Function at 0x1033e89
Capabilities:
Delete registry key
Delete registry value
Persist via default file association registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xae0
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
xor esi, esi
mov dword [ebp - 0xabc], eax
mov dword [ebp - 0xac8], ecx
mov dword [ebp - 0xae0], ebx
mov dword [ebp - 0xab0], esi
mov dword [ebp - 0xab8], esi
mov dword [ebp - 0xab4], 1
mov dword [ebp - 0xac0], esi
cmp eax, esi
je 0x10350c1
push edi
lea ecx, [ebp - 0xab0]
push ecx
push 0x2001f
push esi
push eax
mov edi, 0x80000000
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10350be
push dword [ebp - 0xab0]
inc eax
mov dword [ebp - 0xad4], esi
mov dword [ebp - 0xac4], eax
mov dword [ebp - 0xadc], esi
mov dword [ebp - 0xad0], eax
mov dword [ebp - 0xad8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xabc]
mov ebx, 0x103
push 0x1004250
lea eax, [ebp - 0x450]
push ebx
push eax
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10340f8
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push esi
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10340ec
cmp dword [ebp - 0xab4], 1
je 0x1033fbd
cmp dword [ebp - 0xab4], 2
jne 0x10340ec
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x10340ec
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.01031552
test eax, eax
je 0x10340ec
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xac4], esi
mov dword [ebp - 0xad4], 1
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10340ec
cmp dword [ebp - 0xab4], 1
je 0x1034052
cmp dword [ebp - 0xab4], 2
jne 0x10340ec
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x694]
push eax
call fcn.01027e68
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x694]
push eax
call fcn.01031552
test eax, eax
jne 0x10340ec
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034091
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0xab4]
push esi
push esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1006c14
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x694]
push eax
call fcn.010315f5
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xac4], 1
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x1006be0
push ebx
push eax
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034261
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x1001b94
push dword [ebp - 0xab0]
mov dword [ebp - 0xacc], esi
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103423f
cmp dword [ebp - 0xab4], 1
jne 0x103423f
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
lea eax, [ebp - 0x248]
push eax
push dword [0x103f074]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0xc
test eax, eax
jne 0x103423f
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x1006c14
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034235
cmp dword [ebp - 0xab4], 1
jne 0x1034235
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10341f4
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push esi
push 0x1001b94
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1006c14
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x103423f
mov dword [ebp - 0xacc], 1
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xacc], esi
je 0x1034261
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0xad4], esi
je 0x1034498
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x1006bc4
push ebx
push eax
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0xab0]
push eax
push 0x20006
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10342c4
push 0x1006500
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x10067a8
push ebx
push eax
call fcn.01027f64
add esp, 0x10
cmp dword [ebp - 0xac0], esi
je 0x10343b1
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10343b1
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x10067dc
push ebx
push eax
mov dword [ebp - 0xac0], esi
call fcn.01027f64
add esp, 0x10
push esi
lea eax, [ebp - 0xac0]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103437d
push dword [ebp - 0xac0]
push dword [ebp - 0xab0]
call fcn.0102f291
test eax, eax
je 0x1034371
mov dword [ebp - 0xac4], 1
push dword [ebp - 0xac0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x10067a8
push ebx
push eax
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.0102f8ce
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x1006bc4
push ebx
push eax
call fcn.01027f64
add esp, 0x10
cmp dword [ebp - 0xac4], esi
je 0x103448b
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034498
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103447d
cmp dword [ebp - 0xab4], 1
jne 0x103447d
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034442
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push esi
push esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10064bc
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1034498
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.0102f8ce
mov dword [ebp - 0xac0], esi
cmp dword [ebp - 0xac8], esi
je 0x1034ad8
push dword [ebp - 0xac8]
lea eax, [ebp - 0x450]
push dword [ebp - 0xabc]
push 0x1006808
push ebx
push eax
call fcn.01027f64
add esp, 0x14
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10346d7
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push esi
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10346cb
cmp dword [ebp - 0xab4], 1
je 0x1034539
cmp dword [ebp - 0xab4], 2
jne 0x10346cb
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x10346cb
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.01031552
test eax, eax
je 0x10346cb
push dword [ebp - 0xac8]
lea eax, [ebp - 0x450]
push dword [ebp - 0xabc]
mov dword [ebp - 0xac4], esi
push 0x1006bac
push ebx
push eax
mov dword [ebp - 0xad0], esi
mov dword [ebp - 0xadc], 1
call fcn.01027f64
add esp, 0x14
lea eax, [ebp - 0xac4]
push eax
push 0x20006
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10345e2
push 0x1006500
push dword [ebp - 0xac4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xac4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10346cb
cmp dword [ebp - 0xab4], 1
je 0x1034631
cmp dword [ebp - 0xab4], 2
jne 0x10346cb
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x694]
push eax
call fcn.01027e68
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x694]
push eax
call fcn.01031552
test eax, eax
jne 0x10346cb
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034670
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0xab4]
push esi
push esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1006c14
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x694]
push eax
call fcn.010315f5
mov dword [ebp - 0xac0], eax
mov dword [ebp - 0xad0], 1
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xac8]
lea eax, [ebp - 0x450]
push dword [ebp - 0xabc]
push 0x1006b7c
push ebx
push eax
call fcn.01027f64
add esp, 0x14
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034846
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x1001b94
push dword [ebp - 0xab0]
mov dword [ebp - 0xacc], esi
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034824
cmp dword [ebp - 0xab4], 1
jne 0x1034824
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
lea eax, [ebp - 0x248]
push eax
push dword [0x103f074]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0xc
test eax, eax
jne 0x1034824
