Function at 0x10079eb4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x340
mov eax, 0x100353d6
call fcn.1002c4c6
mov ebx, ecx
push 7
pop ecx
mov esi, 0x100078c8
lea edi, [ebp - 0x21c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x1ea
mov dword [ebp - 0x348], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x344], eax
xor edi, edi
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x1fe]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x338]
push 0x100a7388
call fcn.10037ec3
push 0x110
lea eax, [ebp - 0x32c]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebx], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x330], 0x114
lea ecx, [ebp - 0x330]
call fcn.100749b9
test eax, eax
jne 0x10079f85
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10079f65
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10079f7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x10079fea
movzx esi, si
or esi, 0x80070000
jmp 0x10079fea
mov esi, 0x80004005
jmp 0x10079fea
cmp dword [ebp - 0x32c], 6
ja 0x1007a15f
jne 0x10079fa1
cmp dword [ebp - 0x328], 1
je 0x1007a15f
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x10079ffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10079fcd
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x10079fe3
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x10079fe8
movzx eax, ax
or eax, 0x80070000
jmp 0x10079fe8
mov eax, 0x80004005
mov esi, eax
lea ecx, [ebp - 0x338]
call fcn.10037f76
mov eax, esi
jmp 0x1007a16c
cmp dword [ebp - 0x340], 0
je 0x1007a15f
push edi
lea eax, [ebp - 0x334]
push eax
push edi
push 0xf013f
push 1
push edi
push edi
push 0x10007324
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x1007a045
jle 0x1007a141
movzx esi, si
or esi, 0x80070000
jmp 0x1007a141
lea eax, [ebp - 0x33c]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x21c]
call fcn.1003ef70
mov esi, eax
test esi, esi
js 0x1007a141
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x21c]
add ecx, ecx
push ecx
push eax
push 2
push edi
push 0x10007360
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1007a09c
jg 0x1007a097
mov esi, eax
jmp 0x1007a141
movzx esi, ax
jmp 0x1007a03a
mov eax, 0x208
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x348]
push eax
push edi
push 0x10007360
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007a08e
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.1003a500
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x338]
call fcn.1003a440
push edi
push 0x10007388
lea ecx, [ebp - 0x338]
mov dword [ebp - 4], edi
call fcn.10078aa2
test eax, eax
js 0x1007a141
mov dword [ebx], 1
jmp 0x1007a141
cmp dword [ebp - 0x334], 0
je 0x10079fea
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10079fea
lea ecx, [ebp - 0x338]
call fcn.10037f76
xor eax, eax
call fcn.1002c418
ret