Function at 0x1004473
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x3d84
call fcn.010095d0
mov eax, dword [0x100bffc]
push ebx
push esi
push edi
push 7
pop ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x3d5c]
push eax
mov esi, 0x10013b0
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0xf003f
xor esi, esi
push esi
push 0x1001250
push 0x80000001
mov dword [ebp - 0x3d68], esi
xor ebx, ebx
call edi
test eax, eax
jne 0x1004774
lea eax, [ebp - 0x3d74]
push eax
lea eax, [ebp - 0x438]
push eax
push esi
push dword [ebp - 0x3d5c]
mov dword [ebp - 0x3d74], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x10044fb
mov word [ebp - 0x438], si
lea eax, [ebp - 0x3d74]
push eax
lea eax, [ebp - 0x3d60]
push eax
lea eax, [ebp - 0x3d84]
push eax
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x3d5c]
mov dword [ebp - 0x3d74], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1004555
push 4
lea eax, [ebp - 0x3d60]
push eax
push 4
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x3d5c]
mov dword [ebp - 0x3d60], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 0x3d64]
push eax
push 0xf003f
push esi
push 0x100127c
push dword [ebp - 0x3d5c]
call edi
test eax, eax
jne 0x1004768
lea eax, [ebp - 0x3d7c]
push eax
push 0x20019
push esi
push 0x1001290
push 0x80000002
call edi
test eax, eax
jne 0x100475c
lea eax, [ebp - 0x3d78]
push eax
lea eax, [ebp - 0x20c8]
push eax
push esi
push esi
lea eax, [ebp - 0x3d70]
push eax
lea eax, [ebp - 0x22c]
push eax
push esi
push dword [ebp - 0x3d64]
mov dword [ebp - 0x3d6c], esi
mov dword [ebp - 0x3d70], 0x105
mov dword [ebp - 0x3d78], 0x1c8e
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1004750
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
inc dword [ebp - 0x3d6c]
lea eax, [ebp - 0x3d80]
push eax
lea eax, [ebp - 0x3d58]
push eax
push esi
push esi
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x3d7c]
mov dword [ebp - 0x3d80], 0x1c8e
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10046c3
lea eax, [ebp - 0x3d58]
push eax
lea eax, [ebp - 0x20c8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x10046c3
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1004680
push 4
lea eax, [ebp - 0x3d60]
push eax
push 4
push esi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x3d5c]
mov dword [ebp - 0x3d60], 2
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 8
push esi
call edi
cmp ebx, esi
jne 0x100469b
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x3d68], ebx
je 0x1004750
jmp 0x10046a4
mov dword [ebx + 4], eax
mov ebx, eax
cmp ebx, esi
je 0x100470f
push 0x20a
push esi
mov dword [ebx + 4], esi
call edi
cmp eax, esi
mov dword [ebx], eax
je 0x100470f
lea ecx, [ebp - 0x22c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x3d78]
push eax
lea eax, [ebp - 0x20c8]
push eax
push esi
push esi
lea eax, [ebp - 0x3d70]
push eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x3d6c]
mov dword [ebp - 0x3d70], 0x105
push dword [ebp - 0x3d64]
mov dword [ebp - 0x3d78], 0x1c8e
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x10045eb
mov edi, dword [ebp - 0x3d68]
cmp edi, esi
je 0x1004750
mov ebx, dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1004727
mov edi, dword [ebp - 0x3d68]
mov eax, dword [edi]
cmp eax, esi
je 0x100473e
push eax
push dword [ebp - 0x3d64]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [edi]
call ebx
mov eax, edi
mov edi, dword [edi + 4]
push eax
mov dword [ebp - 0x3d68], edi
call ebx
cmp edi, esi
jne 0x1004721
push dword [ebp - 0x3d7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x3d64]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x3d5c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.01009336
leave
ret