Function at 0x103cac3
Capabilities:
Delete registry key
Delete registry value
Get common file path
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc0
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi + 0x34]
mov edx, dword [edi]
xor ebx, ebx
push edx
mov dword [ebp - 0xc88], ecx
mov dword [ebp - 0xc78], ebx
mov dword [ebp - 0xc80], ebx
mov dword [ebp - 0xc7c], 1
mov dword [ebp - 0xc84], eax
mov dword [ebp - 0xc94], ebx
mov dword [ebp - 0xcc0], ebx
mov dword [ebp - 0xcac], ebx
mov dword [ebp - 0xcb4], ebx
mov dword [ebp - 0xcbc], ebx
call fcn.010387a2
test eax, eax
je 0x103ec67
push dword [edi + 8]
call fcn.010387a2
test eax, eax
je 0x103ec67
mov eax, dword [ecx + 0x14]
mov dword [ebp - 0xc90], eax
mov eax, dword [ecx]
mov dword [ebp - 0xca0], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ecx + 8]
push edx
mov dword [ebp - 0xc98], eax
call fcn.010389eb
mov ecx, dword [edi + 0x30]
push ecx
mov dword [ebp - 0xcb8], eax
call fcn.010387a2
test eax, eax
je 0x103cb87
mov dword [ebp - 0xc90], ecx
mov eax, dword [edi + 0x2c]
cmp eax, ebx
je 0x103cb94
mov dword [ebp - 0xc98], eax
mov ecx, dword [edi + 0x28]
push ecx
call fcn.010387a2
test eax, eax
je 0x103cba7
mov dword [ebp - 0xcb0], ecx
mov ecx, dword [edi + 0x24]
push ecx
call fcn.010387a2
test eax, eax
je 0x103cbba
mov dword [ebp - 0xca0], ecx
push esi
push dword [edi + 0x20]
call fcn.010387a2
test eax, eax
je 0x103cd83
push 0x122
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x103cd83
push 0x100aa5c
push 0x122
lea eax, [ebp - 0x824]
push eax
call fcn.01028adc
push dword [edi + 0x20]
push 0x1008764
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
mov esi, eax
lea eax, [ebp - 0x824]
push eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [0x104601c]
neg esi
push dword [edi + 0x20]
sbb esi, esi
push 0x100aa50
neg esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x103cc8e
lea eax, [ebp - 0x20c]
push 0x100aa34
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x103cc8b
push dword [edi + 0x20]
push 0x1008764
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103cd83
lea eax, [ebp - 0x20c]
push eax
push dword [0x104601c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103cd83
xor esi, esi
inc esi
cmp esi, ebx
je 0x103cd83
push dword [edi + 0x20]
push 0x1008764
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103ccdc
push 0x100aa34
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0x20c]
push eax
push dword [edi + 0x20]
push 0x100aa50
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [edi]
inc eax
inc eax
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.01028a67
push 0x122
lea eax, [ebp - 0x450]
push eax
push dword [0x104601c]
lea eax, [ebp - 0x20c]
push eax
mov esi, 0x100a9ec
push esi
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
je 0x103cd5f
lea eax, [ebp - 0x450]
push eax
push dword [0x104601c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103cd5f
lea eax, [ebp - 0x450]
push eax
push 0x1003ff0
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103cd83
push dword [edi + 0x20]
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
jmp 0x103cd83
push dword [edi + 0x20]
lea eax, [ebp - 0x20c]
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
call esi
push dword [edi + 0x20]
lea eax, [ebp - 0x20c]
push eax
push 0x100aa0c
call esi
push ebx
push ebx
push ebx
push 6
call fcn.01034068
test eax, eax
jne 0x103cde5
push dword [0x10472a4]
lea eax, [ebp - 0x5e0]
push dword [edi]
push 0x100b09c
push 0xc7
push eax
call fcn.01028b64
add esp, 0x14
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103cde5
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi]
lea eax, [ebp - 0x5e0]
push 0x100b074
push 0xc7
push eax
call fcn.01028b64
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x10
test eax, eax
jl 0x103ce4c
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ce4c
push ebx
push ebx
push ebx
push ebx
push dword [edi + 8]
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x100b020
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ce91
push 2
push 0x1002d58
push 1
push ebx
push dword [edi]
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x100afc8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ced6
push 2
push 0x1002d58
push 1
push ebx
push dword [edi]
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x100af50
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103cf1b
push 2
push 0x1002d58
push 1
push ebx
push dword [edi]
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x100aed8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103cf60
push 2
push 0x1002d58
push 1
push ebx
push dword [edi]
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [edi]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ec66
push dword [edi + 0xc]
mov dword [ebp - 0xc8c], ebx
call fcn.010387a2
test eax, eax
