Function at 0x101b763
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x102a0ec]
mov ecx, dword [ebp + 8]
push ebx
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
inc eax
push edi
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x258]
push eax
xor edi, edi
mov ebx, 0x2001f
push ebx
push edi
push ecx
push 0x80000000
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], edi
call esi
test eax, eax
jne 0x101bcfa
lea eax, [ebp - 0x24c]
push eax
push ebx
push edi
push 0x1007520
push dword [ebp - 0x258]
mov dword [ebp - 0x24c], edi
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, 0x1007504
jne 0x101b920
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101b908
cmp dword [ebp - 0x250], 1
je 0x101b839
cmp dword [ebp - 0x250], 2
jne 0x101b908
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101b908
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.0101b4c4
test eax, eax
jne 0x101b886
push dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x258]
call esi
jmp 0x101bcfa
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101b902
cmp dword [ebp - 0x250], 1
je 0x101b8c5
cmp dword [ebp - 0x250], 2
jne 0x101b902
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x101b908
mov dword [ebp - 0x25c], edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x25c], edi
je 0x101ba6c
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x10074ec
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101ba7c
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push 0x10074dc
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101b9d1
cmp dword [ebp - 0x250], 1
je 0x101b989
cmp dword [ebp - 0x250], 2
jne 0x101b9d1
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101b9d1
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x248]
mov dword [esp], 0x1001cd4
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x101b9d1
push 0x10074dc
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101ba51
cmp dword [ebp - 0x250], 1
je 0x101ba10
cmp dword [ebp - 0x250], 2
jne 0x101ba51
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101ba51
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x101ba52
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101ba7c
push 0x10074ec
push dword [ebp - 0x258]
call fcn.01017d6c
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x10074d0
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101bbb1
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101bb0d
cmp dword [ebp - 0x250], 1
jne 0x101bb0d
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101bb0d
lea eax, [ebp - 0x248]
push 0x1004490
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [ebp - 0x260], eax
je 0x101bb99
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101bb84
cmp dword [ebp - 0x250], 1
jne 0x101bb84
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101bb84
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x101bb8d
cmp dword [ebp - 0x25c], edi
jne 0x101bb99
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x260], edi
je 0x101bcee
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x10074b8
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101bc6d
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101bc61
cmp dword [ebp - 0x250], 1
je 0x101bc16
cmp dword [ebp - 0x250], 2
jne 0x101bc61
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101bc61
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x258]
mov dword [ebp - 0x254], 0x244
call ebx
test eax, eax
jne 0x101bcee
cmp dword [ebp - 0x250], 1
jne 0x101bcee
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101bcee
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret 4