Function at 0x106af8c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x910
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
xor edi, edi
inc edi
cmp eax, ebx
mov dword [ebp - 0x904], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x8e8], ebx
mov dword [ebp - 0x8ec], ebx
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x90c], edi
mov dword [ebp - 0x900], edi
mov dword [ebp - 0x8f8], ebx
je 0x106b9b6
push 0x100f0d8
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x106b025
push dword [ebp - 0x8f0]
mov dword [ebp - 0x8f8], edi
push esi
push 0x100f098
jmp 0x106b04f
push 0x100f090
push dword [ebp - 0x8f0]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
push dword [ebp - 0x8f0]
push esi
jne 0x106b04a
push 0x100f050
jmp 0x106b04f
push 0x100f024
lea eax, [ebp - 0x48c]
push 0x121
push eax
call fcn.01034d76
add esp, 0x14
push dword [ebp - 0x8f0]
lea eax, [ebp - 0x248]
push 0x100eff0
push 0x121
push eax
call fcn.01034d76
add esp, 0x10
push ebx
lea eax, [ebp - 0x8e8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
mov edi, SysReAllocString
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x106b15e
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106b123
cmp dword [ebp - 0x8e4], 1
je 0x106b0f7
cmp dword [ebp - 0x8e4], 2
jne 0x106b123
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0106911c
test eax, eax
jne 0x106b152
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b117
jmp 0x106b136
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b12c
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x8e8]
call esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp - 0x8f0]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106b942
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x8e0]
push eax
push 1
push ebx
push 0x100eb64
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8e0], ebx
call edi
test eax, eax
jne 0x106b2e5
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106b2d9
cmp dword [ebp - 0x8e4], 1
jne 0x106b2d9
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106b2d9
lea eax, [ebp - 0x248]
push 0x100bd78
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x106b2d9
push 0x100efdc
push 0x122
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x908], ebx
call fcn.01034cee
lea eax, [ebp - 0x908]
push eax
push 1
push ebx
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e0]
call edi
test eax, eax
jne 0x106b2d9
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x908]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106b2cd
cmp dword [ebp - 0x8e4], 1
je 0x106b29d
cmp dword [ebp - 0x8e4], 2
jne 0x106b2cd
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106b2cd
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8f0]
push 2
call fcn.01069928
mov dword [ebp - 0x900], eax
mov dword [ebp - 0x90c], ebx
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x100ebd0
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106b936
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call edi
test eax, eax
jne 0x106b441
cmp dword [ebp - 0x8e4], 1
je 0x106b35c
cmp dword [ebp - 0x8e4], 2
jne 0x106b441
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106b441
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8f0]
push 2
call fcn.01069928
test eax, eax
je 0x106b488
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x8fc], eax
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x8dc]
push eax
call fcn.01034c79
lea eax, [ebp - 0x8dc]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x8dc]
push eax
call fcn.01068e7c
test eax, eax
jne 0x106b407
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b3d7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x100ebb4
push dword [ebp - 0x8e0]
call esi
jmp 0x106b413
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x8f4], eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0106911c
test eax, eax
jne 0x106b488
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b433
sub eax, edx
jmp 0x106b46e
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x8f4], eax
lea eax, [ebp - 0x48c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x106b462
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8fc], ebx
je 0x106b936
push 0x105
lea eax, [ebp - 0x8a4]
push eax
call fcn.010590be
test eax, eax
je 0x106b936
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], 0x244
call edi
test eax, eax
jne 0x106b4ef
cmp dword [ebp - 0x8e4], 1
je 0x106b51d
mov eax, dword [ebp - 0x8f0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b4f8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x8f0]
push 1
push ebx
push ebx
push dword [ebp - 0x8e8]
call esi
push ebx
push ebx
push ebx
push ebx
mov edi, 0x100efc8
push edi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x106b54a
push 0xc
push 0x100efbc
push 1
push ebx
push edi
push dword [ebp - 0x8e8]
call esi
push ebx
push ebx
push ebx
push ebx
mov edi, 0x100efa8
push edi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x106b592
push 4
lea eax, [ebp - 0x8f0]
push eax
push 3
push ebx
push edi
push dword [ebp - 0x8e8]
mov byte [ebp - 0x8f0], 2
mov byte [ebp - 0x8ef], bl
mov byte [ebp - 0x8ee], bl
mov byte [ebp - 0x8ed], bl
call esi
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
mov edi, 0x2001f
push edi
push ebx
push ebx
push ebx
push 0x100eb9c
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106b75d
cmp dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8ec], 0x244
jne 0x106b653
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106b653
cmp dword [ebp - 0x8e4], 1
je 0x106b60c
cmp dword [ebp - 0x8e4], 2
jne 0x106b653
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106b653
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b625
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x100ebb4
push dword [ebp - 0x8e0]
call esi
mov eax, dword [ebp - 0x910]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b65c
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x910]
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
lea eax, [ebp - 0x8a4]
push eax
push 0x100ef94
lea eax, [ebp - 0x698]
push 0x105
push eax
call fcn.01034d76
add esp, 0x10
test eax, eax
jl 0x106b74c
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
mov edi, 0x100eb8c
push edi
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106b71d
cmp dword [ebp - 0x8e4], 1
je 0x106b6f1
cmp dword [ebp - 0x8e4], 2
jne 0x106b71d
lea eax, [ebp - 0x698]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0106911c
test eax, eax
jne 0x106b74c
lea eax, [ebp - 0x698]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b711
jmp 0x106b730
lea eax, [ebp - 0x698]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b726
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x698]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x2001f
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x100eb64
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106b827
cmp dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8ec], 0x244
jne 0x106b808
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106b808
cmp dword [ebp - 0x8e4], 1
jne 0x106b808
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106b808
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b7de
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push ebx
push 0x100ebb4
push dword [ebp - 0x8e0]
call esi
push 0xa
push 0x100ef88
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x100eb4c
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106b936
cmp dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8ec], 0x244
jne 0x106b8fc
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106b8fc
cmp dword [ebp - 0x8e4], 1
je 0x106b89c
cmp dword [ebp - 0x8e4], 2
jne 0x106b8fc
lea eax, [ebp - 0x248]
push eax
call fcn.01068ddd
test eax, eax
je 0x106b8fc
push dword [ebp - 0x904]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x106b8fc
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b8ce
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x100ebb4
push dword [ebp - 0x8e0]
call esi
mov eax, dword [ebp - 0x904]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x106b905
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x904]
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8f8], ebx
je 0x106b9b6
cmp dword [ebp - 0x8fc], ebx
je 0x106b9b6
lea eax, [ebp - 0x8e8]
push eax
push 0x2001f
push ebx
push 0x100ef00
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106b9b6
push 4
pop edi
push edi
lea eax, [ebp - 0x8f8]
push eax
push edi
push ebx
push 0x100eef0
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8f8], ebx
call esi
push edi
lea eax, [ebp - 0x8f8]
push eax
push edi
push ebx
push 0x100eedc
push dword [ebp - 0x8e8]
call esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01047417
leave
ret 0x18