je 0x103d00c
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x100aebc
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103cfd6
cmp dword [ebp - 0xc7c], 1
je 0x103d00c
mov ecx, dword [edi + 0xc]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xca8], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103cfe4
sub eax, dword [ebp - 0xca8]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x100aebc
push dword [ebp - 0xc78]
call esi
push dword [edi + 0x10]
call fcn.010387a2
test eax, eax
je 0x103d08c
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x10044c8
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d056
cmp dword [ebp - 0xc7c], 1
je 0x103d08c
mov ecx, dword [edi + 0x10]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xca8], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103d064
sub eax, dword [ebp - 0xca8]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x10044c8
push dword [ebp - 0xc78]
call esi
cmp dword [ebp - 0xcb8], ebx
je 0x103d16c
call fcn.010387c4
test eax, eax
je 0x103d16c
push dword [edi + 8]
lea eax, [ebp - 0x20c]
push 0x100ae58
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0xc8c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103d104
push 0x4e
push 0x10039a0
push 1
push ebx
push ebx
push dword [ebp - 0xc8c]
call esi
push dword [ebp - 0xc8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi + 8]
lea eax, [ebp - 0x20c]
push 0x100adf8
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0xc8c]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103d1f6
push 0x4e
push 0x10038d8
push 1
push ebx
push ebx
push dword [ebp - 0xc8c]
call esi
push dword [ebp - 0xc8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x103d1f6
push dword [edi + 8]
lea eax, [ebp - 0x20c]
push 0x100ae58
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [edi + 8]
lea eax, [ebp - 0x20c]
push 0x100adf8
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [edi + 8]
lea eax, [ebp - 0x20c]
push 0x100ad90
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d67f
cmp dword [ebp - 0xc7c], 1
jne 0x103d67f
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103d67f
push dword [edi]
call fcn.01039910
test eax, eax
jne 0x103d28d
push dword [edi + 8]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103d276
push 0x10
push 0x100aa84
jmp 0x103d27d
push 0xe
push 0x100ad80
push 1
push ebx
push 0x100aa94
push dword [ebp - 0xc78]
call esi
cmp dword [ebp - 0xc84], ebx
jne 0x103d6b7
lea eax, [ebp - 0x450]
push eax
push 0x100a4f0
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc9c], 1
mov dword [ebp - 0xca8], ebx
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0xc8c]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103d368
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc8c]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d35d
cmp dword [ebp - 0xc7c], 1
je 0x103d32f
cmp dword [ebp - 0xc7c], 2
jne 0x103d35d
lea eax, [ebp - 0xa68]
push eax
call fcn.010387a2
test eax, eax
je 0x103d35d
lea ecx, [ebp - 0xa68]
push ecx
push dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 0xca8], eax
call fcn.010392ed
mov dword [ebp - 0xc9c], eax
push dword [ebp - 0xc8c]
jmp 0x103d41e
push dword [edi]
lea eax, [ebp - 0xc74]
push dword [0x10472a0]
mov dword [ebp - 0xca4], ebx
push 0x10078dc
push 0x104
push eax
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x103d430
lea eax, [ebp - 0xca4]
push eax
push 1
push ebx
lea eax, [ebp - 0xc74]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103d430
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xc74]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x100a3ac
push dword [ebp - 0xca4]
mov dword [ebp - 0xc80], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d418
cmp dword [ebp - 0xc7c], 1
jne 0x103d418
lea eax, [ebp - 0xc74]
push 0x10024b0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103d418
push dword [ebp - 0xca4]
jmp 0x103ec60
push dword [ebp - 0xca4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc9c], ebx
je 0x103d5c4
lea eax, [ebp - 0x450]
push eax
push 0x100a47c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0xc8c]
push eax
push 1
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103d5bc
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc8c]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d5b0
cmp dword [ebp - 0xc7c], 1
jne 0x103d5b0
lea eax, [ebp - 0xa68]
push eax
call fcn.010387a2
test eax, eax
je 0x103d5b0
lea eax, [ebp - 0xa68]
push 0x100a544
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103d5b0
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x450]
push eax
push 0x100a51c
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xca4], ebx
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0xca4]
push eax
push 1
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103d5b0
