Function at 0x106f561
Capabilities:
Delete registry value
Persist via autoplayhandlers registry key
Persist via contextmenuhandlers registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x107fa78]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
xor edi, edi
mov dword [ebp - 0x7e8], edi
mov dword [ebp - 0x7fc], edi
call fcn.01068d5a
test eax, eax
jne 0x107089e
push ebx
push esi
call fcn.01068dff
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x106ff5f
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010bd0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f63a
push 0x100f770
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f61b
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f5f5
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1001e8c
push 1
push edi
push 0x10114e0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010b38
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f6c7
push 0x100e988
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f6a8
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f682
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1001e8c
push 1
push edi
push 0x10114e0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010aa0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f754
push 0x100f770
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f735
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f70f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1001e8c
push 1
push edi
push 0x10114e0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010a08
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f7e1
push 0x100e988
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f7c2
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f79c
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1001e8c
push 1
push edi
push 0x10114e0
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010960
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f857
push 0x100f770
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f84f
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f829
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x10108b0
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f8cd
push 0x1011490
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f8c5
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f89f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010808
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f943
push 0x100f770
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f93b
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f915
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010758
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106f9b9
push 0x1011490
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x106f9b1
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x106f98b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
lea eax, [ebp - 0x7fc]
push eax
push 0x2001f
push edi
push dword [0x107fde4]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106ff5f
lea eax, [ebp - 0x7e8]
push eax
push 0x20019
push edi
push 0x100bccc
push dword [ebp - 0x7fc]
mov dword [ebp - 0x7f0], edi
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x810], edi
mov dword [ebp - 0x80c], edi
mov dword [ebp - 0x800], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106ff57
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x514]
push eax
push edi
jmp 0x106ff31
inc dword [ebp - 0x808]
lea eax, [ebp - 0x514]
push eax
call fcn.01069026
test eax, eax
je 0x106ff19
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7e8]
call fcn.01069088
test eax, eax
je 0x106ff19
lea eax, [ebp - 0x810]
push eax
push 0x20019
push edi
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106ff19
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x7e4]
push eax
push edi
push edi
push 0x100bd94
push dword [ebp - 0x810]
mov dword [ebp - 0x7ec], edi
mov dword [ebp - 0x7f0], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x106faed
lea eax, [ebp - 0x514]
push eax
push 0x100bd84
lea eax, [ebp - 0x7e4]
push 0x63
push eax
call fcn.01034d76
add esp, 0x10
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x30c]
push eax
push edi
push edi
push 0x1011010
push dword [ebp - 0x810]
mov dword [ebp - 0x7f0], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x106fb39
lea eax, [ebp - 0x514]
push eax
push 0x1010fec
lea eax, [ebp - 0x30c]
push 0x3f
push eax
call fcn.01034d76
add esp, 0x10
mov dword [ebp - 0x804], edi
cmp dword [ebp - 0x804], edi
lea eax, [ebp - 0x7f8]
push eax
push 0x2001f
mov dword [ebp - 0x7f8], edi
mov dword [ebp - 0x7f4], edi
push edi
lea eax, [ebp - 0x7e4]
je 0x106fb6c
lea eax, [ebp - 0x30c]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106ff11
push edi
lea eax, [ebp - 0x80c]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010f90
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106fbc1
push 0x4e
push 0x100f770
push 1
push edi
push edi
push dword [ebp - 0x80c]
call esi
push dword [ebp - 0x80c]
call ebx
push edi
