [ebp - 0x60]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
mov edx, 0x127d38
call fcn.00013ff4
mov eax, dword [ebp - 0x5c]
call fcn.001271f4
pop ecx
jmp 0x127527
push ebp
lea edx, [ebp - 0x68]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
mov edx, 0x127d58
call fcn.00013ff4
mov eax, dword [ebp - 0x64]
call fcn.001271f4
pop ecx
lea eax, [ebp - 0xc]
mov edx, 0x19000
call fcn.00027218
mov dword [ebp - 8], 4
xor eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x127d64
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edi, eax
test edi, edi
jne 0x127610
cmp dword [ebp - 0x1c], 4
jne 0x1275e2
cmp dword [ebp - 0x24], 1
je 0x1275d1
mov dword [ebp - 0x24], 1
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push 0x127d64
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x1275a8
push ebp
mov eax, 0x127d84
call fcn.00127164
pop ecx
jmp 0x1276d3
push ebp
lea edx, [ebp - 0x70]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
mov edx, 0x127da4
call fcn.00013ff4
mov eax, dword [ebp - 0x6c]
call fcn.001271f4
pop ecx
jmp 0x1276d3
push ebp
mov eax, 0x127dc4
call fcn.00127164
pop ecx
jmp 0x1276d3
push ebp
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x78]
call fcn.00027444
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x127de0
call fcn.00013ff4
mov eax, dword [ebp - 0x74]
call fcn.001271f4
pop ecx
jmp 0x1276d3
cmp edi, 2
jne 0x127671
mov dword [ebp - 0x24], 1
push 4
lea eax, [ebp - 0x24]
push eax
push 4
push 0
push 0x127d64
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x12764b
push ebp
mov eax, 0x127df4
call fcn.00127164
pop ecx
jmp 0x1276d3
push ebp
lea edx, [ebp - 0x80]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x80]
lea eax, [ebp - 0x7c]
mov edx, 0x127e14
call fcn.00013ff4
mov eax, dword [ebp - 0x7c]
call fcn.001271f4
pop ecx
jmp 0x1276d3
push ebp
lea edx, [ebp - 0x88]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x88]
lea eax, [ebp - 0x84]
mov edx, 0x127e34
call fcn.00013ff4
mov eax, dword [ebp - 0x84]
call fcn.001271f4
pop ecx
jmp 0x1276d3
push ebp
lea edx, [ebp - 0x90]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
mov edx, 0x127e48
call fcn.00013ff4
mov eax, dword [ebp - 0x8c]
call fcn.001271f4
pop ecx
cmp dword [ebp - 0x14], 0
je 0x1276e2
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, esi
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov edi, eax
test edi, edi
jne 0x127944
lea eax, [ebp - 0xc]
mov edx, 0x19000
call fcn.000271f0
mov dword [ebp - 8], 0x19000
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
push 0x127e54
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edi, eax
test edi, edi
jne 0x12788c
cmp dword [ebp - 0x1c], 1
jne 0x127852
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
call fcn.00013ee0
lea edx, [ebp - 0x94]
mov eax, dword [ebp - 0x18]
call fcn.00027408
mov eax, dword [ebp - 0x94]
push eax
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x2c]
call fcn.00027408
mov eax, dword [ebp - 0x98]
pop edx
call fcn.00014294
test eax, eax
jg 0x127841
mov eax, dword [ebp - 0x18]
call fcn.00013fa8
test eax, eax
jle 0x1277c2
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, 0x127c90
call fcn.00013ff4
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
call fcn.00013ff4
mov eax, dword [ebp - 0x18]
call fcn.00013fa8
inc eax
push eax
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 1
push 0
push 0x127e54
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x12780c
push ebp
mov eax, 0x127e70
call fcn.00127164
pop ecx
jmp 0x127937
push ebp
lea edx, [ebp - 0xa0]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
mov edx, 0x127e90
call fcn.00013ff4
mov eax, dword [ebp - 0x9c]
call fcn.001271f4
pop ecx
jmp 0x127937
push ebp
mov eax, 0x127eb0
call fcn.00127164
pop ecx
jmp 0x127937
push ebp
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
lea eax, [ebp - 0xa8]
call fcn.00027444
mov ecx, dword [ebp - 0xa8]
lea eax, [ebp - 0xa4]
mov edx, 0x127ec8
call fcn.00013ff4
mov eax, dword [ebp - 0xa4]
call fcn.001271f4
pop ecx
jmp 0x127937
cmp edi, 2
jne 0x127907
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
call fcn.00013db0
mov eax, dword [ebp - 0x18]
call fcn.00013fa8
inc eax
push eax