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xca4]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d5a4
cmp dword [ebp - 0xc7c], 1
je 0x103d576
cmp dword [ebp - 0xc7c], 2
jne 0x103d5a4
lea eax, [ebp - 0xa68]
push eax
call fcn.010387a2
test eax, eax
je 0x103d5a4
lea ecx, [ebp - 0xa68]
push ecx
push dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 0xca8], eax
call fcn.010392ed
mov dword [ebp - 0xc9c], eax
push dword [ebp - 0xca4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc8c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc9c], ebx
jne 0x103d5db
cmp dword [ebp - 0xca8], ebx
je 0x103d5db
mov dword [ebp - 0xc84], 1
jmp 0x103d66a
push dword [edi + 8]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103d624
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103d5fa
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push 1
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
mov ecx, dword [edi + 8]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xca4], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103d632
sub eax, dword [ebp - 0xca4]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
push dword [edi + 8]
lea eax, [ebp - 0x450]
push 0x121
push eax
call fcn.01028a67
cmp dword [ebp - 0xc9c], ebx
jne 0x103d6b7
cmp dword [ebp - 0xca8], ebx
je 0x103d6b7
jmp 0x103ec5a
mov ecx, dword [edi + 8]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc84], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103d68d
sub eax, dword [ebp - 0xc84]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
mov dword [ebp - 0xc84], ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc84], ebx
lea eax, [ebp - 0x450]
jne 0x103d6d4
mov eax, dword [edi + 8]
push eax
push 0xc7
lea eax, [ebp - 0x5e0]
push eax
call fcn.01028a67
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
mov dword [ebp - 0xc9c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103eb1d
push 4
lea eax, [ebp - 0xc80]
push eax
push 4
push ebx
push 0x100ad50
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 1
call esi
push dword [edi]
call fcn.010389bc
test eax, eax
je 0x103d779
push 4
lea eax, [ebp - 0xc84]
push eax
push 3
push ebx
push 0x100a6cc
push dword [ebp - 0xc78]
mov byte [ebp - 0xc84], bl
mov byte [ebp - 0xc83], bl
mov byte [ebp - 0xc82], 1
mov byte [ebp - 0xc81], bl
call esi
jmp 0x103d78a
push 0x100a6cc
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5e0]
push eax
push 0x100a4f0
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103dd8b
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc84], ebx
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d8f1
cmp dword [ebp - 0xc7c], 1
je 0x103d832
cmp dword [ebp - 0xc7c], 2
jne 0x103d8f1
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103d8f1
lea ecx, [ebp - 0x450]
push ecx
push dword [edi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 0xc84], eax
call fcn.010392ed
test eax, eax
je 0x103d99d
lea eax, [ebp - 0x450]
push eax
push 0x121
lea eax, [ebp - 0x824]
push eax
call fcn.01028a67
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x824]
push eax
call fcn.01038841
test eax, eax
jne 0x103d8d5
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103d8a5
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
jmp 0x103d8f1
lea eax, [ebp - 0x824]
push eax
call fcn.010387f5
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0xcc0], 1
cmp dword [edi + 0x38], ebx
mov dword [ebp - 0xcb4], 1
je 0x103d951
push dword [ebp - 0xc98]
call fcn.010387a2
test eax, eax
je 0x103d951
cmp dword [ebp - 0xc84], ebx
je 0x103d92d
push dword [ebp - 0xc98]
lea eax, [ebp - 0x450]
push eax
call fcn.01038ae1
test eax, eax
jne 0x103d99d
mov eax, dword [ebp - 0xc98]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103d936
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc98]
jmp 0x103d991
cmp dword [ebp - 0xc84], ebx
je 0x103d96f
push dword [ebp - 0xc90]
lea eax, [ebp - 0x450]
push eax
call fcn.01038ae1
test eax, eax
jne 0x103d99d
mov eax, dword [ebp - 0xc90]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103d978
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc90]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcb4], ebx
je 0x103dd8b
lea eax, [ebp - 0x5e0]
push eax
push 0x100a4c4
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc84], ebx
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103dab7
lea eax, [ebp - 0x5e0]
push eax
push 0x100a490
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc90], ebx
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0xc90]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103da72
push dword [ebp - 0xc90]
push dword [ebp - 0xc78]
call fcn.01033018
push dword [ebp - 0xc90]
mov dword [ebp - 0xc84], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc84], ebx
je 0x103dab7
lea eax, [ebp - 0x5e0]
push eax