lea eax, [ebp - 0x80c]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010f30
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106fc02
push 0x4e
push 0x100e988
push 1
push edi
push edi
push dword [ebp - 0x80c]
call esi
push dword [ebp - 0x80c]
call ebx
lea eax, [ebp - 0x7ec]
push eax
push 1
push edi
push 0x1011464
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106fc8c
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x800]
push eax
push edi
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106fc84
cmp dword [ebp - 0x800], 1
je 0x106fc64
cmp dword [ebp - 0x800], 2
jne 0x106fc84
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x71c]
push eax
call fcn.01068e30
mov dword [ebp - 0x7f4], eax
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x7ec]
push eax
push 0x20006
push edi
push 0x1010f18
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106fce8
cmp dword [ebp - 0x7f4], edi
je 0x106fccf
push 2
push 0x1001e8c
push 1
push edi
push 0x100f17c
push dword [ebp - 0x7ec]
call esi
jmp 0x106fce0
push 0x100f17c
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x28c]
push eax
push edi
push edi
push 0x1010ef0
push dword [ebp - 0x810]
mov dword [ebp - 0x7f0], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106fe10
lea eax, [ebp - 0x28c]
push eax
push 0x1011440
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01034d76
add esp, 0x10
test eax, eax
jl 0x106fef6
lea eax, [ebp - 0x7ec]
push eax
push 1
push edi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106fdcf
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x800]
push eax
push edi
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106fdc7
cmp dword [ebp - 0x800], 1
je 0x106fda7
cmp dword [ebp - 0x800], 2
jne 0x106fdc7
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x71c]
push eax
call fcn.01068e30
mov dword [ebp - 0x7f4], eax
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x28c]
push eax
push 0x1010edc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.01034d76
add esp, 0x10
test eax, eax
jl 0x106fef6
lea eax, [ebp - 0x7ec]
push eax
push 0x20006
push edi
lea eax, [ebp - 0x20c]
push eax
jmp 0x106feac
lea eax, [ebp - 0x7ec]
push eax
push 1
push edi
push 0x100ebd0
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106fe9a
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x71c]
push eax
lea eax, [ebp - 0x800]
push eax
push edi
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x106fe92
cmp dword [ebp - 0x800], 1
je 0x106fe72
cmp dword [ebp - 0x800], 2
jne 0x106fe92
lea eax, [ebp - 0x71c]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x71c]
push eax
call fcn.01068e30
mov dword [ebp - 0x7f4], eax
push dword [ebp - 0x7ec]
call ebx
lea eax, [ebp - 0x7ec]
push eax
push 0x20006
push edi
push 0x100eb9c
push dword [ebp - 0x7f8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x106fef6
cmp dword [ebp - 0x7f4], edi
je 0x106fedd
push 2
push 0x1001e8c
push 1
push edi
push 0x100f17c
push dword [ebp - 0x7ec]
call esi
jmp 0x106feee
push 0x100f17c
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call ebx
push dword [ebp - 0x7f8]
call ebx
inc dword [ebp - 0x804]
cmp dword [ebp - 0x804], 2
jl 0x106fb3f
push dword [ebp - 0x810]
call ebx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x808]
push dword [ebp - 0x7e8]
mov dword [ebp - 0x7f0], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x106fa3f
push dword [ebp - 0x7e8]
call ebx
push dword [ebp - 0x7fc]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010688
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106ffba
push 2
push 0x1001e8c
push 1
push edi
push 0x1010654
push dword [ebp - 0x7e8]
call esi
push 2
push 0x1001e8c
push 1
push edi
push 0x1010628
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010558
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x106fffe
push 2
push 0x1001e8c
push 1
push edi
push 0x1010524
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010440
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070042
push 2
push 0x1001e8c
push 1
push edi
push 0x10103f8
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010320
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070086
push 2
push 0x1001e8c
push 1
push edi
push 0x10102e8
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010210
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10700ca
push 2
push 0x1001e8c
push 1
push edi
push 0x10101e4
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010110
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x107010e
push 2
push 0x1001e8c
push 1
push edi
push 0x1003608
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1010038
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070152
push 2
push 0x1001e8c
push 1
push edi
push 0x1003608
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100ff70
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10701f2
push 0x24
push 0x101141c
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x18
push 0x10113bc
push 1
push edi
push 0x10113a0
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x100bd78
push 1
push edi
