Function at 0x1000eb20
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x38
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0
push eax
push 0x2001b
push 0
push str.SOFTWAREDownloadManager
push reloc.WS2_32.dll_accept
mov bl, cl
mov dword [esp + 0x34], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x1000edb7
push 0
lea eax, [esp + 0x24]
push eax
push 0
push 0x2001b
push 0
push 0
push 0
push str.ConfigTime
push dword [esp + 0x38]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x1000edb7
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 4
push eax
lea eax, [esp + 0x18]
push eax
push esi
push esi
push str.RecordTraffic
push dword [esp + 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 0x14]
test bl, bl
je 0x1000ebc9
mov ecx, eax
jmp 0x1000ebd0
xor ecx, ecx
test eax, eax
sete cl
test ecx, ecx
je 0x1000ebeb
xor ecx, ecx
mov esi, 0x426
test bl, bl
cmovne esi, ecx
jne 0x1000ede6
jmp 0x1000edbb
push 4
movzx eax, bl
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
push 4
push 0
push str.RecordTraffic
push dword [esp + 0x2c]
call edi
mov esi, eax
test esi, esi
jne 0x1000edb7
push eax
call dword [sym.imp.msvcrt.dll__time64]
add esp, 4
mov dword [esp + 0x24], eax
lea eax, [esp + 0x24]
push 4
push eax
push 4
push esi
push esi
push dword [esp + 0x34]
call edi
mov esi, eax
test esi, esi
jne 0x1000edb7
test bl, bl
jne 0x1000edb3
mov ebp, dword [esp + 0x4c]
test ebp, ebp
je 0x1000edb3
push 0x20a
lea ecx, [esp + 0x2c]
mov dword [esp + 0x2c], 0x1005bdb0
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov word [esp + 0x38], 0x1ff
call fcn.100049c0
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x1c]
mov ebx, dword [esp + 0x30]
push eax
push edi
push esi
push esi
push str.AppDataIDMFolder
push dword [esp + 0x2c]
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x1000ecbb
cmp edi, 0x1005bdb0
je 0x1000ede6
lea eax, [edi - 4]
push eax
call dword [sym.imp.msvcrt.dll_free]
add esp, 4
jmp 0x1000ede6
mov ecx, dword [esp + 0x1c]
shr ecx, 1
test ebx, ebx
je 0x1000ecd1
lea eax, [ebx - 1]
shr eax, 1
cmp ecx, eax
cmovb eax, ecx
jmp 0x1000ecd3
xor eax, eax
push eax
push edi
call fcn.100014c8
xor ecx, ecx
mov dword [esp + 0x34], eax
push 0x3a
mov word [esp + 0x50], 0xff
mov word [edi + eax*2], cx
mov dword [esp + 0x4c], 0x36
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
add esp, 0xc
test esi, esi
je 0x1000ed07
add esi, 4
mov edi, dword [sym.imp.msvcrt.dll_free]
lea edx, [esp + 0x38]
mov dword [esp + 0x38], esi
lea ecx, [esp + 0x28]
test esi, esi
je 0x1000ed74
xor eax, eax
mov dword [esp + 0x3c], 0xb
mov word [esi + 0x16], ax
mov eax, dword [str.Traffic.log]
mov dword [esi], eax
mov eax, dword [0x10055b28]
mov dword [esi + 4], eax
mov eax, dword [0x10055b2c]
mov dword [esi + 8], eax
mov eax, dword [0x10055b30]
mov dword [esi + 0xc], eax
mov eax, dword [0x10055b34]
mov dword [esi + 0x10], eax
mov ax, word [0x10055b38]
mov word [esi + 0x14], ax
call fcn.1000a630
cmp esi, 0x1005bdb0
je 0x1000ed91
lea eax, [esi - 4]
push eax
call edi
add esp, 4
jmp 0x1000ed91
mov dword [esp + 0x38], 0x1005bdb0
mov dword [esp + 0x40], 0
mov dword [esp + 0x3c], 0
call fcn.1000a630
push 0
lea ecx, [esp + 0x2c]
call fcn.10004ff0
mov dword [ebp], eax
mov eax, dword [esp + 0x28]
cmp eax, 0x1005bdb0
je 0x1000edb3
add eax, 0xfffffffc
push eax
call edi
add esp, 4
xor esi, esi
jmp 0x1000ede6
mov eax, dword [esp + 0x14]
test bl, bl
je 0x1000ede6
test eax, eax
je 0x1000ede6
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000ede6
push 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
push ecx
push 4
push 0
push str.RecordTraffic
push eax
call edi
mov eax, dword [esp + 0x20]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1000edf7
push eax
call edi
mov eax, dword [esp + 0x18]
test eax, eax
je 0x1000ee02
push eax
call edi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x38
ret