Function at 0x1039fe7
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
xor edi, edi
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x428], edi
mov dword [ebp - 0x430], edi
mov dword [ebp - 0x434], edi
cmp dword [ebp - 0x434], edi
jne 0x103a034
mov dword [ebp - 0x42c], edi
mov eax, 0x100baa8
jmp 0x103a043
mov dword [ebp - 0x42c], 1
mov eax, 0x10041e8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push edi
lea ecx, [ebp - 0x430]
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
push 0x80000002
call ebx
test eax, eax
jne 0x103b41b
cmp dword [ebp - 0x42c], edi
je 0x103a0f6
push 0x103
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.010302a3
test eax, eax
je 0x103a0f6
lea eax, [ebp - 0x414]
push eax
call fcn.0102e61a
push 0x1002774
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.01027edd
test eax, eax
jl 0x103a0f6
lea eax, [ebp - 0x414]
push eax
call fcn.0102e8b9
test eax, eax
je 0x103a0f6
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103a0cc
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push edi
push 0x1004238
push dword [ebp - 0x430]
call esi
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x10042dc
push dword [ebp - 0x430]
call ebx
test eax, eax
jne 0x103a76c
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebx + 0x103f0f0]
cmp eax, edi
je 0x103a74b
cmp dword [ebp - 0x42c], edi
jne 0x103a146
cmp dword [ebx + 0x103f130], edi
je 0x103a74b
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x103a74b
lea eax, [ebp - 0x20c]
push 0x100baa4
mov dword [ebp - 0x420], eax
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
mov dword [ebp - 0x424], eax
pop ecx
cmp eax, edi
je 0x103a196
mov ecx, dword [ebp - 0x424]
xor eax, eax
add dword [ebp - 0x424], 2
mov word [ecx], ax
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [ebp - 0x420]
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103a70c
mov ecx, dword [ebx + 0x103f0f4]
cmp ecx, edi
je 0x103a1fe
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x420], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a1d6
sub eax, dword [ebp - 0x420]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x10042a0
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x42c], edi
je 0x103a22a
lea eax, [ebx + 0x103f138]
mov ecx, dword [eax]
cmp ecx, edi
je 0x103a22a
cmp ecx, 0xffffffff
je 0x103a22a
push 4
push eax
push 4
push edi
push 0x100ba94
push dword [ebp - 0x418]
call esi
lea eax, [ebx + 0x103f13c]
mov ecx, dword [eax]
cmp ecx, edi
je 0x103a24e
cmp ecx, 0xffffffff
je 0x103a24e
push 4
push eax
push 4
push edi
push 0x100ba7c
push dword [ebp - 0x418]
call esi
mov ecx, dword [ebx + 0x103f140]
cmp ecx, edi
je 0x103a28b
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x420], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a263
sub eax, dword [ebp - 0x420]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1006dd0
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 0x103f0f8]
cmp eax, edi
je 0x103a343
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103a343
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103a2c3
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008e88
push dword [ebp - 0x418]
call esi
push dword [ebx + 0x103f0f8]
lea eax, [ebp - 0x20c]
push 0x1005850
push 0x103
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x103a343
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103a319
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008e58
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x42c], edi
je 0x103a3a5
mov eax, dword [ebx + 0x103f134]
cmp eax, edi
je 0x103a3de
push edi
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103a3de
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103a379
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008eb4
push dword [ebp - 0x418]
call esi
jmp 0x103a3de
mov ecx, dword [ebx + 0x103f0fc]
cmp ecx, edi
je 0x103a3de
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a3b4
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008eb4
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
mov ecx, dword [ebx + 0x103f100]
cmp ecx, edi
je 0x103a419
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a3ed
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008e30
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
jmp 0x103a42a
push 0x1008e30
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x42c], edi
je 0x103a46d
mov ecx, dword [ebx + 0x103f108]
cmp ecx, edi
je 0x103a4a8
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a441
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
jmp 0x103a4bf
mov ecx, dword [ebx + 0x103f104]
cmp ecx, edi
je 0x103a4a8
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a47c
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
jmp 0x103a4c7
push 8
push 0x1006658
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x42c], edi
jne 0x103a4de
push 0x1a
push 0x1002774
push 1
push edi
push 0x1006660
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 0x103f10c]
cmp eax, edi
je 0x103a54e
push 0x1006d54
