Function at 0x7cf732fe
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_Ordinal_344]
push esi
lea eax, [ebp - 0x10]
push edi
xor esi, esi
push eax
push esi
push esi
mov edi, 0x7cf399a0
push 0x7cf33548
push edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov word [ebp - 0x424], si
mov word [ebp - 0x62c], si
call ebx
test eax, eax
jl 0x7cf7365a
lea eax, [ebp - 0xc]
push eax
push esi
push 1
push 0x7cf33548
push edi
call ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jge 0x7cf7346a
lea eax, [ebp - 0xc]
push eax
push 1
push 1
push 0x7cf33548
push 0x7cf399a0
call ebx
test eax, eax
jl 0x7cf7365a
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x7cf7365a
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push esi
push esi
push dword [ebp - 0xc]
call ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x7cf321cc
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x7cf7365a
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push esi
push 0x7cf321cc
push dword [ebp - 0xc]
call ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push 0x7cf321c0
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x7cf7365a
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push esi
push 0x7cf321c0
push dword [ebp - 0xc]
call ebx
jmp 0x7cf73470
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x7cf734d9
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x208
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x7cf7365a
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push esi
push esi
push dword [ebp - 0xc]
call ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 8], esi
mov dword [ebp - 4], 0x208
mov eax, 0x7cf321cc
jne 0x7cf73503
mov eax, 0x7cf321c0
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x7cf73589
cmp dword [ebp + 8], esi
mov dword [ebp - 4], 0x208
mov eax, 0x7cf321cc
jne 0x7cf73533
mov eax, 0x7cf321c0
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [ebp - 0x10]
call edi
test eax, eax
jne 0x7cf7365a
cmp dword [ebp + 8], esi
mov dword [ebp - 0x14], 0x7cf321cc
jne 0x7cf73564
mov dword [ebp - 0x14], 0x7cf321c0
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push esi
push dword [ebp - 0x14]
push dword [ebp - 0xc]
call ebx
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x62c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x7cf7365a
cmp dword [ebp + 8], esi
mov dword [ebp - 4], 0x208
mov eax, 0x7cf321cc
jne 0x7cf735cf
mov eax, 0x7cf321c0
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 0x21c]
push ecx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [ebp - 0xc]
call edi
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push esi
push esi
push dword [ebp - 0xc]
call ebx
push 0x2c
lea eax, [ebp - 0x424]
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
mov edi, eax
cmp edi, esi
je 0x7cf7365a
lea eax, [edi + 2]
push eax
call dword [sym.imp.SHLWAPI.dll_StrToIntW]
mov ebx, eax
lea eax, [ebp - 0x424]
push eax
mov word [edi], si
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
push esi
push ebx
push edi
call fcn.7cf504eb
push eax
push esi
push ebx
push edi
call sym.SHELL32.dll_SHUpdateImageW
push esi
push esi
push 0x1000
push esi
call sym.SHELL32.dll_SHChangeNotify
cmp dword [ebp - 0x10], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x7cf7366a
push dword [ebp - 0x10]
call edi
cmp dword [ebp - 0xc], esi
je 0x7cf73674
push dword [ebp - 0xc]
call edi
pop edi
pop esi
pop ebx
leave
ret 4