mov eax, dword [ebp - 0x18]
call fcn.0001416c
push eax
push 1
push 0
push 0x127e54
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x1278d5
push ebp
mov eax, 0x127edc
call fcn.00127164
pop ecx
jmp 0x127937
push ebp
lea edx, [ebp - 0xb0]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
mov edx, 0x127efc
call fcn.00013ff4
mov eax, dword [ebp - 0xac]
call fcn.001271f4
pop ecx
jmp 0x127937
push ebp
lea edx, [ebp - 0xb8]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0xb8]
lea eax, [ebp - 0xb4]
mov edx, 0x127f1c
call fcn.00013ff4
mov eax, dword [ebp - 0xb4]
call fcn.001271f4
pop ecx
lea eax, [ebp - 0xc]
mov edx, 0x19000
call fcn.00027218
cmp dword [ebp - 0x14], 0
je 0x127953
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov edi, eax
test edi, edi
jne 0x127bc6
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x2c]
call fcn.000145ac
mov eax, dword [ebp - 0x20]
call fcn.00014630
inc eax
add eax, eax
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0xc]
mov edx, 0x2800
call fcn.000271f0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov eax, 0x2510b4
mov ecx, 6
call fcn.0001291c
add dword [ebp - 0x28], 6
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov ecx, 4
call fcn.0001291c
add dword [ebp - 0x28], 4
mov eax, dword [ebp - 0x20]
call fcn.00014620
mov ebx, eax
mov esi, ebx
mov eax, dword [ebp - 0x20]
call fcn.00014630
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, esi
call fcn.0001291c
mov eax, dword [ebp - 0x20]
call fcn.00014630
add eax, eax
add eax, 2
add dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
mov eax, 0x2510bc
mov ecx, 8
call fcn.0001291c
add dword [ebp - 0x28], 8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov ecx, 4
call fcn.0001291c
add dword [ebp - 0x28], 4
mov esi, ebx
mov eax, dword [ebp - 0x20]
call fcn.00014630
mov ecx, eax
add ecx, ecx
mov edx, dword [ebp - 0x28]
mov eax, esi
call fcn.0001291c
mov eax, dword [ebp - 0x20]
call fcn.00014630
add eax, eax
add eax, 2
add dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
call fcn.00014630
mov ebx, eax
add ebx, ebx
add ebx, 0xa
add ebx, 2
add ebx, 8
add ebx, 4
mov eax, dword [ebp - 0x20]
call fcn.00014630
add eax, eax
add ebx, eax
add ebx, 2
mov dword [ebp - 8], ebx
xor ebx, ebx
lea eax, [ebp - 0x28]
mov edx, 0x2800
call fcn.000271f0
xor esi, esi
lea edx, [ebp - 0x1b8]
mov eax, esi
call fcn.000287f0
lea edx, [ebp - 0x1b8]
lea eax, [ebp - 0x30]
call fcn.00013f4c
mov dword [ebp - 0x24], 0x2800
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0x30]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edi, eax
test edi, edi
jne 0x127b0e
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 8]
jne 0x127b07
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.00027350
mov ebx, eax
test bl, bl
jne 0x127b0f
inc esi
jmp 0x127b0f
inc esi
cmp esi, 0x3e8
jge 0x127b1f
test edi, edi
jne 0x127b1f
test bl, bl
je 0x127aa7
lea eax, [ebp - 0x28]
mov edx, 0x2800
call fcn.00027218
test bl, bl
jne 0x127bb7
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 3
push 0
mov eax, dword [ebp - 0x30]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x127b7a
push ebp
lea eax, [ebp - 0x1bc]
mov ecx, dword [ebp - 0x30]
mov edx, 0x127f30
call fcn.00013ff4
mov eax, dword [ebp - 0x1bc]
call fcn.00127164
pop ecx
jmp 0x127bb7
push ebp
push 0x127f54
push dword [ebp - 0x30]
push 0x127f74
lea edx, [ebp - 0x1c4]
mov eax, edi
call fcn.00027478
push dword [ebp - 0x1c4]
lea eax, [ebp - 0x1c0]
mov edx, 4
call fcn.00014068
mov eax, dword [ebp - 0x1c0]
call fcn.001271f4
pop ecx
lea eax, [ebp - 0xc]
mov edx, 0x2800
call fcn.00027218
jmp 0x127bf6
push ebp
lea edx, [ebp - 0x1cc]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x1cc]
lea eax, [ebp - 0x1c8]
mov edx, 0x127f80
call fcn.00013ff4
mov eax, dword [ebp - 0x1c8]
call fcn.001271f4
pop ecx
cmp dword [ebp - 0x14], 0
je 0x127c05
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x14], eax
push ebp
mov eax, 0x127f94
call fcn.00127164
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x127c5b
lea eax, [ebp - 0x1cc]
mov edx, 5
call fcn.00013d3c
lea eax, [ebp - 0xb8]
mov edx, 0x24
call fcn.00013d3c
lea eax, [ebp - 0x20]
call fcn.000143f0
lea eax, [ebp - 0x18]
call fcn.00013d18
ret