push 0x100a4c4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call fcn.01033666
lea eax, [ebp - 0x5e0]
push eax
push 0x100a8a0
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103dc46
test byte [0x104942c], 1
jne 0x103db1d
or dword [0x104942c], 1
push ebx
push ebx
push ebx
push 6
call fcn.01034068
mov dword [0x1049428], eax
cmp dword [0x1049428], ebx
je 0x103db43
mov eax, dword [ebp - 0xc88]
push dword [eax + 0x10]
push 0x100ad44
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103dc00
cmp dword [ebp - 0xcc0], ebx
mov dword [ebp - 0xc80], 0x244
jne 0x103dbc8
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103dbc8
cmp dword [ebp - 0xc7c], 1
jne 0x103dbc8
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103dbc8
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103db9e
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push 1
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
mov eax, dword [ebp - 0xc88]
mov ecx, dword [eax + 0x10]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc88], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103dbdc
sub eax, dword [ebp - 0xc88]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
cmp dword [ebp - 0xcb8], ebx
je 0x103dc29
cmp dword [ebp - 0xc9c], ebx
je 0x103dc29
push 2
push 0x1002d58
push 1
push ebx
push 0x100a884
push dword [ebp - 0xc78]
call esi
jmp 0x103dc3a
push 0x100a884
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcb8], ebx
je 0x103dd8b
call fcn.010363d6
test eax, eax
jne 0x103dd8b
lea eax, [ebp - 0x5e0]
push eax
push 0x100a8bc
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103dd8b
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x10021cc
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103dd46
cmp dword [ebp - 0xc7c], 1
jne 0x103dd46
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
lea eax, [ebp - 0x450]
push eax
push dword [0x10472a8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0xc
test eax, eax
je 0x103dd46
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103dd18
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a8f0
push dword [ebp - 0xc78]
call esi
mov ecx, dword [0x10472a8]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc88], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103dd57
sub eax, dword [ebp - 0xc88]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x10021cc
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc98]
mov dword [ebp - 0xc9c], ebx
call fcn.010387a2
test eax, eax
jne 0x103ddaf
mov dword [ebp - 0xca0], 0x100a544
jmp 0x103e426
push dword [ebp - 0xca0]
lea eax, [ebp - 0x5e0]
push eax
push 0x100a51c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x14
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103e426
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103df39
cmp dword [ebp - 0xc7c], 1
je 0x103de4b
cmp dword [ebp - 0xc7c], 2
jne 0x103df39
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103df39
lea eax, [ebp - 0x450]
push eax
push 0x121
lea eax, [ebp - 0x824]
push eax
call fcn.01028a67
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x824]
push eax
push dword [edi]
push 1
call fcn.010392ed
test eax, eax
je 0x103df71
lea eax, [ebp - 0x824]
push eax
mov dword [ebp - 0xcbc], 1
call fcn.01038841
test eax, eax
jne 0x103def0
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103dec0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
jmp 0x103df0c
lea eax, [ebp - 0x824]
push eax
call fcn.010387f5
mov dword [ebp - 0xc9c], eax
mov dword [ebp - 0xc94], 1
push dword [ebp - 0xc98]
lea eax, [ebp - 0x450]
push eax
call fcn.01038ae1
test eax, eax
jne 0x103df71
mov eax, dword [ebp - 0xc98]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103df2b
sub eax, edx
jmp 0x103df58
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0xcbc], 1
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103df4c
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc98]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcbc], ebx
je 0x103e426
push dword [ebp - 0xca0]
lea eax, [ebp - 0x5e0]
push eax
push 0x100ad1c
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc88], ebx
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103e09d
push dword [ebp - 0xca0]
lea eax, [ebp - 0x5e0]
push eax
push 0x100a80c
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc90], ebx
call fcn.01028b64
add esp, 0x14
push ebx
lea eax, [ebp - 0xc90]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103e052
push dword [ebp - 0xc90]
push dword [ebp - 0xc78]
call fcn.01033018
push dword [ebp - 0xc90]
mov dword [ebp - 0xc88], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc88], ebx
je 0x103e09d
push dword [ebp - 0xca0]
lea eax, [ebp - 0x5e0]
push eax
push 0x100ad1c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call fcn.01033666
push dword [ebp - 0xca0]
lea eax, [ebp - 0x5e0]
