Function at 0x10003d90
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100248b8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x100365e8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ecx]
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x64], edi
cmp eax, esi
je 0x10003e6d
lea edx, [ebp - 0x5c]
push edx
mov dword [ebp - 0x5c], esi
mov ecx, dword [eax]
push 2
push eax
mov eax, dword [ecx + 0x3c]
call eax
cmp eax, esi
jne 0x10003e6d
mov edx, dword [str.SoftwarePoliciesGoogleChromeExtensionInstallWhitelist]
mov eax, dword [ebp - 0x5c]
lea ecx, [ebp - 0x4c]
push ecx
push 0x2001f
push esi
push edx
push eax
mov dword [ebp - 0x4c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x60], eax
cmp eax, 2
jne 0x10003e5e
mov ecx, dword [ebp - 0x5c]
cmp edi, esi
jne 0x10003e40
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012e4f
mov esp, ebp
pop ebp
ret 8
mov eax, dword [str.SoftwarePoliciesGoogleChromeExtensionInstallWhitelist]
push esi
lea edx, [ebp - 0x4c]
push edx
push esi
push 0x2001f
push esi
push esi
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x4c], esi
jne 0x10003e71
mov edx, dword [ebp - 0x5c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x10003e22
push 0xc
mov dword [ebp - 0x54], esi
call fcn.100129eb
add esp, 4
cmp eax, esi
je 0x10004251
mov dword [eax], eax
mov dword [ebp - 0x58], eax
mov dword [eax + 4], eax
mov dword [ebp - 4], esi
xor edi, edi
cmp edi, 0x100
jge 0x10003fdd
xor eax, eax
push 0x80
mov word [ebp - 0x24], ax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov word [ebp - 0x12], ax
mov dword [ebp - 0x78], 0xa
call fcn.1001330e
add esp, 4
lea ecx, [ebp - 0x6c]
push ecx
mov ebx, eax
push ebx
lea edx, [ebp - 0x74]
push edx
mov edx, dword [ebp - 0x4c]
push esi
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x24]
push ecx
push edi
push edx
mov dword [ebp - 0x6c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [ebp - 0x68], eax
cmp eax, esi
jne 0x10003fc4
cmp dword [ebp - 0x74], 1
jne 0x10003fc4
push 0xa
lea eax, [ebp - 0x24]
push 0
push eax
call fcn.100132f4
add esp, 0xc
test eax, eax
jle 0x10003fc4
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003f21
sub eax, edx
sar eax, 1
cmp eax, 0x20
jne 0x10003fc4
mov eax, dword [ebp - 0x58]
mov esi, dword [eax]
mov byte [ebp - 0x45], cl
cmp esi, eax
je 0x10003f8c
mov eax, dword [esi + 8]
mov ecx, ebx
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003f76
test dx, dx
je 0x10003f72
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003f76
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003f50
xor eax, eax
jmp 0x10003f7b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10003f88
mov esi, dword [esi]
cmp esi, dword [ebp - 0x58]
jne 0x10003f45
jmp 0x10003f8c
mov byte [ebp - 0x45], 1
mov edx, dword [ebp - 0x4c]
lea ecx, [ebp - 0x24]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
dec edi
cmp byte [ebp - 0x45], 0
jne 0x10003fc4
mov esi, dword [ebp - 0x6c]
push esi
call fcn.1001330e
push esi
push ebx
push eax
mov dword [ebp - 0x70], eax
call fcn.100133b0
add esp, 0x10
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x58]
call fcn.10003d40
push ebx
call fcn.100130f8
add esp, 4
inc edi
xor esi, esi
cmp dword [ebp - 0x68], 0x103
jne 0x10003e93
cmp dword [ebp - 0x64], esi
je 0x1000405d
mov edi, dword [ebp - 0x58]
mov esi, dword [edi]
cmp esi, edi
je 0x1000402a
mov ebx, dword [ebp - 0x64]
mov edi, edi
mov eax, dword [esi + 8]
mov ecx, ebx
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000401b
test dx, dx
je 0x10004017
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000401b
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003ff5
xor eax, eax
jmp 0x10004020
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1000405d
mov esi, dword [esi]
cmp esi, edi
jne 0x10003ff0
