Function at 0x10350d6
Capabilities:
Delete registry value
Get common file path
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x80c], ecx
mov ecx, dword [ebp + 0x10]
xor esi, esi
xor ebx, ebx
inc ebx
push eax
mov dword [ebp - 0x800], eax
mov dword [ebp - 0x7f8], ecx
mov dword [ebp - 0x7ec], esi
mov dword [ebp - 0x7f0], esi
mov dword [ebp - 0x804], esi
mov edi, ebx
call fcn.010326b2
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
push dword [ebp - 0x800]
mov dword [ebp - 0x7f4], ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103546b
mov dword [ebp - 0x7f0], 0x190
cmp dword [ebp - 0x808], esi
je 0x10351ba
lea eax, [ebp - 0x7f0]
jmp 0x104a458
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1035224
cmp dword [ebp - 0x7f4], ebx
jne 0x1035224
lea eax, [ebp - 0x194]
push eax
call fcn.010313bf
test eax, eax
je 0x1035224
lea eax, [ebp - 0x7fc]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push eax
mov dword [ebp - 0x7fc], ebx
call fcn.01033e89
jmp 0x103522a
mov dword [ebp - 0x7fc], esi
cmp edi, esi
je 0x103523a
cmp dword [ebp - 0x7fc], esi
jne 0x10352f8
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
mov edi, 0x10064bc
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10352f8
cmp dword [ebp - 0x7f4], ebx
jne 0x10352f8
lea eax, [ebp - 0x194]
push eax
call fcn.010313bf
test eax, eax
je 0x10352f8
lea eax, [ebp - 0x808]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push eax
mov dword [ebp - 0x808], ebx
call fcn.01033e89
cmp dword [ebp - 0x808], esi
je 0x10352f8
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10352bc
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x7fc], ebx
lea eax, [ebp - 0x194]
cmp dword [ebp - 0x80c], esi
je 0x1035319
push dword [ebp - 0x80c]
push 0xc7
push eax
call fcn.01027e68
jmp 0x1035332
push dword [ebp - 0x800]
push 0x1006dec
push 0xc7
push eax
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push eax
call fcn.01033e89
cmp dword [ebp - 0x7fc], esi
jne 0x1035393
cmp dword [ebp - 0x804], esi
je 0x1035393
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1035364
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x7fc], ebx
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7fc], esi
jne 0x103546b
lea eax, [ebp - 0x7ec]
push eax
push ebx
push esi
push dword [ebp - 0x800]
mov dword [ebp - 0x7f8], ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103545b
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x1006dd0
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call edi
test eax, eax
jne 0x1035410
mov dword [ebp - 0x7f8], esi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x1006dc0
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call edi
test eax, eax
jne 0x1035447
mov dword [ebp - 0x7f8], esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7f8], esi
je 0x103546b
push dword [ebp - 0x800]
push 0x80000000
call fcn.0102f8ce
push 0x103
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x103566c
push 0x1006da8
mov edi, 0x104
push edi
lea eax, [ebp - 0x7e8]
push eax
call fcn.01027edd
lea eax, [ebp - 0x7e8]
push eax
push edi
lea eax, [ebp - 0x39c]
push eax
push dword [0x103f01c]
push 0x1006d94
push 0x1006d88
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x10354fc
lea eax, [ebp - 0x39c]
push eax
push dword [0x103f01c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x10354fc
lea eax, [ebp - 0x39c]
push 0x1006d6c
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
mov dword [ebp - 0x7f8], esi
test eax, eax
je 0x1035502
mov dword [ebp - 0x7f8], ebx
lea eax, [ebp - 0x7e8]
push eax
push edi
lea eax, [ebp - 0x39c]
push eax
push dword [0x103f01c]
push 0x1006d54
push 0x1006d88
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x1035562
lea eax, [ebp - 0x39c]
push eax
push dword [0x103f01c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1035562
lea eax, [ebp - 0x39c]
push 0x1006d6c
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
mov dword [ebp - 0x7fc], esi
test eax, eax
je 0x1035568
mov dword [ebp - 0x7fc], ebx
cmp dword [ebp - 0x7f8], esi
jne 0x103557c
cmp dword [ebp - 0x7fc], esi
je 0x103566c
mov eax, dword [ebp - 0x800]
add eax, 2
push eax
push 0x103
lea eax, [ebp - 0x39c]
push eax
call fcn.01027e68
mov edi, dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x103f01c]
lea eax, [ebp - 0x39c]
push eax
push 0x1006d2c
call edi
test eax, eax
je 0x103566c
lea eax, [ebp - 0x5e0]
push eax
push dword [0x103f01c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x103566c
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x1006d2c
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x103f01c]
lea eax, [ebp - 0x39c]
push eax
push 0x1006d0c
call edi
test eax, eax
je 0x103566c
cmp dword [ebp - 0x7f8], esi
je 0x1035639
lea eax, [ebp - 0x5e0]
push eax
push 0x1006d94
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1035659
cmp dword [ebp - 0x7fc], esi
je 0x103566c
lea eax, [ebp - 0x5e0]
push eax
push 0x1006d54
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x103566c
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x1006d0c
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push dword [ebp - 0x800]
lea eax, [ebp - 0x39c]
push 0x1006c88
push 0x103
push eax
mov dword [ebp - 0x804], ebx
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1035844
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x1006b30
push dword [ebp - 0x7ec]
mov edi, 0x244
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103580e
cmp dword [ebp - 0x7f4], ebx
jne 0x103580e
lea eax, [ebp - 0x5e0]
push 0x1001e30
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x103580e
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], ebx
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103580e
cmp dword [ebp - 0x7f4], ebx
jne 0x103580e
lea eax, [ebp - 0x5e0]
push eax
call fcn.010313bf
test eax, eax
je 0x103580e
lea eax, [ebp - 0x5e0]
push 0x1006c30
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x103580e
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
mov dword [ebp - 0x7f0], edi
push esi
mov edi, 0x10064bc
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1035808
cmp dword [ebp - 0x7f4], ebx
jne 0x1035808
lea eax, [ebp - 0x5e0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10357d0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x5e0]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x103580e
mov dword [ebp - 0x804], esi
push 0x1006b30
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x804], esi
jne 0x1035844
lea eax, [ebp - 0x39c]
push eax
push 0x80000002
call fcn.0102f8ce
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 0xc