Function at 0x1022f20
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1032038]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0xc105
push esi
call fcn.0102728b
test eax, eax
je 0x1022f50
push 0x100b610
push esi
call fcn.01027339
pop ecx
pop ecx
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push 2
push 0
mov edi, 0x100ad38
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1022f93
push esi
call fcn.0102728b
test eax, eax
je 0x1023162
push edi
push 0x100b520
push esi
call fcn.01027339
add esp, 0xc
jmp 0x1023162
push ebx
mov ebx, 0x1003298
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0
mov ebx, 0x100adb8
push ebx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
test eax, eax
jne 0x1022ffc
call fcn.0102728b
test eax, eax
je 0x1022fd7
push ebx
push edi
push 0x100b470
push esi
call fcn.01027339
add esp, 0x10
push 4
lea eax, [ebp - 0x20]
push eax
push 4
push 0
mov ebx, 0x100adc8
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x20], 0x84020004
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
test eax, eax
je 0x1023017
call fcn.0102728b
test eax, eax
je 0x102306d
push ebx
push edi
push 0x100b3c0
push esi
call fcn.01027339
add esp, 0x10
jmp 0x102306d
call fcn.0102728b
test eax, eax
je 0x1023033
push ebx
push edi
push dword [ebp - 0x20]
push 0x100b318
push esi
call fcn.01027339
add esp, 0x14
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
push 3
push 0
mov ebx, 0x100acb8
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x102307b
push esi
call fcn.0102728b
test eax, eax
je 0x102306d
push ebx
push 0x100b520
push esi
call fcn.01027339
add esp, 0xc
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1023161
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0x100ade0
push dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0x10
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10230be
push esi
call fcn.0102728b
test eax, eax
je 0x1023151
push 0x100ade0
push ebx
push 0x100b1f8
jmp 0x1023148
push dword [ebp - 0x24]
inc byte [ebp - 5]
lea eax, [ebp - 0x14]
push eax
push 3
push 0
push 0x100ad24
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
test eax, eax
je 0x10230f5
call fcn.0102728b
test eax, eax
je 0x1023151
push 0x100ad24
push edi
push 0x100b140
jmp 0x1023148
call fcn.0102728b
test eax, eax
je 0x1023112
push 0x100ad24
push edi
push 0x100b0a0
push esi
call fcn.01027339
add esp, 0x10
mov edi, 0x100ade0
push edi
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push esi
test eax, eax
je 0x1023138
call fcn.0102728b
test eax, eax
je 0x1023151
push edi
push ebx
push 0x100af88
jmp 0x1023148
call fcn.0102728b
test eax, eax
je 0x1023151
push edi
push ebx
push 0x100aee0
push esi
call fcn.01027339
add esp, 0x10
push dword [ebp - 0x1c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x18]
call esi
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01016715
leave
ret