push eax
push 0x100a86c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103e2db
cmp dword [ebp - 0xc94], ebx
mov dword [ebp - 0xc80], 0x244
jne 0x103e180
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103e180
cmp dword [ebp - 0xc7c], 1
je 0x103e139
cmp dword [ebp - 0xc7c], 2
jne 0x103e180
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103e180
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e152
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
push 0x105
lea eax, [ebp - 0xa30]
push eax
call fcn.01033bb5
test eax, eax
je 0x103e267
lea eax, [ebp - 0xa30]
push eax
push 0x100a6b8
lea eax, [ebp - 0xc74]
push 0x105
push eax
call fcn.01028b64
add esp, 0x10
test eax, eax
jl 0x103e267
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x10059e4
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103e234
cmp dword [ebp - 0xc7c], 1
je 0x103e208
cmp dword [ebp - 0xc7c], 2
jne 0x103e234
lea eax, [ebp - 0xc74]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.01038ae1
test eax, eax
jne 0x103e267
lea eax, [ebp - 0xc74]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e228
jmp 0x103e247
lea eax, [ebp - 0xc74]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e23d
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0xc74]
push eax
push 2
push ebx
push 0x10059e4
push dword [ebp - 0xc78]
call esi
mov eax, dword [ebp - 0xcb0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e270
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xcb0]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
cmp dword [ebp - 0xcb8], ebx
je 0x103e2be
cmp dword [ebp - 0xc9c], ebx
je 0x103e2be
push 2
push 0x1002d58
push 1
push ebx
push 0x100a884
push dword [ebp - 0xc78]
call esi
jmp 0x103e2cf
push 0x100a884
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcb8], ebx
je 0x103e426
call fcn.010363d6
test eax, eax
jne 0x103e426
push dword [ebp - 0xca0]
lea eax, [ebp - 0x5e0]
push eax
push 0x100a83c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x14
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103e426
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x10021cc
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103e3e1
cmp dword [ebp - 0xc7c], 1
jne 0x103e3e1
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
lea eax, [ebp - 0x450]
push eax
push dword [0x10472a8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0xc
test eax, eax
je 0x103e3e1
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e3b3
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a8f0
push dword [ebp - 0xc78]
call esi
mov ecx, dword [0x10472a8]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc88], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103e3f2
sub eax, dword [ebp - 0xc88]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x10021cc
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5e0]
push eax
push 0x100a47c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103eb1d
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xcb0], ebx
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103e654
cmp dword [ebp - 0xc7c], 1
jne 0x103e654
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103e654
lea eax, [ebp - 0x450]
push 0x100a544
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103e543
cmp dword [ebp - 0xcb4], ebx
je 0x103e543
cmp dword [ebp - 0xcc0], ebx
je 0x103e4fd
mov dword [ebp - 0xcb0], 1
jmp 0x103e534
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e506
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
mov dword [ebp - 0xcac], 1
jmp 0x103e66c
cmp dword [ebp - 0xcbc], ebx
je 0x103e581
push dword [ebp - 0xca0]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103e581
cmp dword [ebp - 0xc94], ebx
jne 0x103e4f1
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e575
jmp 0x103e510
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x5e0]
push eax
push 0x100a51c
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc94], ebx
call fcn.01028b64
add esp, 0x14
lea eax, [ebp - 0xc94]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103e7bf
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc94]
mov dword [ebp - 0xc80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103e646
cmp dword [ebp - 0xc7c], 1
je 0x103e618
cmp dword [ebp - 0xc7c], 2
jne 0x103e646
lea eax, [ebp - 0x20c]
push eax
call fcn.010387a2
test eax, eax
je 0x103e646
lea eax, [ebp - 0x20c]
push eax
push dword [edi]
push 1
call fcn.010392ed
test eax, eax
je 0x103e646
mov dword [ebp - 0xcac], 1
push dword [ebp - 0xc94]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x103e660
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xcac], eax
cmp dword [ebp - 0xcac], ebx
je 0x103e7bf
mov eax, dword [ebp - 0xca0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e675
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xca0]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
