Function at 0x1002c63
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x1006110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x1c]
push edi
mov edi, ecx
mov dword [ebp - 0x70], eax
mov eax, dword [edi]
mov eax, dword [eax*8 + 0x1006014]
xor esi, esi
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x78], 4
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x58], esi
lea ecx, [eax + 2]
mov bx, word [eax]
inc eax
inc eax
cmp bx, si
jne 0x1002cb0
sub eax, ecx
lea ecx, [ebp - 0x64]
push ecx
lea ecx, [ebp - 0x58]
push ecx
sar eax, 1
push 0x400
add eax, 9
push eax
push 0x10013b0
push edx
call fcn.01004378
mov ebx, eax
cmp ebx, esi
jne 0x1002ecc
push 0x10017dc
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.010024a5
cmp eax, esi
jge 0x1002d07
movzx ebx, ax
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1002ecc
mov eax, dword [edi]
push dword [eax*8 + 0x1006014]
push dword [ebp - 0x64]
push dword [ebp - 0x58]
call fcn.010024a5
cmp eax, esi
jl 0x1002cf8
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x60]
push eax
push esi
push esi
push esi
push dword [ebp - 0x68]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
cmp ebx, esi
jne 0x1002ecc
mov dword [ebp - 0x5c], esi
cmp dword [ebp - 0x60], esi
jbe 0x1002ecc
lea eax, [ebp - 0x50]
push eax
push 2
push esi
push 0x10
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x5c]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x50], esi
call dword [sym.imp.msvcrt.dll__itow]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0xc
push eax
push dword [ebp - 0x7c]
call edi
mov ebx, eax
cmp ebx, esi
jne 0x1002ebc
lea eax, [ebp - 0x48]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 0x68]
call edi
mov ebx, eax
cmp ebx, esi
jne 0x1002ebc
push esi
lea eax, [ebp - 0x4c]
push eax
mov edi, 0x400
push edi
push esi
push 0x10013c8
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], esi
call fcn.01004378
mov ebx, eax
cmp ebx, esi
jne 0x1002eae
push esi
lea eax, [ebp - 0x54]
push eax
push edi
push esi
push 0x100126c
push dword [ebp - 0x48]
mov dword [ebp - 0x54], esi
call fcn.01004378
mov ebx, eax
cmp ebx, esi
jne 0x1002ea0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push esi
push 0x10017c0
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp ebx, esi
jne 0x1002ea0
lea eax, [ebp - 0x8c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
push dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x74]
push dword [ebp - 0x50]
push dword [ebp - 0x70]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x58]
push dword [ebp - 0x54]
push dword [ebp - 0x4c]
call fcn.01002730
mov ebx, eax
cmp ebx, esi
je 0x1002e49
xor eax, eax
lea edi, [ebp - 0x8c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
lea eax, [ebp - 0x8c]
push eax
push 0xb
push esi
push 0x1001258
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x54], esi
je 0x1002e71
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x4c], esi
je 0x1002e7f
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x50]
call fcn.010022aa
lea ecx, [ebp - 0x48]
call fcn.010022aa
inc dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x60]
jb 0x1002d4c
jmp 0x1002ecc
cmp dword [ebp - 0x54], esi
je 0x1002eae
push dword [ebp - 0x54]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x4c], esi
je 0x1002ebc
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x50]
call fcn.010022aa
lea ecx, [ebp - 0x48]
call fcn.010022aa
cmp dword [ebp - 0x58], esi
je 0x1002eda
push dword [ebp - 0x58]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.01004780
leave
ret 0x18