Function at 0x102359d
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0xc105
push esi
call fcn.01027916
test eax, eax
je 0x10235cd
push 0x100b9b8
push esi
call fcn.010279c4
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 2
push 0
mov edi, 0x100b1a8
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1023610
push esi
call fcn.01027916
test eax, eax
je 0x10237df
push edi
push 0x100b8c8
push esi
call fcn.010279c4
add esp, 0xc
jmp 0x10237df
push ebx
mov ebx, 0x10032d8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
mov ebx, 0x100b228
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
test eax, eax
jne 0x1023679
call fcn.01027916
test eax, eax
je 0x1023654
push ebx
push edi
push 0x100b818
push esi
call fcn.010279c4
add esp, 0x10
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push 0
mov ebx, 0x100b238
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x20], 0x84020004
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
test eax, eax
je 0x1023694
call fcn.01027916
test eax, eax
je 0x10236ea
push ebx
push edi
push 0x100b768
push esi
call fcn.010279c4
add esp, 0x10
jmp 0x10236ea
call fcn.01027916
test eax, eax
je 0x10236b0
push ebx
push edi
push dword [ebp - 0x20]
push 0x100b6c0
push esi
call fcn.010279c4
add esp, 0x14
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 3
push 0
mov ebx, 0x100b138
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10236f8
push esi
call fcn.01027916
test eax, eax
je 0x10236ea
push ebx
push 0x100b8c8
push esi
call fcn.010279c4
add esp, 0xc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10237de
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x100b250
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x102373b
push esi
call fcn.01027916
test eax, eax
je 0x10237ce
push 0x100b250
push ebx
push 0x100b5a0
jmp 0x10237c5
push dword [ebp - 0x24]
inc byte [ebp - 5]
lea eax, [ebp - 0x14]
push eax
push 3
push 0
push 0x100b270
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
test eax, eax
je 0x1023772
call fcn.01027916
test eax, eax
je 0x10237ce
push 0x100b270
push edi
push 0x100b4e8
jmp 0x10237c5
call fcn.01027916
test eax, eax
je 0x102378f
push 0x100b270
push edi
push 0x100b448
push esi
call fcn.010279c4
add esp, 0x10
mov edi, 0x100b250
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
test eax, eax
je 0x10237b5
call fcn.01027916
test eax, eax
je 0x10237ce
push edi
push ebx
push 0x100b330
jmp 0x10237c5
call fcn.01027916
test eax, eax
je 0x10237ce
push edi
push ebx
push 0x100b288
push esi
call fcn.010279c4
add esp, 0x10
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x18]
call esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01016c45
leave
ret