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x103a513
push 0x14
push 0x1006d94
push 1
push edi
push 0x1008ef4
push dword [ebp - 0x418]
call esi
jmp 0x103a54e
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 0x103f10c]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a524
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008ef4
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
mov ecx, dword [ebx + 0x103f120]
cmp ecx, edi
je 0x103a587
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a55d
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1001b94
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
mov ecx, dword [ebx + 0x103f110]
cmp ecx, edi
je 0x103a5c4
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x420], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a59c
sub eax, dword [ebp - 0x420]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008d6c
push dword [ebp - 0x418]
call esi
mov ecx, dword [ebx + 0x103f114]
cmp ecx, edi
je 0x103a601
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x420], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a5d9
sub eax, dword [ebp - 0x420]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x100ba54
push dword [ebp - 0x418]
call esi
mov ecx, dword [ebx + 0x103f11c]
cmp ecx, edi
je 0x103a63e
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x420], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a616
sub eax, dword [ebp - 0x420]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008e0c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 0x103f118]
cmp eax, edi
je 0x103a698
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103a698
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103a66e
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100ba20
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 0x103f12c]
cmp eax, edi
je 0x103a6ef
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103a700
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103a6c3
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008f0c
push dword [ebp - 0x418]
call esi
jmp 0x103a700
push 0x1008f0c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebx + 0x103f0f0]
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x420], eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x103a74b
cmp dword [ebp - 0x424], edi
je 0x103a74b
push 0x100baa4
push dword [ebp - 0x424]
jmp 0x103a172
add ebx, 0x54
mov dword [ebp - 0x41c], ebx
cmp ebx, 0xb7c
jb 0x103a124
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1008d3c
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103aae4
xor ebx, ebx
mov dword [ebp - 0x424], ebx
mov eax, dword [ebx + 0x103ff68]
cmp eax, edi
je 0x103aac3
cmp dword [ebp - 0x42c], edi
jne 0x103a7c0
cmp dword [ebx + 0x103ff8c], edi
je 0x103aac3
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x103aac3
lea eax, [ebp - 0x20c]
push 0x100baa4
mov dword [ebp - 0x420], eax
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
mov dword [ebp - 0x41c], eax
pop ecx
cmp eax, edi
je 0x103a810
mov ecx, dword [ebp - 0x41c]
xor eax, eax
add dword [ebp - 0x41c], 2
mov word [ecx], ax
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push dword [ebp - 0x420]
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103aa84
mov ecx, dword [ebx + 0x103ff6c]
cmp ecx, edi
je 0x103a878
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x420], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a850
sub eax, dword [ebp - 0x420]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008f64
push dword [ebp - 0x418]
call esi
mov ecx, dword [ebx + 0x103ff70]
cmp ecx, edi
je 0x103a8b5
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0x420], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a88d
sub eax, dword [ebp - 0x420]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008f3c
push dword [ebp - 0x418]
call esi
mov ecx, dword [ebx + 0x103ff74]
cmp ecx, edi
je 0x103a8ee
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a8c4
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008f8c
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x424]
cmp dword [ebp - 0x42c], edi
je 0x103a938
mov ecx, dword [ebx + 0x103ff80]
cmp ecx, edi
je 0x103aa03
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a909
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x424]
jmp 0x103aa1a
mov ecx, dword [ebx + 0x103ff7c]
cmp ecx, edi
je 0x103aa03
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a94b
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
mov ecx, dword [0x103f014]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103a97a
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1001b94
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x424]
mov eax, dword [ebx + 0x103ff84]
cmp eax, edi
je 0x103aa48
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103aa59
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103a9d7
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008f0c
push dword [ebp - 0x418]
call esi
jmp 0x103aa59
push 8
push 0x1006658
