Function at 0x10022f70
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8e0
mov eax, dword [0x100416e4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, edx
mov dword [ebp - 0x8cc], 0
mov edi, ecx
mov dword [ebp - 0x8e0], 4
mov dword [ebp - 0x8d4], 4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x8d8], eax
call fcn.10022c70
mov eax, dword [edi + 0xac]
movzx ecx, byte [edi + 0xa9]
push dword [eax + ecx*4 + 0x4c]
lea eax, [ebp - 0x468]
push edi
push dword [edi + 0x118]
push dword [ebp - 0x8d8]
push 0x10003730
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x468]
push eax
push 0x100036ec
push 0x12b
lea eax, [ebp - 0x8c8]
push 0x12c
push eax
call dword [sym.imp.msvcrt.dll__snwprintf_s]
add esp, 0x14
test eax, eax
jns 0x100230d7
xor eax, eax
push 0x104
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push eax
push 0xb3b0
push dword [0x10043578]
call dword [sym.imp.USER32.dll_LoadStringW]
cmp word [ebp - 0x210], 0
jne 0x10023078
mov esi, dword [0x1004338c]
lea eax, [ebp - 0x210]
push 0x104
push eax
push 0xb3b0
mov ecx, esi
call dword [0x10044350]
call esi
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x670]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll_swprintf_s]
add esp, 0x10
lea eax, [edi + 0x6c]
lea edx, [ebp - 0x670]
mov ecx, 0x3f
push 0
push 0
push 0xfffffffffffffffe
push 0xfffffffffffffffe
push 0xa410
push 0xa4d8
push eax
push dword [edi + 0x7c]
call fcn.1001a230
or eax, 0xffffffff
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8dc]
push eax
push esi
push 0
push 0xf003f
push 1
push 0x100039f0
push 0
lea eax, [ebp - 0x8c8]
push eax
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x10023124
push 0
lea edx, [ebp - 0x468]
mov ecx, edi
call fcn.10022b80
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x8d4]
or dword [edi + 0x5c], 0x8000
lea eax, [ebp - 0x8d8]
push eax
push 4
push 0
push 0x1000380c
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1002316c
push 1
lea edx, [ebp - 0x468]
mov ecx, edi
call fcn.10022b80
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x8dc]
push eax
lea eax, [ebp - 0x8d0]
push eax
push 0
push 0xf003f
push 1
push 0x10003a00
push 0
push 0x100037c0
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10023204
lea eax, [ebp - 0x8d4]
push eax
lea eax, [ebp - 0x8cc]
push eax
lea eax, [ebp - 0x8e0]
push eax
push 0
push 0x10003820
push dword [ebp - 0x8d0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
inc dword [ebp - 0x8cc]
lea eax, [ebp - 0x8cc]
push 4
push eax
push 4
push 0
push 0x10003820
push dword [ebp - 0x8d0]
mov dword [ebp - 0x8d4], 4
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x8d0]
test eax, eax
je 0x10023222
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
mov edx, 0x100037c0
mov ecx, edi
call fcn.10022b80
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003bd00
mov esp, ebp
pop ebp
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.1003bd00
mov esp, ebp
pop ebp
ret