Function at 0x1008f8c
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x101200c]
mov dword [ebp - 4], eax
xor eax, eax
push ebx
push esi
push edi
xor ebx, ebx
mov byte [ebp - 0x34], bl
lea edi, [ebp - 0x33]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
cmp dword [ebp + 8], ebx
mov byte [ebp - 0x20], bl
lea edi, [ebp - 0x1f]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
push 7
stosb byte es:[edi], al
pop eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x60], ebx
je 0x1009066
mov eax, dword [0x1016c6c]
dec eax
je 0x1008fea
dec eax
jne 0x1009223
mov esi, 0x1005a04
jmp 0x1008fef
mov esi, 0x10059dc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [0x1016bc0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1009223
push 0x14
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.0100cc15
test eax, eax
jne 0x1009049
push ebx
push 0x30
push 0x406
push ebx
call fcn.0100d141
mov esi, 0x1005214
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
jmp 0x1009059
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x48]
push eax
push 1
push ebx
push 0x1004fd0
jmp 0x1009211
lea eax, [ebp - 0x4c]
push eax
push 1
push ebx
push dword [0x1016bc0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x14
pop esi
jne 0x1009136
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x1004fe0
push dword [ebp - 0x4c]
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.01008ba6
test eax, eax
jne 0x10090d1
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.0100ca44
lea eax, [ebp - 0xc]
push eax
call fcn.0100c9fe
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], ebx
jne 0x10090e2
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.01008ca7
jmp 0x1009128
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
push ebx
push ebx
push 0x1004fd0
push dword [ebp - 0x4c]
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x50]
push eax
call fcn.01008ba6
test eax, eax
jne 0x100912b
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0100ca44
lea eax, [ebp - 0xc]
push eax
call fcn.0100c9fe
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1009143
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.01008ca7
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x4c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push dword [0x1016bc0]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1009223
cmp dword [ebp - 0x50], 6
je 0x100921a
cmp dword [ebp - 0x50], 4
jne 0x10091e9
push 4
lea eax, [ebp - 0x50]
push eax
push 4
push ebx
push 0x1004fd8
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 0x60], ebx
je 0x100919b
lea esi, [ebp - 0x20]
jmp 0x10091ff
lea eax, [ebp - 0x5c]
push eax
push 1
push ebx
push 0x1005240
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10091fc
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 0x1004fe0
push dword [ebp - 0x5c]
mov dword [ebp - 0x54], esi
call edi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.01008ba6
push dword [ebp - 0x5c]
lea esi, [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10091ff
push 0x1004fd8
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
lea esi, [ebp - 0x34]
jmp 0x10091ff
mov esi, dword [ebp - 0x64]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push ebx
push 0x1004fe0
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x4c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0100d528
leave
ret 4