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x42c], edi
je 0x103a96f
mov ecx, dword [ebx + 0x103ff78]
cmp ecx, edi
je 0x103a9a4
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103aa39
jmp 0x103a984
push 0x1008f0c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebx + 0x103ff88], edi
jne 0x103aa78
push 6
push 0x100ba18
push 1
push edi
push 0x100ba04
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebx + 0x103ff68]
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0x420], eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x103aac3
cmp dword [ebp - 0x41c], edi
je 0x103aac3
push 0x100baa4
push dword [ebp - 0x41c]
jmp 0x103a7ec
add ebx, 0x28
mov dword [ebp - 0x424], ebx
cmp ebx, 0x488
jb 0x103a79e
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1008d28
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ad12
mov eax, dword [0x103fc6c]
cmp eax, edi
je 0x103ad06
cmp dword [ebp - 0x42c], edi
jne 0x103ab2f
cmp dword [0x103fc7c], edi
je 0x103ad06
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x103ad06
lea ebx, [ebp - 0x20c]
push 0x100baa4
mov eax, ebx
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
mov dword [ebp - 0x41c], eax
pop ecx
cmp eax, edi
je 0x103ab7b
mov ecx, dword [ebp - 0x41c]
xor eax, eax
add dword [ebp - 0x41c], 2
mov word [ecx], ax
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push ebx
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103acd6
mov edx, dword [0x103fc70]
cmp edx, edi
je 0x103abd4
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103abb0
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push edi
push 0x1008fcc
push dword [ebp - 0x418]
call esi
mov edx, dword [0x103fc74]
cmp edx, edi
je 0x103ac07
mov eax, edx
lea ebx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103abe3
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push edi
push 0x10068cc
push dword [ebp - 0x418]
call esi
mov eax, dword [0x103fc78]
cmp eax, edi
je 0x103ac5d
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103ac6e
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103ac31
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008f0c
push dword [ebp - 0x418]
call esi
jmp 0x103ac6e
push 0x1008f0c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x42c], edi
je 0x103acca
mov eax, dword [0x103fc84]
cmp eax, edi
je 0x103acca
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103acca
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103aca0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1003784
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x103fc6c]
mov ebx, dword [ebp - 0x41c]
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01027e68
test eax, eax
jl 0x103ad06
cmp ebx, edi
je 0x103ad06
push 0x100baa4
push ebx
jmp 0x103ab57
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x1008d18
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103af1b
xor ebx, ebx
mov dword [ebp - 0x420], ebx
mov eax, dword [ebx + 0x103fc88]
cmp eax, edi
je 0x103aefd
cmp dword [ebp - 0x42c], edi
jne 0x103ad66
cmp dword [ebx + 0x103fc9c], edi
je 0x103aefd
push edi
lea ecx, [ebp - 0x418]
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103aefd
mov eax, dword [ebx + 0x103fc8c]
cmp eax, edi
je 0x103ade2
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103ade2
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103adbc
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 0x103fc90]
cmp eax, edi
je 0x103ae37
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103ae37
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103ae0d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1006474
push dword [ebp - 0x418]
call esi
mov ecx, dword [ebx + 0x103fc94]
cmp ecx, edi
je 0x103ae72
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103ae46
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x420]
jmp 0x103ae89
push 8
push 0x1006658
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 0x103fc98]
cmp eax, edi
je 0x103aee0
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103aef1
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103aeb4
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008f0c
push dword [ebp - 0x418]
call esi
jmp 0x103aef1
push 0x1008f0c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 0x18
mov dword [ebp - 0x420], ebx
cmp ebx, 0x30
jb 0x103ad44
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x428]
push eax
push edi
push 0x20006
push edi
push edi
push edi
push 0x100b9f4
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b40f
xor ebx, ebx
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebx + 0x103fcb8]
cmp eax, edi
je 0x103b3ee
cmp dword [ebp - 0x42c], edi
jne 0x103af6f
cmp dword [ebx + 0x103fcd8], edi
je 0x103b3ee
push edi
lea ecx, [ebp - 0x418]
push ecx
push edi
push 0x20006
push edi
push edi
push edi
push eax
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b3ee
mov eax, dword [ebx + 0x103fcbc]
cmp eax, edi
je 0x103b0c0
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103b0c0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103afcd
