Function at 0x10004e8b
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 4], 0
push 0x1006e390
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10004f32
cmp dword [ebp - 8], 2
jne 0x10004f1b
push 2
push 0x1006e39c
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10004f16
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x10004f32
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3a0
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10004fc8
cmp dword [ebp - 8], 2
jne 0x10004fb1
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10004fac
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x10004fc8
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3a8
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000505e
cmp dword [ebp - 8], 2
jne 0x10005047
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10005042
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x1000505e
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3b0
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100050f4
cmp dword [ebp - 8], 2
jne 0x100050dd
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100050d8
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x100050f4
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3b8
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000518a
cmp dword [ebp - 8], 2
jne 0x10005173
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000516e
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x1000518a
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3c0
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10005220
cmp dword [ebp - 8], 2
jne 0x10005209
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10005204
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x10005220
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3c8
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100052b6
cmp dword [ebp - 8], 2
jne 0x1000529f
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000529a
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x100052b6
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3d0
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000534c
cmp dword [ebp - 8], 2
jne 0x10005335
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10005330
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x1000534c
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
push 0x1006e3d8
lea eax, [ebp - 0x48]
push eax
call fcn.1001bc30
add esp, 8
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100053e3
cmp dword [ebp - 8], 2
jne 0x100053cc
push 5
push 0x1006e3e4
push 1
push 0
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100053c7
push 0x10003
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
jmp 0x100053e3
push 0x10006
call fcn.100042e2
add esp, 4
mov eax, 0xffffffff
jmp 0x100053ea
xor eax, eax
jmp 0x100053ea
pop edi
pop esi
pop ebx
leave
ret