Function at 0xd290920
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x8dc
mov eax, dword [0xd2b0418]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 4
push edi
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x8cc], 0
mov dword [ebp - 0x8dc], eax
mov dword [ebp - 0x8d0], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x8d4], eax
call fcn.0d290660
movzx eax, byte [esi + 0xa9]
mov ecx, dword [esi + 0xac]
mov edx, dword [ecx + eax*4 + 0x4c]
mov eax, dword [esi + 0x118]
mov ecx, dword [ebp - 0x8d4]
push edx
push esi
push eax
push ecx
push 0xd273258
lea edx, [ebp - 0x66c]
push 0x12c
push edx
call sub.msvcrt.dll_swprintf_s
lea eax, [ebp - 0x66c]
push eax
push 0xd273300
push 0x12b
lea ecx, [ebp - 0x8c4]
push 0x12c
push ecx
call sub.msvcrt.dll__snwprintf_s
add esp, 0x30
test eax, eax
jge 0xd290a2c
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0xb3b0
call fcn.0d29fa20
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x414]
push 0x104
push edx
call sub.msvcrt.dll_swprintf_s
mov edx, dword [esi + 0x7c]
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [esi + 0x6c]
push ecx
push edx
push 0x3f
call fcn.0d288e10
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea eax, [ebp - 0x8d8]
push eax
push edi
push 0
push 0xf003f
push 1
push 0xd27348c
push 0
lea ecx, [ebp - 0x8c4]
push ecx
push 0x80000002
call ebx
test eax, eax
je 0xd290ac5
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0xb3b0
call fcn.0d29fa20
lea eax, [ebp - 0x66c]
push eax
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push 0x104
push edx
call sub.msvcrt.dll_swprintf_s
mov edx, dword [esi + 0x7c]
add esp, 0x10
push 0
push 0
lea eax, [ebp - 0x20c]
push eax
lea ecx, [esi + 0x6c]
push ecx
push edx
push 1
call fcn.0d288e10
pop ebx
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x8d0]
or dword [esi + 0x5c], 0x8000
mov edx, dword [edi]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
lea ecx, [ebp - 0x8d4]
push ecx
push 4
push 0
push 0xd2731f4
push edx
call edi
test eax, eax
je 0xd290b58
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0xb3b0
call fcn.0d29fa20
lea ecx, [ebp - 0x66c]
push ecx
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_swprintf_s
mov eax, dword [esi + 0x7c]
add esp, 0x10
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [esi + 0x6c]
push edx
push eax
push 0x3f
call fcn.0d288e10
pop ebx
pop edi
or eax, 0xffffffff
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x8d8]
push ecx
lea edx, [ebp - 0x8c8]
push edx
push 0
push 0xf003f
push 1
push 0xd273478
push 0
push 0xd273208
push 0x80000002
call ebx
test eax, eax
jne 0xd290beb
lea eax, [ebp - 0x8d0]
push eax
mov eax, dword [ebp - 0x8c8]
lea ecx, [ebp - 0x8cc]
push ecx
lea edx, [ebp - 0x8dc]
push edx
push 0
push 0xd2731d0
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x8c8]
inc dword [ebp - 0x8cc]
push 4
lea ecx, [ebp - 0x8cc]
push ecx
push 4
push 0
push 0xd2731d0
push edx
mov dword [ebp - 0x8d0], 4
call edi
test eax, eax
je 0xd290c0b
mov eax, dword [ebp - 0x8c8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
mov ebx, 0xd273208
call fcn.0d2905d0
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x8c8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop ebx
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.0d2a6cd9
mov esp, ebp
pop ebp
ret