Function at 0x1008af1
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x101203c]
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x34], bl
lea edi, [ebp - 0x33]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp dword [ebp + 8], ebx
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
stosb byte es:[edi], al
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], ebx
je 0x1008bcb
mov eax, dword [0x1016c8c]
dec eax
je 0x1008b4f
dec eax
jne 0x1008d88
mov esi, 0x10059f8
jmp 0x1008b54
mov esi, 0x10059d0
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1008d88
push 0x14
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.0100c74b
test eax, eax
jne 0x1008bae
push ebx
push 0x30
push 0x406
push ebx
call fcn.0100cc77
mov esi, 0x1005208
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
jmp 0x1008bbe
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push ebx
push 0x1004fbc
jmp 0x1008d76
lea eax, [ebp - 0x4c]
push eax
push 1
push ebx
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x14
pop esi
jne 0x1008c9b
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x1004fcc
push dword [ebp - 0x4c]
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0100870b
test eax, eax
jne 0x1008c36
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0100c580
lea eax, [ebp - 0xc]
push eax
call fcn.0100c53a
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], ebx
jne 0x1008c47
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.0100880c
jmp 0x1008c8d
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push 0x1004fbc
push dword [ebp - 0x4c]
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.0100870b
test eax, eax
jne 0x1008c90
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0100c580
lea eax, [ebp - 0xc]
push eax
call fcn.0100c53a
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008ca8
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.0100880c
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [0x1016be0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1008d88
cmp dword [ebp - 0x50], 6
je 0x1008d7f
cmp dword [ebp - 0x50], 4
jne 0x1008d4e
push 4
lea eax, [ebp - 0x50]
push eax
push 4
push ebx
push 0x1004fc4
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x60], ebx
je 0x1008d00
lea esi, [ebp - 0x20]
jmp 0x1008d64
lea eax, [ebp - 0x5c]
push eax
push 1
push ebx
push 0x1005234
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1008d61
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x1004fcc
push dword [ebp - 0x5c]
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.0100870b
push dword [ebp - 0x5c]
lea esi, [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1008d64
push 0x1004fc4
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea esi, [ebp - 0x34]
jmp 0x1008d64
mov esi, dword [ebp - 0x64]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebx
push 0x1004fcc
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d058
leave
ret 4