mov edx, dword [edi + 4]
lea ecx, [ebp - 0x64]
push ecx
push edx
push edi
lea ecx, [ebp - 0x58]
call fcn.10003ca0
mov ecx, 0x3ffffffe
sub ecx, dword [ebp - 0x54]
cmp ecx, 1
jae 0x10004052
push str.list_T__too_long
call fcn.1001215f
inc dword [ebp - 0x54]
mov dword [edi + 4], eax
mov edx, dword [eax + 4]
mov dword [edx], eax
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x100040db
mov eax, dword [ebp - 0x58]
mov edi, dword [eax]
mov ebx, edi
cmp ebx, eax
je 0x100040db
nop
mov eax, dword [ebx + 8]
mov ecx, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1000409b
test dx, dx
je 0x10004097
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1000409b
add eax, 4
add ecx, 4
test dx, dx
jne 0x10004075
xor eax, eax
jmp 0x100040a0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x100040ad
mov ebx, dword [ebx]
cmp ebx, dword [ebp - 0x58]
jne 0x10004070
jmp 0x100040db
mov ebx, dword [ebx + 8]
mov esi, edi
cmp esi, dword [ebp - 0x58]
je 0x100040db
cmp dword [esi + 8], ebx
jne 0x100040d4
mov eax, dword [esi + 4]
push esi
mov esi, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], eax
call fcn.10012225
add esp, 4
dec dword [ebp - 0x54]
jmp 0x100040d6
mov esi, dword [esi]
cmp esi, dword [ebp - 0x58]
jne 0x100040b7
mov eax, dword [ebp - 0x58]
mov ebx, dword [eax]
mov esi, 1
cmp ebx, eax
je 0x10004178
mov edi, dword [ebp - 0x54]
add edi, 0x100
mov dword [ebp - 0x68], edi
jmp 0x10004103
mov edi, dword [ebp - 0x68]
cmp esi, edi
jae 0x10004139
push esi
lea eax, [ebp - 0x24]
push 0x1002df64
push eax
call fcn.10013059
mov edx, dword [ebp - 0x4c]
add esp, 0xc
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x10004139
inc esi
cmp esi, edi
jb 0x10004107
mov edx, dword [ebx + 8]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004141
sub eax, edi
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
mov edx, dword [ebp - 0x4c]
push 1
push 0
lea ecx, [ebp - 0x24]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [ebp - 0x60], 0
jne 0x10004171
mov dword [ebp - 0x60], eax
mov ebx, dword [ebx]
cmp ebx, dword [ebp - 0x58]
jne 0x10004100
mov eax, dword [ebp - 0x58]
mov esi, dword [eax]
cmp esi, eax
je 0x100041a2
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x64]
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x1000419b
cmp eax, edi
je 0x1000419b
push eax
call fcn.100130f8
add esp, 4
mov esi, dword [esi]
cmp esi, dword [ebp - 0x58]
jne 0x10004187
mov eax, dword [ebp - 0x4c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp - 0x58]
push eax
call esi
mov ecx, dword [ebp - 0x5c]
push ecx
call esi
mov eax, dword [0x1002ded4]
mov ecx, dword [0x1002ded8]
mov edx, dword [0x1002ded0]
mov dword [ebp - 0x30], eax
mov eax, dword [0x1002dee0]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [0x1002dee4]
mov dword [ebp - 0x44], eax
mov eax, dword [0x1002deec]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x38], eax
mov eax, dword [ecx]
mov dword [ebp - 0x34], edx
mov edx, dword [0x1002dedc]
lea ecx, [ebp - 0x44]
push ecx
mov dword [ebp - 0x28], edx
mov edx, dword [0x1002dee8]
lea ecx, [ebp - 0x34]
push ecx
push 1
mov dword [ebp - 0x3c], edx
mov edx, dword [eax]
mov edx, dword [edx + 0x1c]
push 1
push eax
call edx
test eax, eax
jne 0x10004222
cmp dword [ebp - 0x60], eax
jne 0x10004222
mov bl, 1
jmp 0x10004224
xor bl, bl
mov eax, dword [edi]
mov dword [edi], edi
mov dword [edi + 4], edi
cmp eax, edi
je 0x10004241
nop
mov esi, dword [eax]
push eax
call fcn.10012225
add esp, 4
mov eax, esi
cmp esi, edi
jne 0x10004230
push edi
call fcn.10012225
add esp, 4
mov al, bl
jmp 0x10003e22
lea eax, [ebp - 0x80]
push eax
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x80], esi
call fcn.100128c3
push 0x10031e6c
lea ecx, [ebp - 0x8c]
push ecx
mov dword [ebp - 0x8c], vtable.std::bad_alloc.0
call fcn.10012230
int3