Function at 0x100162f0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10034944
mov eax, dword fs:[0]
push eax
mov eax, 0x1db0
call fcn.10010620
mov eax, dword [0x10048024]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1db4], ecx
mov byte [ebp - 0x9e4], 0
push 0x103
push 0
lea eax, [ebp - 0x9e3]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x284]
call fcn.10009ab0
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x9e4]
push ecx
lea ecx, [ebp - 0x284]
call fcn.1000d310
test eax, eax
jne 0x10016396
mov dword [ebp - 0x1da0], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.1000d2f0
mov eax, dword [ebp - 0x1da0]
jmp 0x10016bea
mov byte [ebp - 0xf0c], 0
push 0x103
push 0
lea edx, [ebp - 0xf0b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x9e4]
push eax
push str._sBCD
lea ecx, [ebp - 0xf0c]
push ecx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea edx, [ebp - 0xf0c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001644c
push 0x104
push 0
lea eax, [ebp - 0xf0c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x9e4]
push ecx
push str._sBootBCD
lea edx, [ebp - 0xf0c]
push edx
call dword [sym.imp.ntdll.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0xf0c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1001644c
mov dword [ebp - 0x1da4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.1000d2f0
mov eax, dword [ebp - 0x1da4]
jmp 0x10016bea
call fcn.10010f70
mov word [ebp - 0x54], 0
push 0x3e
push 0
lea ecx, [ebp - 0x52]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x49c], 0
push 0x206
push 0
lea edx, [ebp - 0x49a]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0xe00], 1
mov dword [ebp - 0x4a4], 1
lea eax, [ebp - 0xf0c]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0xf0c]
push ecx
lea edx, [ebp - 0x49c]
push edx
call dword [sym.imp.ntdll.dll_mbstowcs]
add esp, 0xc
jmp 0x100164d2
mov eax, dword [ebp - 0x4a4]
add eax, 1
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 0xa
jg 0x10016529
mov ecx, dword [ebp - 0x4a4]
push ecx
push str.MyBCD_d
lea edx, [ebp - 0x54]
push edx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x54]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0xf28], eax
cmp dword [ebp - 0xf28], 0
jne 0x1001651d
jmp 0x10016529
mov dword [ebp - 0xe00], 0
jmp 0x100164c3
mov dword [ebp - 0xf18], 0
mov word [ebp - 0x8d4], 0
push 0x1fe
push 0
lea edx, [ebp - 0x8d2]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov word [ebp - 0x74], 0
xor eax, eax
mov dword [ebp - 0x72], eax
mov dword [ebp - 0x6e], eax
mov dword [ebp - 0x6a], eax
mov dword [ebp - 0x66], eax
mov dword [ebp - 0x62], eax
mov dword [ebp - 0x5e], eax
mov dword [ebp - 0x5a], eax
mov word [ebp - 0x56], ax
mov dword [ebp - 0x4a0], 0
push 0x10038784
call sub.ntdll.dll_strlen
add esp, 4
push eax
push 0x10038790
lea ecx, [ebp - 0x74]
push ecx
call dword [sym.imp.ntdll.dll_mbstowcs]
add esp, 0xc
lea ecx, [ebp - 0x6d4]
call fcn.1000cb50
mov byte [ebp - 4], 1
lea edx, [ebp - 0x54]
push edx
lea ecx, [ebp - 0x6d4]
call fcn.1000cc40
cmp dword [ebp - 0x4a4], 0xb
jne 0x1001664a
cmp dword [ebp - 0xe00], 0
jne 0x1001664a
push 0x1003879c
push str.BCD00000000_s
lea eax, [ebp - 0x8d4]
push eax
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0xc
lea ecx, [ebp - 0x4a0]
push ecx
push 0x20019
push 0
lea edx, [ebp - 0x8d4]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x10016645
mov dword [ebp - 0x1da8], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6d4]
call fcn.1000cb90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.1000d2f0
mov eax, dword [ebp - 0x1da8]
jmp 0x10016bea
jmp 0x1001670b
push str.Objects
lea eax, [ebp - 0x54]
push eax
push 0x100387e0
lea ecx, [ebp - 0x8d4]
push ecx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x10
lea edx, [ebp - 0x4a0]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x8d4]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1001670b
call sym.Comn.dll_GetObjectLog
mov dword [ebp - 0x1db8], eax
push 0x789
push str..._bootset.cpp
call fcn.10010eb0
add esp, 8
push eax
push str._s:_Failed_to_RegOpenKeyEx.
mov ecx, dword [ebp - 0x1db8]
push ecx
mov edx, dword [ebp - 0x1db8]
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
call ecx
add esp, 0xc
lea edx, [ebp - 0x54]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov dword [ebp - 0x1dac], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6d4]
call fcn.1000cb90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.1000d2f0
mov eax, dword [ebp - 0x1dac]
jmp 0x10016bea
mov ax, word [0x10038818]
mov word [ebp - 0xbf4], ax
push 0x206
push 0
lea ecx, [ebp - 0xbf2]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x4a8], 0x104
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0xf24], 0x3fff
lea edx, [ebp - 0xf14]
push edx
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x9e8]
push ecx
lea edx, [ebp - 0xf1c]
push edx
lea eax, [ebp - 0xf20]
push eax
lea ecx, [ebp - 0x28c]
push ecx
lea edx, [ebp - 0xbf8]
push edx
lea eax, [ebp - 0x9ec]
push eax
push 0
lea ecx, [ebp - 0x4a8]
push ecx
lea edx, [ebp - 0xbf4]
push edx
mov eax, dword [ebp - 0x4a0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x9ec], 0
je 0x10016b9b
mov dword [ebp - 0xf2c], 0
jmp 0x100167cf
mov ecx, dword [ebp - 0xf2c]
add ecx, 1
mov dword [ebp - 0xf2c], ecx
mov edx, dword [ebp - 0xf2c]
cmp edx, dword [ebp - 0x9ec]
jae 0x10016b9b
mov dword [ebp - 0x290], 0xff
lea eax, [ebp - 0xf14]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 0x290]
push ecx
lea edx, [ebp - 0xdfc]
push edx
mov eax, dword [ebp - 0xf2c]
push eax
mov ecx, dword [ebp - 0x4a0]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 0
jne 0x10016b8b
mov word [ebp - 0x1134], 0
push 0x206
push 0
lea edx, [ebp - 0x1132]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
push str.Elements
lea eax, [ebp - 0xdfc]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push str._s_s_s
lea edx, [ebp - 0x1134]
push edx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x14
lea eax, [ebp - 0x1138]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x1134]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10016b8b
mov dx, word [0x10038844]
mov word [ebp - 0x1344], dx
push 0x206
push 0
lea eax, [ebp - 0x1342]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x1368], 0x104
mov dword [ebp - 0x1358], 0
lea ecx, [ebp - 0x1364]
push ecx
lea edx, [ebp - 0x1570]
push edx
lea eax, [ebp - 0x1354]
push eax
lea ecx, [ebp - 0x1574]
push ecx
lea edx, [ebp - 0x1348]
push edx
lea eax, [ebp - 0x1350]
push eax
lea ecx, [ebp - 0x134c]
push ecx
lea edx, [ebp - 0x1358]
push edx
push 0
lea eax, [ebp - 0x1368]
push eax
lea ecx, [ebp - 0x1344]
push ecx
mov edx, dword [ebp - 0x1138]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x1358], 0
je 0x10016b7e
mov dword [ebp - 0x1578], 0
jmp 0x10016957
mov eax, dword [ebp - 0x1578]
add eax, 1
mov dword [ebp - 0x1578], eax
mov ecx, dword [ebp - 0x1578]
cmp ecx, dword [ebp - 0x1358]
jae 0x10016b7e
mov dword [ebp - 0x135c], 0xff
lea edx, [ebp - 0x1364]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x135c]
push eax
lea ecx, [ebp - 0x156c]
push ecx
mov edx, dword [ebp - 0x1578]
push edx
mov eax, dword [ebp - 0x1138]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [ebp - 0x8d8], eax
cmp dword [ebp - 0x8d8], 0
jne 0x10016b6e
mov word [ebp - 0x1784], 0
push 0x206
push 0
lea ecx, [ebp - 0x1782]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
lea edx, [ebp - 0x156c]
push edx
lea eax, [ebp - 0x1134]
push eax
push 0x10038848
lea ecx, [ebp - 0x1784]
push ecx
call dword [sym.imp.MSVCR80.dll__swprintf]
add esp, 0x10
lea edx, [ebp - 0x1788]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x1784]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10016b6e
mov word [ebp - 0x198c], 0
push 0x1fe
push 0
lea ecx, [ebp - 0x198a]
push ecx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x1994], 0x200
mov dword [ebp - 0x1990], 0
mov edx, dword [ebp - 0x1990]
mov dword [ebp - 0x1dbc], edx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1994]
push eax
lea ecx, [ebp - 0x198c]
push ecx
mov edx, dword [ebp - 0x1dbc]
push edx
mov eax, dword [ebp - 0x1788]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ecx, dword [ebp - 0x1990]
add ecx, 1
mov dword [ebp - 0x1990], ecx
test eax, eax
jne 0x10016b61
mov byte [ebp - 0x1d9c], 0
push 0x3ff
push 0
lea edx, [ebp - 0x1d9b]
push edx
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x1998], 0x400
lea eax, [ebp - 0x1998]
push eax
lea ecx, [ebp - 0x1d9c]
push ecx
push 0
push 0
lea edx, [ebp - 0x198c]
push edx
mov eax, dword [ebp - 0x1788]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10016b3c
lea ecx, [ebp - 0x74]
push ecx
lea edx, [ebp - 0x1d9c]
push edx
call fcn.10002cc0
add esp, 8
test eax, eax
je 0x10016b3c
mov dword [ebp - 0xf18], 1
lea eax, [ebp - 0xdfc]
push eax
call dword [sym.imp.ntdll.dll_wcslen]
add esp, 4
cmp eax, dword [ebp + 0xc]
jae 0x10016b3a
lea ecx, [ebp - 0xdfc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntdll.dll_wcscpy]
add esp, 8
jmp 0x10016b61
push pe_nt_image_headers32
push 0
lea eax, [ebp - 0x198c]
push eax
call sub.ntdll.dll_memset
add esp, 0xc
mov dword [ebp - 0x1994], 0x200
jmp 0x10016a52
mov ecx, dword [ebp - 0x1788]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xf18], 0
je 0x10016b79
jmp 0x10016b7e
jmp 0x10016948
mov edx, dword [ebp - 0x1138]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xf18], 0
je 0x10016b96
jmp 0x10016b9b
jmp 0x100167c0
mov eax, dword [ebp - 0x4a0]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x54]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov edx, dword [ebp - 0xf18]
mov dword [ebp - 0x1db0], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6d4]
call fcn.1000cb90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x284]
call fcn.1000d2f0
mov eax, dword [ebp - 0x1db0]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1000f672
mov esp, ebp
pop ebp
ret 8