push 0x1011388
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x1011258
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070292
push 0x24
push 0x1011230
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x1c
push 0x1011214
push 1
push edi
push 0x10113a0
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x100bd78
push 1
push edi
push 0x1011388
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100fd10
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070332
push 0x24
push 0x10111f0
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x10
push 0x10111e0
push 1
push edi
push 0x10113a0
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x100bd78
push 1
push edi
push 0x1011388
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100fea8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10703d2
push 0x24
push 0x10111bc
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x14
push 0x10111a8
push 1
push edi
push 0x10113a0
push dword [ebp - 0x7e8]
call esi
push 8
push 0x10111a0
push 1
push edi
push 0x1011388
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100fb58
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070472
push 0x24
push 0x101117c
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x10
push 0x101116c
push 1
push edi
push 0x10113a0
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x100bd78
push 1
push edi
push 0x1011388
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100fc30
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070512
push 0x24
push 0x1011148
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x10
push 0x101116c
push 1
push edi
push 0x10113a0
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x100bd78
push 1
push edi
push 0x1011388
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100fde0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10705b2
push 0x24
push 0x1011124
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x16
push 0x101110c
push 1
push edi
push 0x10113a0
push dword [ebp - 0x7e8]
call esi
push 0xa
push 0x1011100
push 1
push edi
push 0x1011388
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push dword [ebp - 0x7e8]
call ebx
push edi
lea eax, [ebp - 0x7e8]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
push 0x100faa0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070667
push 0x26
push 0x10110d8
push 1
push edi
push 0x101140c
push dword [ebp - 0x7e8]
call esi
push 0x24
push 0x10113e8
push 1
push edi
push 0x10113d4
push dword [ebp - 0x7e8]
call esi
push 0x4e
push 0x1011088
push 1
push edi
push 0x1011068
push dword [ebp - 0x7e8]
call esi
push 0x66
push 0x1011320
push 2
push edi
push 0x100eb4c
push dword [ebp - 0x7e8]
call esi
push 0x16
push 0x1011050
push 1
push edi
push 0x1011040
push dword [ebp - 0x7e8]
call esi
push 0x1011028
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7e8]
call ebx
lea eax, [ebp - 0x7e8]
push eax
push 0x2001f
push edi
push 0x1010e68
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1070797
lea eax, [ebp - 0x7fc]
push eax
push 0x2001f
push edi
push 0x1010dc0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x107078f
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x804], 0x104
jmp 0x1070760
push edi
lea eax, [ebp - 0x808]
push eax
push edi
push 0x2001f
push edi
push edi
push edi
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7fc]
mov dword [ebp - 0x804], 0x104
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1070760
push 0x1001e8c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x1070745
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x107071b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100351c
push dword [ebp - 0x808]
call esi
lea eax, [ebp - 0x514]
push eax
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x808]
call ebx
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x514]
push eax
push edi
push dword [ebp - 0x7e8]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10706c6
push dword [ebp - 0x7fc]
call ebx
push dword [ebp - 0x7e8]
call ebx
lea eax, [ebp - 0x7fc]
push eax
push 0x20006
push edi
push 0x1010d08
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x107089c
push 0x1001e8c
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01034c79
test eax, eax
jl 0x1070894
lea eax, [ebp - 0x7f4]
push eax
push 2
push edi
push 0x1010cb8
push dword [ebp - 0x7fc]
mov dword [ebp - 0x7f4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x107083a
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1070808
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100351c
push dword [ebp - 0x7f4]
call esi
push dword [ebp - 0x7f4]
call ebx
lea eax, [ebp - 0x7f4]
push eax
push 2
push edi
push 0x1010c68
push dword [ebp - 0x7fc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1070894
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1070862
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100351c
push dword [ebp - 0x7f4]
call esi
push dword [ebp - 0x7f4]
call ebx
push dword [ebp - 0x7fc]
call ebx
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.01047417
leave
ret