Function at 0x100b928
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1440
call fcn.0100ee80
mov eax, dword [0x1012288]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1438], eax
xor eax, eax
push esi
push edi
xor esi, esi
mov edx, 0x81
mov ecx, edx
mov dword [ebp - 0x81c], esi
lea edi, [ebp - 0x818]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov ecx, edx
mov dword [ebp - 0x610], esi
lea edi, [ebp - 0x60c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
push 0x7e
pop edx
mov dword [ebp - 0x404], esi
mov ecx, edx
lea edi, [ebp - 0x400]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x204], esi
mov ecx, edx
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0xa1c], esi
mov ecx, edx
lea edi, [ebp - 0xa18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0xe1c], esi
mov ecx, edx
lea edi, [ebp - 0xe18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0xc1c], esi
mov ecx, edx
lea edi, [ebp - 0xc18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov dword [ebp - 0x1430], esi
mov ecx, 0x183
lea edi, [ebp - 0x142c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1434]
push eax
push 0xf003f
push esi
push 0x10028e8
push 0x80000002
mov dword [ebp - 0x1434], esi
mov dword [ebp - 0x1440], esi
mov dword [ebp - 0x143c], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x1434], esi
je 0x100bbf3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x143c]
push eax
lea eax, [ebp - 0x1440]
push eax
push esi
push esi
push 0x10028c8
push dword [ebp - 0x1434]
call edi
cmp dword [ebp - 0x1440], esi
je 0x100bbe7
push ebx
lea eax, [ebp - 0x143c]
push eax
lea eax, [ebp - 0x81c]
push eax
push esi
push esi
push 0x10028b4
push dword [ebp - 0x1434]
mov ebx, 0x20a
mov dword [ebp - 0x143c], ebx
call edi
lea eax, [ebp - 0x143c]
push eax
lea eax, [ebp - 0x610]
push eax
push esi
push esi
push 0x1002894
push dword [ebp - 0x1434]
mov dword [ebp - 0x143c], ebx
call edi
cmp word [ebp - 0x81c], si
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
mov ebx, 0xff
lea eax, [ebp - 0x404]
push ebx
push eax
je 0x100bb00
push 0x2f8
push dword [ebp - 0x1438]
call edi
lea eax, [ebp - 0x81c]
push eax
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0xa1c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xa1c]
jmp 0x100bb13
push 0x2f9
push dword [ebp - 0x1438]
call edi
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x1430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp word [ebp - 0x610], si
lea eax, [ebp - 0x204]
push ebx
push eax
je 0x100bb65
push 0x2fa
push dword [ebp - 0x1438]
call edi
lea eax, [ebp - 0x610]
push eax
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0xe1c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0xe1c]
jmp 0x100bb78
push 0x2fb
push dword [ebp - 0x1438]
call edi
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x1430]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
lea eax, [ebp - 0xc1c]
push eax
push 0x1f4
push dword [ebp - 0x1438]
call edi
push 0x30
lea eax, [ebp - 0xc1c]
push eax
lea eax, [ebp - 0x1430]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
push 4
lea eax, [ebp - 0x1440]
push eax
push 4
push esi
push 0x10028c8
push dword [ebp - 0x1434]
mov dword [ebp - 0x1440], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop ebx
jmp 0x100bbf5
push dword [ebp - 0x1434]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.0100ecf8
leave
ret