mov ecx, dword [edi + 0xc]
push ecx
call fcn.010387a2
test eax, eax
je 0x103e7bf
push 0x100acfc
push ecx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103e7bf
push 0x1008f94
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103e7bf
push 0x100ace0
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103e7bf
push 0x100acb4
push dword [edi + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103e7bf
push dword [edi]
lea eax, [ebp - 0x20c]
push 0x100ac38
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [edi + 0xc]
lea eax, [ebp - 0x20c]
push 0x100abb0
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [edi]
lea eax, [ebp - 0x20c]
push 0x100ab30
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [edi + 0xc]
lea eax, [ebp - 0x20c]
push 0x100aaa8
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcac], ebx
je 0x103eb1d
push dword [edi + 0x1c]
call fcn.010387a2
test eax, eax
je 0x103e91c
lea eax, [ebp - 0x5e0]
push eax
push 0x100a5a0
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103e91c
cmp dword [ebp - 0xcb0], ebx
mov dword [ebp - 0xc80], 0x244
jne 0x103e8de
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103e8de
cmp dword [ebp - 0xc7c], 1
je 0x103e881
cmp dword [ebp - 0xc7c], 2
jne 0x103e8de
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103e8de
push dword [edi + 0x1c]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103e8de
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e8b0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
mov ecx, dword [edi + 0x1c]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc88], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103e8ec
sub eax, dword [ebp - 0xc88]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [edi + 0x14]
call fcn.010387a2
test eax, eax
je 0x103eb1d
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103eb1d
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc88], 1
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103ea2a
cmp dword [ebp - 0xc7c], 1
jne 0x103ea2a
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103ea2a
push dword [edi + 0x14]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103e9fc
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103e9ce
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
push dword [edi]
push 0x1008bc8
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103ea22
push dword [edi]
push 0x10084c0
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103ea2a
mov dword [ebp - 0xc88], ebx
jmp 0x103ea5c
mov ecx, dword [edi + 0x14]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc94], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103ea38
sub eax, dword [ebp - 0xc94]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
mov edx, dword [edi + 0x18]
push edx
call fcn.010387a2
test eax, eax
je 0x103eaa0
mov eax, edx
lea ecx, [eax + 2]
mov dword [ebp - 0xc94], ecx
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ea74
sub eax, dword [ebp - 0xc94]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push ebx
push 0x1009ab0
push dword [ebp - 0xc78]
push ebx
call fcn.0103376e
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc88], ebx
je 0x103eb1d
push dword [edi + 0xc]
call fcn.010387a2
test eax, eax
je 0x103eb1d
lea eax, [ebp - 0xc78]
push eax
push 2
push ebx
push dword [edi]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103eb1d
mov ecx, dword [edi + 0xc]
mov eax, ecx
lea edx, [eax + 2]
mov dword [ebp - 0xc88], edx
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103eae9
sub eax, dword [ebp - 0xc88]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push ecx
push 1
push ebx
push 0x100aebc
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [edi + 0xc]
push ecx
call fcn.010387a2
test eax, eax
je 0x103ec66
push 0x100acb4
push ecx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103ec66
push dword [edi]
lea eax, [ebp - 0x20c]
push 0x100a968
push 0x103
push eax
call fcn.01028b64
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ec66
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov edi, 0x100a910
jne 0x103ec2c
cmp dword [ebp - 0xc7c], 1
jne 0x103ec2c
lea eax, [ebp - 0x450]
push eax
call fcn.010387a2
test eax, eax
je 0x103ec2c
lea eax, [ebp - 0x450]
push edi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103ec2c
cmp dword [ebp - 0xcac], ebx
je 0x103ec5a
lea eax, [ebp - 0x450]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x103ebfe
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100a340
push dword [ebp - 0xc78]
call esi
cmp dword [ebp - 0xcac], ebx
je 0x103ec5a
push 0x56
push edi
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call esi
push 8
push 0x10024b0
push 1
push ebx
push 0x100a7f0
push dword [ebp - 0xc78]
call esi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 8