Function at 0x10034c6
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x45c
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x100700c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x454], ecx
xor esi, esi
lea ecx, [ebp - 0x450]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x42c]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
push esi
inc ebx
push eax
mov dword [ebp - 0x448], eax
mov dword [ebp - 0x428], esi
mov dword [ebp - 0x440], ebx
mov dword [ebp - 0x42c], 0x104
call edi
cmp eax, esi
mov dword [ebp - 0x430], ebx
jne 0x100373b
mov ebx, 0x100167c
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x45c]
push eax
call dword [sym.imp.ntdll.dll_RtlGUIDFromString]
cmp eax, esi
jge 0x1003579
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1001620
jmp 0x10035b0
lea eax, [ebp - 0x428]
push eax
call fcn.010023ea
or eax, 0x2001f
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x448]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x10035bd
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x10015d0
call fcn.01002a73
add esp, 0xc
jmp 0x10036fd
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x434]
push eax
push esi
push ebx
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10035f7
cmp dword [ebp - 0x434], 3
je 0x1003663
mov ecx, dword [ebp - 0x44c]
mov eax, dword [ebp - 0x450]
push ecx
push eax
mov dword [ebp - 0x43c], eax
lea eax, [ebp - 0x20c]
push eax
push 0x1001594
mov dword [ebp - 0x438], ecx
call fcn.01002a73
add esp, 0x10
push 8
lea eax, [ebp - 0x43c]
push eax
push 3
push esi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, esi
je 0x1003663
push eax
push dword [ebp - 0x438]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x43c]
push eax
push 0x1001520
call fcn.01002a73
add esp, 0x14
lea eax, [ebp - 0x414]
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x434]
push eax
push esi
push 0x1001230
push dword [ebp - 0x428]
mov dword [ebp - 0x42c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x10036ad
cmp dword [ebp - 0x434], 1
je 0x10036c8
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x10014c8
call fcn.01002a73
add esp, 0xc
mov dword [ebp - 0x444], esi
push dword [ebp - 0x444]
lea eax, [ebp - 0x43c]
push eax
lea eax, [ebp - 0x424]
push eax
push dword [ebp - 0x454]
call fcn.01003327
test eax, eax
je 0x1003758
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x428], esi
lea eax, [ebp - 0x450]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x430]
mov dword [ebp - 0x42c], 0x104
push dword [ebp - 0x448]
call edi
inc dword [ebp - 0x430]
cmp eax, esi
je 0x100353e
cmp eax, 0x103
je 0x100375e
push eax
push dword [ebp - 0x430]
push 0x1001460
call fcn.01002a73
add esp, 0xc
jmp 0x100375e
mov dword [ebp - 0x440], esi
cmp dword [ebp - 0x428], esi
pop edi
pop esi
pop ebx
je 0x1003775
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x440]
call fcn.01005b2e
leave
ret 8