Function at 0x1001c9b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x430
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x408]
push eax
push 1
xor edi, edi
push edi
push 0x10011e0
push 0x80000002
mov dword [ebp - 0x410], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001ce7
xor eax, eax
jmp 0x1002061
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
push 0x10012e0
push dword [ebp - 0x408]
mov dword [ebp - 0x414], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001d2a
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001ce0
push ebx
push esi
mov dword [ebp - 0x41c], edi
mov ebx, 0x10013e4
mov esi, 0x200
cmp dword [ebp - 0x42c], edi
jbe 0x1001e8a
push dword [ebp - 0x41c]
lea eax, [ebp - 0x204]
push 0x100131c
push ebx
push esi
push eax
call fcn.01001801
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x414], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1001e72
mov word [ebp - 0x206], ax
push 0x1001340
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1001e72
push dword [ebp - 0x41c]
lea eax, [ebp - 0x204]
push 0x10012c8
push ebx
push esi
push eax
call fcn.01001801
add esp, 0x14
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x408]
mov dword [ebp - 0x414], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
push dword [ebp - 0x418]
call sub.TAPI32.dll_lineRemoveProvider
test eax, eax
jne 0x1001ebf
lea eax, [ebp - 0x410]
push eax
push 0x2001f
push edi
push 0x1001260
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002028
push dword [ebp - 0x418]
lea eax, [ebp - 0x204]
push 0x100135c
push ebx
push esi
push eax
call fcn.01001801
add esp, 0x14
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x410]
call fcn.010016a5
inc dword [ebp - 0x41c]
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x42c]
jb 0x1001d48
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x428]
push eax
push edi
push 0x10012fc
push dword [ebp - 0x408]
mov dword [ebp - 0x414], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1001ec7
push dword [ebp - 0x408]
jmp 0x1001f41
cmp dword [ebp - 0x410], edi
jne 0x1001ef4
lea eax, [ebp - 0x410]
push eax
push 0x2001f
push edi
push 0x1001260
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002028
push dword [ebp - 0x418]
lea eax, [ebp - 0x204]
push 0x100135c
push ebx
push esi
push eax
call fcn.01001801
add esp, 0x14
lea eax, [ebp - 0x430]
push eax
lea eax, [ebp - 0x40c]
push eax
push edi
push 2
push edi
push edi
push edi
lea eax, [ebp - 0x204]
push eax
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x1001f4c
push dword [ebp - 0x410]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1002028
mov dword [ebp - 0x424], edi
cmp dword [ebp - 0x420], edi
je 0x1001fbc
push dword [ebp - 0x424]
lea eax, [ebp - 0x204]
push 0x1001370
push ebx
push esi
push eax
call fcn.01001801
add esp, 0x14
push dword [ebp - 0x420]
call fcn.0100151f
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x204]
push 1
push edi
push eax
push dword [ebp - 0x40c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1002012
push edi
call fcn.010015a6
inc dword [ebp - 0x424]
mov dword [ebp - 0x420], eax
cmp eax, edi
jne 0x1001f5a
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
pop ebx
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push edi
push 0x1001380
push dword [ebp - 0x40c]
call esi
test eax, eax
jne 0x1002012
push ebx
push 0x1004028
push ebx
push edi
push 0x1001398
push dword [ebp - 0x40c]
call esi
test eax, eax
jne 0x1002012
push ebx
push 0x1004024
push ebx
push edi
push 0x10013c8
push dword [ebp - 0x40c]
call esi
test eax, eax
je 0x100202c
push dword [ebp - 0x40c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x408]
call esi
xor eax, eax
jmp 0x100205f
lea eax, [ebp - 0x418]
push eax
push edi
push 0x1001340
call sub.TAPI32.dll_lineAddProviderW
push dword [ebp - 0x40c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x408]
call esi
push dword [ebp - 0x410]
call esi
xor eax, eax
inc eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0100265e
leave
ret 4