Function at 0x10003ef0
Capabilities:
Query or enumerate registry value
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1000ad28
mov eax, dword fs:[0]
push eax
sub esp, 0x88
mov eax, dword [0x1000e01c]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push esi
push edi
mov eax, dword [0x1000e01c]
xor eax, esp
push eax
lea eax, [esp + 0x98]
mov dword fs:[0], eax
lea eax, [esp + 0x18]
push eax
xor esi, esi
push 3
push esi
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x44], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10003fba
test byte [0x1000e784], 1
jne 0x10003f8b
or dword [0x1000e784], 1
push 0x1000ad90
mov dword [0x1000e554], 0x1000b78c
mov dword [0x1000e558], 0xffffffff
call fcn.1000a217
add esp, 4
mov esi, dword [0x1000e554]
push 0x161
add esi, 8
call fcn.100036b0
mov ecx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_RegOpenKeyExW_in_UpdateRegistry.
push 0x1000e554
call ecx
add esp, 0xc
xor eax, eax
jmp 0x1000475e
mov ecx, dword [esp + 0x18]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x38]
push eax
push esi
push str.BootExecute
push ecx
call ebx
cmp eax, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
je 0x10004020
cmp eax, 2
jne 0x10004004
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
push edx
push esi
push 7
push esi
push str.BootExecute
push eax
call edi
test eax, eax
jne 0x1000408d
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x14]
push ecx
push esi
lea edx, [esp + 0x38]
push edx
push esi
push str.BootExecute
push eax
call ebx
cmp eax, esi
jne 0x10003fe2
mov eax, dword [esp + 0x14]
push eax
call fcn.1000a108
add esp, 4
lea ecx, [esp + 0x14]
push ecx
mov edi, eax
mov eax, dword [esp + 0x1c]
push edi
lea edx, [esp + 0x38]
push edx
push esi
push str.BootExecute
push eax
call ebx
cmp eax, esi
je 0x100040c6
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
call sym.Comn.dll_GetObjectLog
mov edi, eax
mov esi, dword [edi]
push 0x181
add esi, 8
call fcn.100036b0
mov edx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_RegQueryValueExW_in_UpdateRegistry.
push edi
call edx
add esp, 0xc
xor eax, eax
jmp 0x1000475e
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call sym.Comn.dll_GetObjectLog
mov edi, eax
mov esi, dword [edi]
push 0x16f
add esi, 8
call fcn.100036b0
mov edx, dword [esi]
add esp, 4
push eax
push str._s:_Failed_to_RegSetValueEx_in_UpdateRegistry.
push edi
call edx
add esp, 0xc
xor eax, eax
jmp 0x1000475e
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
push 0x1000bb98
lea ecx, [esp + 0x78]
mov dword [esp + 0xa4], esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
mov byte [esp + 0xa0], 1
xor ebx, ebx
cmp dword [esp + 0x14], esi
jbe 0x1000414b
jmp 0x10004100
movzx ax, byte [ebx + edi]
movzx eax, ax
cmp ax, si
jne 0x10004137
cmp dword [esp + 0x88], esi
je 0x10004126
lea ecx, [esp + 0x74]
push ecx
lea esi, [esp + 0x20]
call fcn.10004c70
xor esi, esi
push 0x1000bb98
lea ecx, [esp + 0x78]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_const__]
jmp 0x10004142
push eax
lea ecx, [esp + 0x78]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_wchar_t_]
add ebx, 2
cmp ebx, dword [esp + 0x14]
jb 0x10004100
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
push str.ddmmain
lea ecx, [esp + 0x5c]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
xor esi, esi
mov byte [esp + 0xa0], 2
mov dword [esp + 0x2c], esi
xor edi, edi
mov ebx, dword [esp + 0x20]
test ebx, ebx
je 0x1000422a
mov ecx, dword [esp + 0x24]
sub ecx, ebx
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp edi, eax
jae 0x1000422a
lea eax, [ebx + esi]
push eax
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
cmp dword [esp + 0x70], 8
mov ecx, dword [esp + 0x5c]
jae 0x100041bd
lea ecx, [esp + 0x5c]
cmp dword [esp + 0x54], 8
mov eax, dword [esp + 0x40]
jae 0x100041d0
lea eax, [esp + 0x40]
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x100041f6
test dx, dx
