Function at 0x3db3c
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0xe
push 0
push 0
dec ecx
jne 0x3db44
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x3e103
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x34], eax
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00013d18
lea eax, [ebp - 0x34]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0x3e114
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov edi, eax
test edi, edi
jne 0x3e0a3
mov eax, 0x186a0
call fcn.0001271c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x186a0
call fcn.00012c70
mov dl, 1
mov eax, dword [0x35908]
call fcn.00012fc0
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], 0x186a0
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x28]
push eax
push 0
push 0x3e14c
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov edi, eax
test edi, edi
jne 0x3e068
cmp dword [ebp - 0x28], 7
jne 0x3e061
cmp dword [ebp - 0x24], 1
jbe 0x3e061
cmp dword [ebp - 0x24], 0x186a0
jae 0x3e061
xor eax, eax
mov dword [ebp - 0x18], eax
mov esi, dword [ebp - 0xc]
jmp 0x3dc45
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.00013ee0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x34]
push esi
call sub.kernel32.dll_lstrlenA_1
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add dword [ebp - 0x18], eax
add esi, dword [ebp - 8]
cmp byte [esi], 0
je 0x3dc53
cmp dword [ebp - 0x18], 0x186a0
jb 0x3dc1d
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x3e05a
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
cmp eax, 0
jb 0x3dcbf
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x3c]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0x3c]
lea edx, [ebp - 0x38]
call fcn.000273cc
mov eax, dword [ebp - 0x38]
push eax
lea edx, [ebp - 0x40]
mov eax, 0x3e164
call fcn.000273cc
mov edx, dword [ebp - 0x40]
pop eax
call fcn.000140b8
jne 0x3dcb6
mov bl, 1
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x44]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
jne 0x3dc74
test bl, bl
je 0x3e03e
mov eax, dword [ebp - 0x24]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0x3e170
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x3e037
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x186a0
call fcn.00012c70
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jb 0x3dd62
inc ebx
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00013fa8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
call fcn.00014178
mov edx, esi
mov ecx, dword [ebp - 8]
call fcn.0001291c
mov eax, dword [ebp - 8]
inc eax
add esi, eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x2c]
dec ebx
jne 0x3dd21
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0x3e14c
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x3e00c
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x40]
mov edx, 0x3e164
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 0x186a0
call fcn.00012c70
mov esi, dword [ebp - 0xc]
xor eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jb 0x3de0f
inc ebx
mov dword [ebp - 0x2c], 0
lea ecx, [ebp - 0x10]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00013fa8
mov dword [ebp - 8], eax
lea eax, [ebp - 0x10]
call fcn.00014178
mov edx, esi
mov ecx, dword [ebp - 8]
call fcn.0001291c
mov eax, dword [ebp - 8]
inc eax
add esi, eax
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x2c]
dec ebx
jne 0x3ddce
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x28]
push eax
push 0
push 0x3e180
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegSetValueExA
mov edi, eax
test edi, edi
jne 0x3dfde
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x10]
mov edx, 0x3e198
call fcn.00013db0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegCreateKeyExA
mov edi, eax
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, case.0x1ffea.3
push eax
push 0
push 0x3e1dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov esi, eax
test edi, edi
jne 0x3df64
test esi, esi
jne 0x3df64
xor eax, eax
mov dword [ebp - 0x2c], eax
mov eax, 0x186a0
call fcn.0001271c
mov esi, eax
mov eax, 0x186a0
call fcn.0001271c
mov ebx, eax
mov dword [ebp - 0x18], 0x186a0
mov dword [ebp - 8], 0x186a0
mov eax, esi
xor ecx, ecx
mov edx, 0x186a0
call fcn.00012c70
mov eax, ebx
xor ecx, ecx
mov edx, 0x186a0
call fcn.00012c70
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumValueA
mov edi, eax
test edi, edi
jne 0x3df34
mov eax, dword [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 0x28]
push eax
push 0
push esi
mov eax, dword [ebp - 0x30]
push eax
call sub.advapi32.dll_RegSetValueExA
inc dword [ebp - 0x2c]
test edi, edi
je 0x3ded2
mov eax, ebx
call fcn.00012734
mov eax, esi
call fcn.00012734
push ebp
mov eax, 0x3e164
call fcn.0003d658
pop ecx
test al, al
jne 0x3df60
mov ebx, 0xa
jmp 0x3dfb1
xor ebx, ebx
jmp 0x3dfb1
mov ebx, 0xb
push ebp
lea edx, [ebp - 0x48]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x48]
lea eax, [ebp - 0x44]
mov edx, 0x3e228
call fcn.00013ff4
mov eax, dword [ebp - 0x44]
call fcn.0003d5ac
pop ecx
push ebp
lea edx, [ebp - 0x50]
mov eax, esi
call fcn.00027478
mov ecx, dword [ebp - 0x50]
lea eax, [ebp - 0x4c]
mov edx, 0x3e23c
call fcn.00013ff4
mov eax, dword [ebp - 0x4c]
call fcn.0003d5ac
pop ecx
cmp dword [ebp - 0x30], 0
je 0x3dfc0
mov eax, dword [ebp - 0x30]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp dword [ebp - 0x1c], 0
je 0x3dfcf
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x3e091
mov ebx, 9
push ebp
lea edx, [ebp - 0x58]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x54]
mov edx, 0x3e250
call fcn.00013ff4
mov eax, dword [ebp - 0x54]
call fcn.0003d5ac
pop ecx
jmp 0x3e091
mov ebx, 6
push ebp
lea edx, [ebp - 0x60]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x60]
lea eax, [ebp - 0x5c]
mov edx, 0x3e260
call fcn.00013ff4
mov eax, dword [ebp - 0x5c]
call fcn.0003d5ac
pop ecx
jmp 0x3e091
mov ebx, 5
jmp 0x3e091
mov ebx, 7
push ebp
mov eax, 0x3e164
call fcn.0003d658
pop ecx
test al, al
jne 0x3e091
mov ebx, 0xa
jmp 0x3e091
mov ebx, 4
jmp 0x3e091
mov ebx, 3
jmp 0x3e091
mov ebx, 2
push ebp
lea edx, [ebp - 0x68]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x64]
mov edx, 0x3e270
call fcn.00013ff4
mov eax, dword [ebp - 0x64]
call fcn.0003d5ac
pop ecx
mov eax, dword [ebp - 0x20]
call fcn.00012ff0
mov eax, dword [ebp - 0xc]
call fcn.00012734
jmp 0x3e0cc
mov ebx, 1
push ebp
lea edx, [ebp - 0x70]
mov eax, edi
call fcn.00027478
mov ecx, dword [ebp - 0x70]
lea eax, [ebp - 0x6c]
mov edx, 0x3e280
call fcn.00013ff4
mov eax, dword [ebp - 0x6c]
call fcn.0003d5ac
pop ecx
cmp dword [ebp - 0x34], 0
je 0x3e0db
mov eax, dword [ebp - 0x34]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x34], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3e10a
lea eax, [ebp - 0x70]
mov edx, 0xf
call fcn.00013d3c
lea eax, [ebp - 0x10]
call fcn.00013d18
ret