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x418]
call esi
push 0x40
pop eax
mov word [ebp - 0x20c], ax
push 0x103
lea eax, [ebp - 0x20a]
push eax
call fcn.0102fc69
test eax, eax
je 0x103b0c0
push 0x1008e50
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x103b0c0
lea eax, [ebp - 0x20c]
push 0x2d
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
cmp eax, edi
je 0x103b0c0
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov dword [ebp - 0x420], edx
mov dx, word [ecx]
inc ecx
inc ecx
cmp dx, di
jne 0x103b058
sub ecx, dword [ebp - 0x420]
push dword [ebx + 0x103fcbc]
sar ecx, 1
mov edx, 0x103
push 0x1005850
sub edx, ecx
push edx
add eax, 2
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x103b0c0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b096
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100b9d0
push dword [ebp - 0x418]
call esi
mov eax, dword [ebx + 0x103fcc0]
cmp eax, edi
je 0x103b22e
push 0x452
push 0xa28
push 1
push 5
mov dword [ebp - 0x424], eax
call fcn.0102fffb
test eax, eax
je 0x103b10c
push dword [ebx + 0x103fcb8]
push 0x10096c4
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x103b10c
mov dword [ebp - 0x424], 0x2727
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x424]
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103b22e
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b13b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100b9b8
push dword [ebp - 0x418]
call esi
push 0x40
pop eax
mov word [ebp - 0x20c], ax
push 0x103
lea eax, [ebp - 0x20a]
push eax
call fcn.0102fc69
test eax, eax
je 0x103b22e
push 0x1008e50
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x103b22e
lea eax, [ebp - 0x20c]
push 0x2d
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
cmp eax, edi
je 0x103b22e
lea ecx, [ebp - 0x20c]
lea ebx, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
cmp dx, di
jne 0x103b1c4
push dword [ebp - 0x424]
sub ecx, ebx
sar ecx, 1
mov edx, 0x103
push 0x1005850
sub edx, ecx
push edx
add eax, 2
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x103b228
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b1fe
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x100b988
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
cmp dword [ebx + 0x103fcc4], edi
je 0x103b2bc
push 0x452
push 0xa28
push 1
push 5
call fcn.0102fffb
test eax, eax
je 0x103b281
push dword [ebx + 0x103fcb8]
push 0x10096c4
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x103b281
push 0x44
push 0x1009588
push 1
push edi
push 0x10042dc
push dword [ebp - 0x418]
call esi
jmp 0x103b2bc
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 0x103fcc4]
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103b292
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x10042dc
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
mov ecx, dword [ebx + 0x103fcc8]
cmp ecx, edi
je 0x103b2f5
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103b2cb
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008d3c
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
mov ecx, dword [ebx + 0x103fccc]
cmp ecx, edi
je 0x103b32e
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103b304
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008d28
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
mov ecx, dword [ebx + 0x103fcd0]
cmp ecx, edi
je 0x103b369
mov eax, ecx
lea ebx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, di
jne 0x103b33d
sub eax, ebx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push edi
push 0x1008d18
push dword [ebp - 0x418]
call esi
mov ebx, dword [ebp - 0x41c]
jmp 0x103b37a
push 0x1008d18
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebx + 0x103fcd4]
cmp eax, edi
je 0x103b3d1
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.0103c444
test eax, eax
jl 0x103b3e2
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b3a5
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008f0c
push dword [ebp - 0x418]
call esi
jmp 0x103b3e2
push 0x1008f0c
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 0x24
mov dword [ebp - 0x41c], ebx
cmp ebx, 0x2ac
jb 0x103af4d
push dword [ebp - 0x428]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x434]
cmp dword [ebp - 0x434], 2
jl 0x103a01f
push edi
push edi
push edi
push 6
call fcn.0102fffb
test eax, eax
jne 0x103b6fd
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b950
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x100b940
test eax, eax
jne 0x103b4b4
push 0x4e
push 0x100b8f0
push 1
push edi
push 0x10068cc
push dword [ebp - 0x418]
call esi
push 0x4e
push 0x100b8a0
push 1
push edi
push 0x100b888
push dword [ebp - 0x418]
call esi
push 0x4e
push 0x100b838
push 1
push edi
push ebx
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b7f8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b523
push 0x4e
push 0x100b7a8
push 1
push edi
push 0x10068cc
push dword [ebp - 0x418]
call esi
push 0x4e
push 0x100b8a0
push 1
push edi
push 0x100b888
push dword [ebp - 0x418]
call esi
push 0x4e
push 0x100b758
push 1
push edi