je 0x100041f2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x100041f6
add eax, 4
add ecx, 4
test dx, dx
jne 0x100041d0
xor eax, eax
jmp 0x100041fb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov byte [esp + 0xa0], 2
lea ecx, [esp + 0x3c]
je 0x1000421c
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add edi, 1
add esi, 0x1c
jmp 0x10004173
mov dword [esp + 0x2c], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [ebp + 8], 0
je 0x100043bb
cmp dword [esp + 0x2c], 0
jne 0x10004349
lea edx, [esp + 0x58]
push edx
lea esi, [esp + 0x20]
call fcn.10004c70
mov edi, dword [esp + 0x20]
cmp edi, dword [esp + 0x24]
jbe 0x1000425d
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea esi, [esp + 0x1c]
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x20], ebx
jbe 0x10004271
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
test esi, esi
je 0x1000427d
lea ecx, [esp + 0x1c]
cmp esi, ecx
je 0x10004283
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp edi, ebx
je 0x100044f9
test esi, esi
jne 0x10004295
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp edi, dword [esi + 8]
jb 0x100042a0
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push edi
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov byte [esp + 0xa0], 5
cmp dword [esp + 0x54], 8
mov eax, dword [esp + 0x40]
jae 0x100042c2
lea eax, [esp + 0x40]
push str.autocheck
push eax
call dword [sym.imp.ntdll.dll_wcsstr]
add esp, 8
test eax, eax
je 0x100044d4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], esi
lea esi, [edi + 0x1c]
cmp esi, eax
mov dword [esp + 0x38], edi
mov ebx, eax
je 0x10004305
sub edi, esi
push esi
lea ecx, [esi + edi]
call dword [sym.imp.MSVCP80.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
add esi, 0x1c
cmp esi, ebx
jne 0x100042f0
mov eax, dword [esp + 0x24]
lea esi, [eax - 0x1c]
cmp esi, eax
mov edi, eax
je 0x10004323
mov edi, edi
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x10004310
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x38]
sub eax, 0x1c
lea ecx, [esp + 0x3c]
mov dword [esp + 0x24], eax
mov byte [esp + 0xa0], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x10004261
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x58]
mov byte [esp + 0xa0], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x74]
mov byte [esp + 0xa0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [esp + 0xa0], 0xffffffff
mov eax, dword [esp + 0x20]
test eax, eax
je 0x100043b1
mov edi, dword [esp + 0x24]
cmp eax, edi
mov esi, eax
je 0x100043a8
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x10004395
mov eax, dword [esp + 0x20]
push eax
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, 1
jmp 0x1000475e
cmp dword [esp + 0x2c], 0
je 0x1000424d
mov edi, dword [esp + 0x20]
cmp edi, dword [esp + 0x24]
jbe 0x100043d6
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea ebx, [esp + 0x1c]
mov esi, edi
lea esp, [esp]
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x20], edi
jbe 0x100043f0
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
test ebx, ebx
je 0x100043fc
lea ecx, [esp + 0x1c]
cmp ebx, ecx
je 0x10004402
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, edi
je 0x1000424d
test ebx, ebx
jne 0x10004414
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp esi, dword [ebx + 8]
jb 0x1000441f
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
push esi
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov byte [esp + 0xa0], 4
mov ecx, dword [esp + 0x5c]
mov eax, 8
cmp dword [esp + 0x70], eax
jae 0x10004445
lea ecx, [esp + 0x5c]
cmp dword [esp + 0x54], eax
mov eax, dword [esp + 0x40]
jae 0x10004453
lea eax, [esp + 0x40]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10004479
test dx, dx
je 0x10004475
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10004479
add eax, 4
add ecx, 4
test dx, dx
jne 0x10004453
xor eax, eax
jmp 0x1000447e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x100044af
