Function at 0x101caf9
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push 0x24c
mov eax, 0x1030109
call fcn.0102ada8
xor ebx, ebx
mov dword [ebp - 0x21c], 1
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
push 0xf003f
push 0x1002430
push 0x80000002
lea ecx, [ebp - 0x23c]
mov dword [ebp - 4], ebx
call fcn.0101c571
cmp eax, ebx
je 0x101cb7e
jle 0x101cb53
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10023a0
push ebx
push 0x10
push 0x1035128
call fcn.0102c6ab
add esp, 0x14
lea ecx, [ebp - 0x23c]
call fcn.0101c4fe
mov eax, esi
call fcn.0102ae3a
ret
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x23c]
mov dword [ebp - 0x224], ebx
mov dword [ebp - 0x220], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp eax, ebx
je 0x101cbe6
jle 0x101cbbd
and eax, 0xffff
or eax, 0x80070000
mov esi, eax
push esi
push 0x10022f0
push ebx
push 0x10
push 0x1035128
call fcn.0102c6ab
mov ebx, esi
add esp, 0x14
lea ecx, [ebp - 0x23c]
call fcn.0101c4fe
mov eax, ebx
jmp 0x101cb78
cmp dword [ebp - 0x224], ebx
jne 0x101cc03
push ebx
push 0x1002260
push ebx
push 2
push 0x1035128
call fcn.0102c6ab
jmp 0x101cbd4
inc dword [ebp - 0x220]
mov eax, dword [ebp - 0x220]
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0102a176
pop ecx
mov dword [ebp - 0x230], eax
cmp eax, ebx
jne 0x101cc35
mov ebx, 0x8007000e
jmp 0x101cbd7
mov dword [ebp - 0x228], ebx
cmp dword [ebp - 0x224], ebx
jbe 0x101ce68
mov esi, 0x1035128
push dword [ebp - 0x220]
push dword [ebp - 0x230]
push dword [ebp - 0x228]
push dword [ebp - 0x23c]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, ebx
je 0x101cc97
jle 0x101cc7a
and eax, 0xffff
or eax, 0x80070000
push eax
push 0x10021d8
push ebx
push 0x10
push esi
mov dword [ebp - 0x21c], eax
call fcn.0102c6ab
add esp, 0x14
jmp 0x101ce50
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x240], ebx
push 0x20019
push dword [ebp - 0x230]
lea ecx, [ebp - 0x248]
push dword [ebp - 0x23c]
mov byte [ebp - 4], 1
call fcn.0101c571
cmp eax, ebx
je 0x101ccf0
jle 0x101ccd9
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0x230]
mov dword [ebp - 0x21c], eax
push 0x1002118
jmp 0x101ce36
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push ebx
push eax
mov dword [ebp - 0x22c], ebx
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
push 0x1002100
push dword [ebp - 0x248]
mov dword [ebp - 0x24c], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x101ce18
cmp dword [ebp - 0x22c], 1
jne 0x101ce24
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x258]
push eax
lea eax, [ebp - 0x22c]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x254], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x101cdee
push 4
lea eax, [ebp - 0x250]
push eax
push 4
push ebx
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x23c]
mov dword [ebp - 0x250], 1
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, ebx
jne 0x101cdcd
lea eax, [ebp - 0x218]
push eax
push 0x1002050
jmp 0x101ce0a
jle 0x101cdd9
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
push 0x1001fb8
jmp 0x101ce36
cmp eax, ebx
je 0x101ce42
jle 0x101cdfe
and eax, 0xffff
or eax, 0x80070000
push eax
mov dword [ebp - 0x21c], eax
push 0x1001f10
push ebx
push 0x10
push esi
call fcn.0102c6ab
add esp, 0x14
jmp 0x101ce42
jle 0x101ce24
and eax, 0xffff
or eax, 0x80070000
push eax
push dword [ebp - 0x22c]
mov dword [ebp - 0x21c], eax
push 0x1001e50
push ebx
push 0x10
push esi
call fcn.0102c6ab
add esp, 0x18
lea ecx, [ebp - 0x248]
mov byte [ebp - 4], bl
call fcn.0101c4fe
inc dword [ebp - 0x228]
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp - 0x224]
jb 0x101cc4c
push dword [ebp - 0x230]
call fcn.0102a0f6
mov ebx, dword [ebp - 0x21c]
pop ecx
jmp 0x101cbd7