push ebx
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b74c
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x100b730
test eax, eax
jne 0x103b565
push 0x1a
push ebx
push 1
push edi
push edi
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b663
push 2
push 0x1002720
push 1
push edi
push 0x100b720
push dword [ebp - 0x418]
call esi
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x26c4
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103b5ef
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b5c9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x418]
call esi
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0102fc69
test eax, eax
je 0x103b657
lea eax, [ebp - 0x20c]
push eax
push 0x100b70c
lea eax, [ebp - 0x414]
push ebx
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x103b657
lea eax, [ebp - 0x414]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b62d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push edi
push 0x100b9d0
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b6d8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b6fd
push 0x103
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.010302a3
test eax, eax
je 0x103b6f1
lea eax, [ebp - 0x20c]
push eax
call fcn.0102e61a
push 0x100b6b4
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x103b6f1
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b6cb
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push edi
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x452
push 0xa28
push 1
push 5
call fcn.0102fffb
test eax, eax
je 0x103badc
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b640
push 0x80000002
mov dword [ebp - 0x41c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x26c7
test eax, eax
jne 0x103b8f9
push 0x1e
push 0x100b61c
push 1
push edi
push 0x10042a0
push dword [ebp - 0x418]
call esi
push 0x103
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.010302a3
test eax, eax
je 0x103b7d0
lea eax, [ebp - 0x20c]
push eax
call fcn.0102e61a
push 0x100b6b4
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x103b7d0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b7a6
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008eb4
push dword [ebp - 0x418]
call esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
push dword [0x10405b0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103b875
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b7fa
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008e88
push dword [ebp - 0x418]
call esi
push ebx
push 0x1005850
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x103b875
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b84b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push 0x1008e58
push dword [ebp - 0x418]
call esi
push 0xc
push 0x100ab60
push 1
push edi
push 0x1006dd0
push dword [ebp - 0x418]
call esi
push 0x1a
push 0x1002774
push 1
push edi
push 0x1006640
push dword [ebp - 0x418]
call esi
push 4
pop ebx
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
push edi
push 0x100ba94
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 7
call esi
push ebx
lea eax, [ebp - 0x41c]
push eax
push ebx
push edi
push 0x100ba7c
push dword [ebp - 0x418]
mov dword [ebp - 0x41c], 0xf
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 0x26c7
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
push dword [0x10405b0]
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x103badc
push 0x100b604
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x103badc
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b588
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 0x100b584
test eax, eax
jne 0x103b9a0
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103b96e
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push ebx
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b500
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ba9b
push 0x40
pop eax
mov word [ebp - 0x20c], ax
push 0x103
lea eax, [ebp - 0x20a]
push eax
call fcn.0102fc69
test eax, eax
je 0x103ba8f
push 0x1008e50
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.01027edd
test eax, eax
jl 0x103ba8f
lea eax, [ebp - 0x20c]
push 0x2d
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
cmp eax, edi
je 0x103ba8f
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov dword [ebp - 0x420], edx
mov dx, word [ecx]
inc ecx
inc ecx
cmp dx, di
jne 0x103ba2b
sub ecx, dword [ebp - 0x420]
push dword [ebp - 0x41c]
sar ecx, 1
mov edx, 0x103
push 0x1005850
sub edx, ecx
push edx
add eax, 2
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x103ba8f
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103ba69
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push edi
push ebx
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
lea eax, [ebp - 0x418]
push eax
push edi
push 2
push edi
push edi
push edi
push 0x100b490
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103badc
push 0x12
push 0x100b478
push 1
push edi
push ebx
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret