Function at 0x1009ee5
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1438
call fcn.0100cb50
mov edx, dword [0x10017dc]
push ebx
push esi
mov esi, 0x81
push edi
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x820]
mov dword [ebp - 0x824], edx
mov dword [ebp - 0x618], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x614]
push 0x7e
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
pop esi
xor eax, eax
mov ecx, esi
lea edi, [ebp - 0x208]
mov dword [ebp - 0x20c], edx
mov dword [ebp - 0x40c], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0x408]
mov dword [ebp - 0xa24], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xa20]
mov dword [ebp - 0xe24], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xe20]
mov dword [ebp - 0xc24], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, esi
xor eax, eax
lea edi, [ebp - 0xc20]
mov dword [ebp - 0x1438], edx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x183
xor eax, eax
lea edi, [ebp - 0x1434]
xor ebx, ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 0xf003f
push ebx
push 0x10025fc
push 0x80000002
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 4], ebx
je 0x100a154
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push 0x10025dc
push dword [ebp - 4]
call esi
cmp dword [ebp - 0xc], ebx
je 0x100a154
lea eax, [ebp - 8]
mov edi, 0x20a
push eax
lea eax, [ebp - 0x824]
push eax
push ebx
push ebx
push 0x10025c8
push dword [ebp - 4]
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x618]
push eax
push ebx
push ebx
push 0x10025a8
push dword [ebp - 4]
call esi
cmp word [ebp - 0x824], bx
mov edi, 0x1fe
lea eax, [ebp - 0x20c]
push edi
push eax
je 0x100a080
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x2f8
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xa24]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xa24]
jmp 0x100a096
mov esi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x2f9
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [ebp - 0x618], bx
lea eax, [ebp - 0x40c]
push edi
push eax
je 0x100a0e5
push 0x2fa
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0xe24]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xe24]
jmp 0x100a0f5
push 0x2fb
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x1438]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0xc24]
push edi
push eax
push 0x1f4
push dword [ebp + 8]
call esi
lea eax, [ebp - 0xc24]
push 0x30
push eax
lea eax, [ebp - 0x1438]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0xc]
push 4
push eax
push 4
push ebx
push 0x10025dc
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x100a156
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret