Function at 0x1009b58
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x208]
sub esp, 0x288
mov eax, dword [0x10171b0]
push esi
push edi
push 0x2c
mov dword [ebp + 0x204], eax
call fcn.01012145
test eax, eax
pop ecx
je 0x1009b8a
mov ecx, eax
call fcn.010056f6
mov esi, eax
jmp 0x1009b8c
xor esi, esi
test esi, esi
je 0x1009baa
mov eax, dword [esi]
lea ecx, [ebp - 0x44]
push ecx
push 0x100147c
push esi
call dword [eax]
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
test edi, edi
je 0x1009bb1
xor eax, eax
jmp 0x1009df7
mov eax, dword [ebp - 0x44]
push ebx
mov ebx, dword [ebp + 0x210]
test ebx, ebx
lea edi, [ebp + 0x1f4]
je 0x1009e0e
and dword [ebp - 0x34], 0
and dword [ebp - 0x3c], 0
mov ebx, 0x100140c
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
movsd dword es:[edi], dword [esi]
push 0
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp eax, 0x80070002
jne 0x1009c24
mov eax, dword [ebp - 0x44]
mov esi, ebx
lea edi, [ebp + 0x1f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
push 0
push 0x1001d84
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x3c], 1
test eax, eax
jne 0x1009d41
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push 5
pop esi
push esi
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x48]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x1009d38
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x80]
push edx
mov word [ebp - 0x80], 0x30
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x1009d2f
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], esi
lea edx, [ebp - 0x80]
xor esi, esi
push edx
mov word [ebp - 0x80], 0x30
mov dword [ebp - 0x64], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x38]
push edx
push eax
call dword [ecx + 0x5c]
test eax, eax
jl 0x1009d26
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea edx, [ebp - 0x4c]
push edx
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x1009cd4
mov eax, dword [ebp + 0x218]
mov ecx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
and eax, 0xffffffc0
add eax, 0x40
and ecx, 0xffffffbf
or eax, ecx
mov ecx, dword [ebp - 0x38]
or eax, 0x2000
push eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x70]
cmp dword [ebp - 0x3c], esi
je 0x1009cfe
push 0x111
push 0x1001854
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x30], si
call fcn.01013315
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x214]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp + 0x210]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor edi, edi
push 0x1001540
push edi
push edi
lea ecx, [ebp + 0x1f8]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], 4
call fcn.01005e49
push 0xffffffffffffffff
lea ecx, [ebp + 0x1f8]
call fcn.01005e93
push 1
push 0x2001f
push 2
call fcn.010094e3
cmp eax, edi
mov dword [ebp - 0x3c], eax
je 0x1009dde
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x40]
push ecx
push edi
push 0x10
mov esi, 0x1001d78
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x1009dd2
mov eax, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
and eax, 0xffffffdf
push 4
and ebx, 0x20
or ebx, eax
lea eax, [ebp - 0x40]
push eax
push 4
push edi
push esi
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
lea ecx, [ebp + 0x1f8]
call fcn.01005ebc
lea ecx, [ebp + 0x1f8]
call fcn.01005e6e
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x204]
pop edi
pop esi
call fcn.0101206b
add ebp, 0x208
leave
ret 0xc
mov esi, 0x100140c
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x1009d47