push esi
push ebx
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
call fcn.10004d20
mov ebx, dword [eax]
mov esi, dword [eax + 4]
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa0], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x100043e0
cmp esi, dword [ebx + 8]
jb 0x100044ba
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea ecx, [esp + 0x3c]
add esi, 0x1c
mov byte [esp + 0xa0], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x100043e0
cmp edi, dword [esi + 8]
jb 0x100044df
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
lea ecx, [esp + 0x3c]
add edi, 0x1c
mov byte [esp + 0xa0], 2
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
jmp 0x10004261
xor edi, edi
mov dword [esp + 0x14], edi
xor esi, esi
cmp dword [esp + 0x20], 0
je 0x1000455a
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x1000455a
mov edx, dword [esp + 0x20]
add edx, edi
push edx
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
lea edx, [eax + ecx + 1]
lea ecx, [esp + 0x3c]
mov dword [esp + 0x14], edx
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 1
add edi, 0x1c
jmp 0x10004501
mov eax, dword [esp + 0x14]
add eax, eax
push eax
mov dword [esp + 0x18], eax
call fcn.1000a108
mov ecx, dword [esp + 0x18]
add esp, 4
push ecx
push 0
push eax
mov dword [esp + 0x40], eax
call sub.ntdll.dll_memset
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
add esp, 0xc
xor edi, edi
test esi, esi
jne 0x10004593
xor eax, eax
jmp 0x100045aa
mov ebx, ecx
sub ebx, esi
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
lea ebx, [eax - 1]
test ebx, ebx
jl 0x1000465c
lea eax, [ebx*8]
sub eax, ebx
add eax, eax
add eax, eax
mov dword [esp + 0x2c], eax
jmp 0x100045d8
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x20]
test esi, esi
je 0x100045f5
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp ebx, eax
jb 0x100045ff
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x2c]
add esi, edx
push esi
lea ecx, [esp + 0x40]
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
cmp dword [esp + 0x54], 8
mov edx, dword [esp + 0x40]
jae 0x1000461f
lea edx, [esp + 0x40]
mov esi, dword [esp + 0x34]
lea ecx, [esi + edi*2]
movzx eax, word [edx]
mov word [ecx], ax
add edx, 2
add ecx, 2
test ax, ax
jne 0x10004626
add edi, dword [esp + 0x50]
lea ecx, [esp + 0x3c]
mov word [esi + edi*2], ax
add edi, 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
sub dword [esp + 0x2c], 0x1c
sub ebx, 1
test ebx, ebx
jge 0x100045d0
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
push eax
push edi
push ecx
push 0
push str.BootExecute
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.MSVCR80.dll_void___cdecl_operator_delete___void__
add esp, 4
test esi, esi
je 0x100046f6
lea ecx, [esp + 0x58]
mov byte [esp + 0xa0], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x74]
mov byte [esp + 0xa0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [esp + 0xa0], 0xffffffff
mov esi, dword [esp + 0x20]
test esi, esi
je 0x100046f2
mov edi, dword [esp + 0x24]
cmp esi, edi
je 0x100046e9
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x100046d6
mov esi, dword [esp + 0x20]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
jmp 0x1000475e
call fcn.10004790
lea ecx, [esp + 0x58]
mov ebx, eax
mov byte [esp + 0xa0], 1
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
lea ecx, [esp + 0x74]
mov byte [esp + 0xa0], 0
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov dword [esp + 0xa0], 0xffffffff
mov esi, dword [esp + 0x20]
test esi, esi
je 0x1000475c
mov edi, dword [esp + 0x24]
cmp esi, edi
je 0x10004753
lea esp, [esp]
mov ecx, esi
call dword [sym.imp.MSVCP80.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
add esi, 0x1c
cmp esi, edi
jne 0x10004740
mov esi, dword [esp + 0x20]
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x98]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x80]
xor ecx, esp
call fcn.1000a10d
mov esp, ebp
pop ebp
ret 4