Function at 0x103a6a6
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x910
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
xor edi, edi
inc edi
cmp eax, ebx
mov dword [ebp - 0x904], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x8e8], ebx
mov dword [ebp - 0x8ec], ebx
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x90c], edi
mov dword [ebp - 0x900], edi
mov dword [ebp - 0x8f8], ebx
je 0x103b0d0
push 0x10081b0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103a73f
push dword [ebp - 0x8f0]
mov dword [ebp - 0x8f8], edi
push esi
push 0x100a7b0
jmp 0x103a769
push 0x100812c
push dword [ebp - 0x8f0]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
push dword [ebp - 0x8f0]
push esi
jne 0x103a764
push 0x100a770
jmp 0x103a769
push 0x100a748
lea eax, [ebp - 0x48c]
push 0x121
push eax
call fcn.01028b64
add esp, 0x14
push dword [ebp - 0x8f0]
lea eax, [ebp - 0x248]
push 0x100a714
push 0x121
push eax
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0x8e8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
mov edi, 0x80000000
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jne 0x103a878
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103a83d
cmp dword [ebp - 0x8e4], 1
je 0x103a811
cmp dword [ebp - 0x8e4], 2
jne 0x103a83d
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.01038ae1
test eax, eax
jne 0x103a86c
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103a831
jmp 0x103a850
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103a846
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x8e8]
call esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp - 0x8f0]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b05c
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x8e0]
push eax
push 1
push ebx
push 0x100a31c
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8e0], ebx
call edi
test eax, eax
jne 0x103a9ff
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103a9f3
cmp dword [ebp - 0x8e4], 1
jne 0x103a9f3
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x103a9f3
lea eax, [ebp - 0x248]
push 0x1004598
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103a9f3
push 0x100a700
push 0x122
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x908], ebx
call fcn.01028adc
lea eax, [ebp - 0x908]
push eax
push 1
push ebx
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e0]
call edi
test eax, eax
jne 0x103a9f3
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x908]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103a9e7
cmp dword [ebp - 0x8e4], 1
je 0x103a9b7
cmp dword [ebp - 0x8e4], 2
jne 0x103a9e7
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x103a9e7
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8f0]
push 2
call fcn.010392ed
mov dword [ebp - 0x900], eax
mov dword [ebp - 0x90c], ebx
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x100a35c
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b050
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call edi
test eax, eax
jne 0x103ab5b
cmp dword [ebp - 0x8e4], 1
je 0x103aa76
cmp dword [ebp - 0x8e4], 2
jne 0x103ab5b
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x103ab5b
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8f0]
push 2
call fcn.010392ed
test eax, eax
je 0x103aba2
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x8fc], eax
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x8dc]
push eax
call fcn.01028a67
lea eax, [ebp - 0x8dc]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x8dc]
push eax
call fcn.01038841
test eax, eax
jne 0x103ab21
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103aaf1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x100a340
push dword [ebp - 0x8e0]
call esi
jmp 0x103ab2d
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x8f4], eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.01038ae1
test eax, eax
jne 0x103aba2
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ab4d
sub eax, edx
jmp 0x103ab88
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x8f4], eax
lea eax, [ebp - 0x48c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103ab7c
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8fc], ebx
je 0x103b050
push 0x105
lea eax, [ebp - 0x8a4]
push eax
call fcn.01033bb5
test eax, eax
je 0x103b050
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], 0x244
call edi
test eax, eax
jne 0x103ac09
cmp dword [ebp - 0x8e4], 1
je 0x103ac37
mov eax, dword [ebp - 0x8f0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ac12
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x8f0]
push 1
push ebx
push ebx
push dword [ebp - 0x8e8]
call esi
push ebx
push ebx
push ebx
push ebx
mov edi, 0x100a6ec
push edi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x103ac64
push 0xc
push 0x100a6e0
push 1
push ebx
push edi
push dword [ebp - 0x8e8]
call esi
push ebx
push ebx
push ebx
push ebx
mov edi, 0x100a6cc
push edi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x103acac
push 4
lea eax, [ebp - 0x8f0]
push eax
push 3
push ebx
push edi
push dword [ebp - 0x8e8]
mov byte [ebp - 0x8f0], 2
mov byte [ebp - 0x8ef], bl
mov byte [ebp - 0x8ee], bl
mov byte [ebp - 0x8ed], bl
call esi
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
mov edi, 0x2001f
push edi
push ebx
push ebx
push ebx
push 0x100a328
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ae77
cmp dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8ec], 0x244
jne 0x103ad6d
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103ad6d
cmp dword [ebp - 0x8e4], 1
je 0x103ad26
cmp dword [ebp - 0x8e4], 2
jne 0x103ad6d
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x103ad6d
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ad3f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x100a340
push dword [ebp - 0x8e0]
call esi
mov eax, dword [ebp - 0x910]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ad76
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x910]
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
lea eax, [ebp - 0x8a4]
push eax
push 0x100a6b8
lea eax, [ebp - 0x698]
push 0x105
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x103ae66
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
mov edi, 0x10059e4
push edi
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103ae37
cmp dword [ebp - 0x8e4], 1
je 0x103ae0b
cmp dword [ebp - 0x8e4], 2
jne 0x103ae37
lea eax, [ebp - 0x698]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.01038ae1
test eax, eax
jne 0x103ae66
lea eax, [ebp - 0x698]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ae2b
jmp 0x103ae4a
lea eax, [ebp - 0x698]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ae40
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x698]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x2001f
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x100a31c
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103af41
cmp dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8ec], 0x244
jne 0x103af22
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103af22
cmp dword [ebp - 0x8e4], 1
jne 0x103af22
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x103af22
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103aef8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push ebx
push 0x100a340
push dword [ebp - 0x8e0]
call esi
push 0xa
push 0x1002064
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x1009aec
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103b050
cmp dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x8ec], 0x244
jne 0x103b016
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103b016
cmp dword [ebp - 0x8e4], 1
je 0x103afb6
cmp dword [ebp - 0x8e4], 2
jne 0x103b016
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x103b016
push dword [ebp - 0x904]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103b016
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103afe8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x100a340
push dword [ebp - 0x8e0]
call esi
mov eax, dword [ebp - 0x904]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103b01f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x904]
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8f8], ebx
je 0x103b0d0
cmp dword [ebp - 0x8fc], ebx
je 0x103b0d0
lea eax, [ebp - 0x8e8]
push eax
push 0x2001f
push ebx
push 0x100a630
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103b0d0
push 4
pop edi
push edi
lea eax, [ebp - 0x8f8]
push eax
push edi
push ebx
push 0x100a624
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8f8], ebx
call esi
push edi
lea eax, [ebp - 0x8f8]
push eax
push edi
push ebx
push 0x100a610
push dword [ebp - 0x8e8]
call esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 0x18