Function at 0x101fc96
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x1027050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 5
pop ecx
mov esi, 0x10018e4
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x16
pop ecx
mov esi, 0x1001888
lea edi, [ebp - 0xa4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0xb
pop ecx
mov esi, 0x100185c
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
cmp dword [ebp + 8], edi
mov dword [ebp - 0x2b8], edi
je 0x101ff6f
lea eax, [ebp - 0x2b0]
push eax
push 0xf003f
push edi
push 0x1001808
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101ff40
push 0x204
lea eax, [ebp - 0x2a8]
push edi
push eax
mov dword [ebp - 0x2ac], edi
call sub.msvcrt.dll_memset
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x2ac]
push eax
push edi
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
mov dword [ebp - 0x2c0], 0x208
call esi
cmp eax, edi
mov dword [ebp - 0x2b4], eax
jne 0x101fd74
cmp dword [ebp - 0x2c0], edi
jne 0x101fd74
mov dword [ebp - 0x2b4], 2
push ebx
lea eax, [ebp - 0x2ac]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x101fdde
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x10017f8
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x101fdb0
push 0x10017ec
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
jne 0x101fdde
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCmpICW]
push 0x10017b8
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x101fdde
push 0x1001780
lea eax, [ebp - 0x2ac]
push eax
call ebx
test eax, eax
je 0x101fdde
xor ebx, ebx
jmp 0x101fde1
xor ebx, ebx
inc ebx
push 0x25
call dword [sym.imp.SHLWAPI.dll_IsOS]
test eax, eax
je 0x101ff0b
lea eax, [ebp - 0x2b8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x101ff0b
cmp ebx, edi
jne 0x101fe16
cmp dword [ebp - 0x2b4], edi
je 0x101ff33
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x5a
lea eax, [ebp - 0xa4]
push eax
push 1
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
call ebx
lea eax, [ebp - 0x2bc]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call esi
cmp eax, edi
jne 0x101fef1
mov esi, dword [ebp - 0x2bc]
cmp esi, edi
je 0x101fef1
add esi, 4
shr esi, 1
inc esi
inc esi
xor ecx, ecx
push 2
pop edx
mov eax, esi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, edi
pop ecx
mov dword [ebp - 0x2b4], eax
je 0x101fef1
lea ecx, [ebp - 0x2bc]
push ecx
push eax
push edi
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x2b8]
push eax
lea eax, [ebp - 0x2c4]
push eax
push dword [ebp - 0x2b4]
mov dword [ebp - 0x2c4], esi
call fcn.0101fc0c
test eax, eax
jl 0x101fee3
mov eax, dword [ebp - 0x2c4]
add eax, eax
push eax
push dword [ebp - 0x2b4]
lea eax, [ebp - 0x48]
push 7
push edi
push eax
push dword [ebp - 0x2b0]
call ebx
push dword [ebp - 0x2b4]
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x101ff33
push 4
lea eax, [ebp - 0x2b8]
push eax
push 7
push edi
lea eax, [ebp - 0x48]
push eax
push dword [ebp - 0x2b0]
call ebx
jmp 0x101ff33
cmp ebx, edi
jne 0x101ff17
cmp dword [ebp - 0x2b4], edi
je 0x101ff33
push 0x5a
lea eax, [ebp - 0xa4]
push eax
push 1
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2b0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
cmp dword [ebp + 0xc], edi
jne 0x101ff6f
push 0x1001768
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, edi
je 0x101ff6f
push 0x1001754
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
je 0x101ff68
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01023399
leave
ret 8