Function at 0xc035c3
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x664
mov eax, dword [0xc940a0]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x648], 0
and dword [ebp - 0x644], 0
push ebx
push esi
push edi
mov dword [ebp - 0x63c], ecx
call fcn.00c030c3
push 0x2001f
lea ecx, [ebp - 0x65c]
mov byte [ebp - 0x63d], al
xor bl, bl
call fcn.00a7f468
mov edi, dword [ebp - 0x648]
test edi, edi
je 0xc0362c
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [0xc97ae0]
test eax, eax
jne 0xc0363b
mov eax, dword [ebp - 0x65c]
xor edx, edx
lea ecx, [ebp - 0x648]
push edx
push ecx
push edx
push 0x2001f
push edx
push edx
push edx
push 0xa22d18
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jle 0xc0366b
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xc03677
mov edx, 0x16b
jmp 0xc03750
mov edi, dword [ebp - 0x644]
test edi, edi
je 0xc03697
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [0xc97ae0]
test eax, eax
jne 0xc036a6
mov eax, dword [ebp - 0x65c]
lea ecx, [ebp - 0x644]
push ecx
push 0x2001f
push 0
push 0xa22c98
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jle 0xc036ce
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xc03763
mov ecx, dword [ebp - 0x63c]
call fcn.00c03abd
mov edi, dword [ebp - 0x644]
test al, al
setne bl
test edi, edi
je 0xc03704
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
push edi
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
push esi
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetLastError]
mov eax, dword [0xc97ae0]
xor edx, edx
mov dword [ebp - 0x644], edx
test eax, eax
jne 0xc0371b
mov eax, dword [ebp - 0x65c]
push edx
lea ecx, [ebp - 0x644]
push ecx
push edx
push 0x2001f
push edx
push edx
push edx
push 0xa22c98
push eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jle 0xc03749
movzx esi, si
or esi, 0x80070000
test esi, esi
jns 0xc03763
mov edx, 0x171
mov ecx, dword [ebp + 4]
push esi
push 0x9fdf00
call fcn.00aa4c55
jmp 0xc03a57
mov ecx, dword [ebp - 0x63c]
call fcn.00c03abd
push 4
pop edi
test al, al
je 0xc0377d
test bl, bl
je 0xc03a28
xor ecx, ecx
test bl, bl
mov ebx, dword [ebp - 0x63c]
mov esi, ecx
mov dword [ebp - 0x64c], ecx
mov dword [ebp - 0x650], ecx
jne 0xc037af
cmp ebx, 0xbadf00d
je 0xc037af
mov dword [ebp - 0x638], ebx
mov dword [ebp - 0x64c], 1
lea eax, [ebp - 0x654]
mov dword [ebp - 0x654], edi
push eax
lea eax, [ebp - 0x650]
push eax
push ecx
push ecx
push 0xa22da8
push dword [ebp - 0x648]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jle 0xc037e4
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0xc03813
xor eax, eax
cmp byte [ebp - 0x63d], al
push edi
setne al
mov dword [ebp - 0x650], eax
lea eax, [ebp - 0x650]
push eax
push edi
push 0
push 0xa22da8
push dword [ebp - 0x648]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
xor edi, edi
cmp edi, 5
jge 0xc038c4
cmp dword [ebp - 0x650], 1
jne 0xc0382f
test edi, edi
je 0xc038bb
push edi
push 0xa22d8c
push 0xa22bec
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.00a60c0c
mov esi, eax
add esp, 0x14
test esi, esi
js 0xc038bb
lea eax, [ebp - 0x654]
mov dword [ebp - 0x654], 4
push eax
lea eax, [ebp - 0x63c]
push eax
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x644]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jle 0xc03894
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0xc038bb
mov ecx, dword [ebp - 0x63c]
mov eax, ecx
xor eax, ebx
test eax, 0xffffff
je 0xc038bb
mov eax, dword [ebp - 0x64c]
mov dword [ebp + eax*4 - 0x638], ecx
inc eax
mov dword [ebp - 0x64c], eax
inc edi
test esi, esi
jns 0xc03815
xor edi, edi
lea ebx, [ebp - 0x638]
mov dword [ebp - 0x63c], edi
xor esi, esi
cmp esi, dword [ebp - 0x64c]
jge 0xc03972
push edi
push 0xa22d8c
push 0xa22bec
lea eax, [ebp - 0x418]
push 0x104
push eax
call fcn.00a60c0c
mov ecx, eax
add esp, 0x14
test ecx, ecx
js 0xc03966
xor edx, edx
test esi, esi
jle 0xc0392e
mov edi, dword [ebx]
and edi, 0xffffff
mov eax, dword [ebp + edx*4 - 0x638]
and eax, 0xffffff
cmp eax, edi
je 0xc03960
inc edx
cmp edx, esi
jl 0xc03913
mov edi, dword [ebp - 0x63c]
push 4
push ebx
push 4
push 0
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x644]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ecx, eax
test ecx, ecx
jle 0xc03957
movzx ecx, cx
or ecx, 0x80070000
inc edi
mov dword [ebp - 0x63c], edi
jmp 0xc03966
mov edi, dword [ebp - 0x63c]
inc esi
add ebx, 4
test ecx, ecx
jns 0xc038d4
xor esi, esi
mov ebx, edi
cmp ebx, 5
jge 0xc03a25
cmp esi, 5
jge 0xc03a25
push ebx
push 0xa22d8c
push 0xa22bec
lea eax, [ebp - 0x620]
push 0x104
push eax
call fcn.00a60c0c
mov ecx, eax
add esp, 0x14
test ecx, ecx
js 0xc03a1b
cmp esi, 4
jae 0xc03a1b
mov edi, dword [esi*4 + 0xa23bd0]
xor edx, edx
mov dword [ebp - 0x64c], edi
cmp dword [ebp - 0x63c], edx
jle 0xc039ec
and edi, 0xffffff
mov eax, dword [ebp + edx*4 - 0x638]
and eax, 0xffffff
cmp edi, eax
je 0xc03aae
inc edx
cmp edx, dword [ebp - 0x63c]
jl 0xc039cf
push 4
lea eax, [ebp - 0x64c]
push eax
push 4
push 0
lea eax, [ebp - 0x620]
push eax
push dword [ebp - 0x644]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
mov ecx, eax
test ecx, ecx
jle 0xc03a1b
movzx ecx, cx
or ecx, 0x80070000
inc ebx
inc esi
test ecx, ecx
jns 0xc03976
push 4
pop edi
xor eax, eax
cmp byte [ebp - 0x63d], al
push edi
setne al
mov dword [ebp - 0x660], eax
lea eax, [ebp - 0x660]
push eax
push edi
push 0
push 0xa22da8
push dword [ebp - 0x648]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegSetValueExW]
xor esi, esi
cmp dword [ebp - 0x65c], 0
je 0xc03a73
push dword [ebp - 0x65c]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
and dword [ebp - 0x65c], 0
cmp dword [ebp - 0x644], 0
je 0xc03a88
push dword [ebp - 0x644]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
cmp dword [ebp - 0x648], 0
je 0xc03a9d
push dword [ebp - 0x648]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00ab3c50
leave
ret
inc esi
cmp esi, 5
jl 0xc039ad
jmp 0xc03a1b