Function at 0x101f74d
Capabilities:
Delete registry value
Get common file path
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x810
mov eax, dword [0x102a0ec]
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x810], eax
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x7fc], eax
mov eax, dword [ebp + 0x14]
xor esi, esi
xor ebx, ebx
push edi
mov dword [ebp - 0x804], edi
mov dword [ebp - 0x800], eax
mov dword [ebp - 0x7ec], esi
mov dword [ebp - 0x7f0], esi
mov dword [ebp - 0x808], esi
inc ebx
call fcn.0101e485
mov dword [ebp - 0x80c], eax
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
push edi
mov edi, 0x80000000
push edi
mov dword [ebp - 0x7f4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101faea
cmp dword [ebp - 0x80c], esi
mov dword [ebp - 0x7f0], 0x190
je 0x101f832
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x1007df0
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f832
cmp dword [ebp - 0x7f4], ebx
jne 0x101f832
lea eax, [ebp - 0x194]
push 0x1007de0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov ebx, eax
neg ebx
pop ecx
sbb ebx, ebx
pop ecx
inc ebx
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f8a5
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x7f4], ecx
jne 0x101f8a5
lea eax, [ebp - 0x194]
push eax
call fcn.0101b431
test eax, eax
je 0x101f8a5
lea eax, [ebp - 0x7f8]
push eax
push dword [ebp - 0x800]
lea eax, [ebp - 0x194]
push dword [ebp - 0x7fc]
mov dword [ebp - 0x7f8], ecx
push eax
call fcn.0101c1b2
jmp 0x101f8ab
mov dword [ebp - 0x7f8], esi
cmp ebx, esi
je 0x101f8bb
cmp dword [ebp - 0x7f8], esi
jne 0x101f97c
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f97c
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x7f4], ebx
jne 0x101f97c
lea eax, [ebp - 0x194]
push eax
call fcn.0101b431
test eax, eax
je 0x101f97c
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 0x800]
lea eax, [ebp - 0x194]
push dword [ebp - 0x7fc]
mov dword [ebp - 0x80c], ebx
push eax
call fcn.0101c1b2
cmp dword [ebp - 0x80c], esi
je 0x101f97c
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1007504
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x7f8], ebx
cmp dword [ebp - 0x810], esi
lea eax, [ebp - 0x194]
je 0x101f99d
push dword [ebp - 0x810]
push 0xc7
push eax
call fcn.0100c535
jmp 0x101f9b6
push dword [ebp - 0x804]
push 0x100731c
push 0xc7
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x808]
push eax
push dword [ebp - 0x800]
lea eax, [ebp - 0x194]
push dword [ebp - 0x7fc]
push eax
call fcn.0101c1b2
cmp dword [ebp - 0x7f8], esi
jne 0x101fa17
cmp dword [ebp - 0x808], esi
je 0x101fa17
lea eax, [ebp - 0x194]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
xor ebx, ebx
inc ebx
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x7f8], ebx
push dword [ebp - 0x7ec]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call ebx
cmp dword [ebp - 0x7f8], esi
jne 0x101faea
xor eax, eax
lea ecx, [ebp - 0x7ec]
push ecx
inc eax
push eax
push esi
push dword [ebp - 0x804]
mov dword [ebp - 0x7fc], eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101fade
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x1004230
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101fa93
mov dword [ebp - 0x7fc], esi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x1007dd0
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101face
mov dword [ebp - 0x7fc], esi
push dword [ebp - 0x7ec]
call ebx
cmp dword [ebp - 0x7fc], esi
je 0x101faea
push dword [ebp - 0x804]
push edi
call fcn.01017d6c
push esi
push 4
call fcn.01017179
mov dword [ebp - 0x7f8], eax
push 0x103
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x101fd32
push 0x1007db8
mov edi, 0x104
push edi
lea eax, [ebp - 0x7e8]
push eax
call fcn.0100d4ff
