Function at 0x101ce6d
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x24c
mov eax, 0x103057d
call fcn.0102b282
xor ebx, ebx
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
push 0xf003f
push 0x1002430
push 0x80000002
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], ebx
call fcn.0101c831
cmp eax, ebx
je 0x101cef2
jle 0x101cec7
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10023a0
push ebx
push 0x10
push 0x1035128
call fcn.0102ca9a
add esp, 0x14
lea ecx, [ebp - 0x23c]
call fcn.0101c7be
mov eax, esi
call fcn.0102b314
ret
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x23c]
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, ebx
je 0x101cf5a
jle 0x101cf31
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10022f0
push ebx
push 0x10
push 0x1035128
call fcn.0102ca9a
mov ebx, esi
add esp, 0x14
lea ecx, [ebp - 0x23c]
call fcn.0101c7be
mov eax, ebx
jmp 0x101ceec
cmp dword [ebp - 0x224], ebx
jne 0x101cf77
push ebx
push 0x1002260
push ebx
push 2
push 0x1035128
call fcn.0102ca9a
jmp 0x101cf48
inc dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0102a64e
pop ecx
mov dword [ebp - 0x230], eax
cmp eax, ebx
jne 0x101cfa9
mov ebx, 0x8007000e
jmp 0x101cf4b
mov dword [ebp - 0x228], ebx
cmp dword [ebp - 0x224], ebx
jbe 0x101d1dc
mov esi, 0x1035128
push dword [ebp - 0x220]
push dword [ebp - 0x230]
push dword [ebp - 0x228]
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, ebx
je 0x101d00b
jle 0x101cfee
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x10021d8
push ebx
push 0x10
push esi
mov dword [ebp - 0x21c], eax
call fcn.0102ca9a
add esp, 0x14
jmp 0x101d1c4
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
push 0x20019
push dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push dword [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.0101c831
cmp eax, ebx
je 0x101d064
jle 0x101d04d
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x21c], eax
push 0x1002118
jmp 0x101d1aa
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x22c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x1002100
push dword [ebp - 0x248]
mov dword [ebp - 0x24c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x101d18c
cmp dword [ebp - 0x22c], 1
jne 0x101d198
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x254], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x101d162
push 4
lea eax, [ebp - 0x250]
push eax
push 4
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x250], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
jne 0x101d141
lea eax, [ebp - 0x218]
push eax
push 0x1002050
jmp 0x101d17e
jle 0x101d14d
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
push 0x1001fb8
jmp 0x101d1aa
cmp eax, ebx
je 0x101d1b6
jle 0x101d172
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 0x21c], eax
push 0x1001f10
push ebx
push 0x10
push esi
call fcn.0102ca9a
add esp, 0x14
jmp 0x101d1b6
jle 0x101d198
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0x22c]
mov dword [ebp - 0x21c], eax
push 0x1001e50
push ebx
push 0x10
push esi
call fcn.0102ca9a
add esp, 0x18
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.0101c7be
inc dword [ebp - 0x228]
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x224]
jb 0x101cfc0
push dword [ebp - 0x230]
call fcn.0102a5ce
mov ebx, dword [ebp - 0x21c]
pop ecx
jmp 0x101cf4b