cmp dword [ebp - 0x7f8], esi
mov eax, 0x1007db0
jne 0x101fb3b
mov eax, 0x1007da4
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x7e8]
push ecx
push edi
lea ecx, [ebp - 0x39c]
push ecx
push dword [0x102a024]
push 0x1007d90
push eax
call ebx
test eax, eax
je 0x101fba7
lea eax, [ebp - 0x39c]
push eax
push dword [0x102a024]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101fba7
cmp dword [ebp - 0x7f8], esi
mov eax, 0x1007d78
jne 0x101fb8d
mov eax, 0x1007d5c
push eax
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x7fc], esi
je 0x101fbb1
mov dword [ebp - 0x7fc], 1
cmp dword [ebp - 0x7f8], esi
mov eax, 0x1007db0
jne 0x101fbc3
mov eax, 0x1007da4
lea ecx, [ebp - 0x7e8]
push ecx
push edi
lea ecx, [ebp - 0x39c]
push ecx
push dword [0x102a024]
push 0x1003870
push eax
call ebx
test eax, eax
je 0x101fc29
lea eax, [ebp - 0x39c]
push eax
push dword [0x102a024]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101fc29
cmp dword [ebp - 0x7f8], esi
mov eax, 0x1007d78
jne 0x101fc0f
mov eax, 0x1007d5c
push eax
lea eax, [ebp - 0x39c]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x800], esi
je 0x101fc33
mov dword [ebp - 0x800], 1
cmp dword [ebp - 0x7fc], esi
jne 0x101fc47
cmp dword [ebp - 0x800], esi
je 0x101fd32
mov eax, dword [ebp - 0x804]
add eax, 2
push eax
push 0x103
lea eax, [ebp - 0x39c]
push eax
call fcn.0100c535
mov edi, dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x102a024]
lea eax, [ebp - 0x39c]
push eax
mov ebx, 0x1007d34
push ebx
call edi
test eax, eax
je 0x101fd32
lea eax, [ebp - 0x5e0]
push eax
push dword [0x102a024]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101fd32
push esi
lea eax, [ebp - 0x39c]
push eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
call ebx
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x102a024]
lea eax, [ebp - 0x39c]
push eax
push 0x100462c
call edi
test eax, eax
je 0x101fd32
cmp dword [ebp - 0x7fc], esi
je 0x101fd03
lea eax, [ebp - 0x5e0]
push eax
push 0x1007d90
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101fd23
cmp dword [ebp - 0x800], esi
je 0x101fd32
lea eax, [ebp - 0x5e0]
push eax
push 0x1003870
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101fd32
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x100462c
call ebx
push dword [ebp - 0x804]
lea eax, [ebp - 0x39c]
push 0x1007cb0
push 0x103
push eax
mov dword [ebp - 0x808], 1
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101ff0a
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
mov ebx, 0x10075c8
push ebx
push dword [ebp - 0x7ec]
mov edi, 0x244
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101fed8
cmp dword [ebp - 0x7f4], 1
jne 0x101fed8
lea eax, [ebp - 0x5e0]
push 0x1001780
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101fed8
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], 1
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101fed8
cmp dword [ebp - 0x7f4], 1
jne 0x101fed8
lea eax, [ebp - 0x5e0]
push eax
call fcn.0101b431
test eax, eax
je 0x101fed8
lea eax, [ebp - 0x5e0]
push 0x1007c58
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101fed8
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
mov dword [ebp - 0x7f0], edi
push esi
mov edi, 0x1007504
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101fed2
cmp dword [ebp - 0x7f4], 1
jne 0x101fed2
lea eax, [ebp - 0x5e0]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x5e0]
push eax
push dword [ebp - 0x7f4]
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x101fed8
mov dword [ebp - 0x808], esi
push ebx
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x808], esi
jne 0x101ff0a
lea eax, [ebp - 0x39c]
push eax
push 0x80000002
call fcn.01017d6c
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret 0x10