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x1006c14
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103481a
cmp dword [ebp - 0xab4], 1
jne 0x103481a
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10347d9
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push esi
push 0x1001b94
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1006c14
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1034824
mov dword [ebp - 0xacc], 1
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xacc], esi
je 0x1034846
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0xadc], esi
je 0x1034ad8
push dword [ebp - 0xac8]
lea eax, [ebp - 0x450]
push dword [ebp - 0xabc]
push 0x1006b4c
push ebx
push eax
call fcn.01027f64
add esp, 0x14
cmp dword [ebp - 0xac0], esi
je 0x1034951
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034951
push dword [ebp - 0xac8]
lea eax, [ebp - 0x450]
push dword [ebp - 0xabc]
mov dword [ebp - 0xac4], esi
push 0x1006b4c
push ebx
push eax
call fcn.01027f64
add esp, 0x14
push esi
lea eax, [ebp - 0xac4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1034917
push dword [ebp - 0xac4]
push dword [ebp - 0xab0]
call fcn.0102f291
test eax, eax
je 0x103490b
mov dword [ebp - 0xad0], 1
push dword [ebp - 0xac4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xac8]
lea eax, [ebp - 0x450]
push dword [ebp - 0xabc]
push 0x1006b4c
push ebx
push eax
call fcn.01027f64
add esp, 0x14
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.0102f8ce
push dword [ebp - 0xac8]
lea eax, [ebp - 0x450]
push dword [ebp - 0xabc]
push 0x1006bac
push ebx
push eax
call fcn.01027f64
add esp, 0x14
cmp dword [ebp - 0xad0], esi
je 0x1034acb
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034ad8
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034a23
cmp dword [ebp - 0xab4], 1
jne 0x1034a23
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x10349e8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push esi
push esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10064bc
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xac8]
call fcn.010313bf
test eax, eax
je 0x1034abd
push 0x100648c
push dword [ebp - 0xac8]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1034abd
push 0x105
lea eax, [ebp - 0xaac]
push eax
call fcn.0102fc69
test eax, eax
je 0x1034abd
lea eax, [ebp - 0xaac]
push eax
push 0x10069e0
lea eax, [ebp - 0x8a0]
push 0x105
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x1034abd
lea eax, [ebp - 0x8a0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034a8f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x8a0]
push eax
push 2
push esi
push 0x1004364
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1034ad8
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.0102f8ce
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x1006794
push ebx
push eax
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1035041
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push esi
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034d74
cmp dword [ebp - 0xab4], 1
jne 0x1034d74
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1034d74
lea eax, [ebp - 0x248]
push 0x1006830
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1034c08
cmp dword [ebp - 0xad4], esi
je 0x1034c08
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xad8], 1
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034c02
cmp dword [ebp - 0xab4], 1
jne 0x1034c02
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034be1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
jmp 0x1034d55
push esi
jmp 0x1034d68
cmp dword [ebp - 0xadc], esi
je 0x1034d74
push dword [ebp - 0xac8]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1034d74
push 0x100648c
push dword [ebp - 0xac8]
mov dword [ebp - 0xad8], 1
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1034ce5
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x1004364
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034ce5
cmp dword [ebp - 0xab4], 1
je 0x1034c9d
cmp dword [ebp - 0xab4], 2
jne 0x1034ce5
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1034ce5
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x248]
mov dword [esp], 0x10020ac
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x1034ce5
push 0x1004364
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034d74
cmp dword [ebp - 0xab4], 1
je 0x1034d2c
cmp dword [ebp - 0xab4], 2
jne 0x1034d74
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034d35
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0xab4]
push esi
push esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10064bc
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xad8], esi
je 0x1035041
push 0x1006474
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x10031d4
push ebx
push eax
mov dword [ebp - 0xac0], esi
call fcn.01027f64
add esp, 0x14
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1034e82
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1034e6e
cmp dword [ebp - 0xab4], 1
je 0x1034e1c
cmp dword [ebp - 0xab4], 2
jne 0x1034e6e
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034e25
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0xab4]
push esi
push esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10064bc
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0xac0], 1
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xac0], esi
jne 0x1034e8f
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.0102f8ce
push 0x1001b94
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x10031d4
push ebx
push eax
mov dword [ebp - 0xac0], 1
call fcn.01027f64
add esp, 0x14
lea eax, [ebp - 0xab0]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1035041
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x1006b30
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1035020
cmp dword [ebp - 0xab4], 1
jne 0x1035020
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push esi
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1035020
cmp dword [ebp - 0xab4], 1
jne 0x1035020
lea eax, [ebp - 0x7c4]
push eax
call fcn.010313bf
test eax, eax
je 0x1035020
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c4]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x1035020
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x7c4]
push eax
lea eax, [ebp - 0xab4]
push eax
push esi
push 0x10064bc
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103501a
cmp dword [ebp - 0xab4], 1
jne 0x103501a
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x1034fdd
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push esi
push esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x10064bc
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x1035020
mov dword [ebp - 0xac0], esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xac0], esi
jne 0x1035041
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.0102f8ce
push dword [ebp - 0xabc]
lea eax, [ebp - 0x450]
push 0x1006794
push ebx
push eax
call fcn.01027f64
add esp, 0x10
lea eax, [ebp - 0xab0]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10350c0
push esi
push esi
push esi
push esi
lea eax, [ebp - 0xab8]
push eax
lea eax, [ebp - 0x248]
push eax
push esi
push dword [ebp - 0xab0]
mov dword [ebp - 0xab8], 0x122
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x10350b0
mov eax, dword [ebp - 0xae0]
mov dword [eax], esi
push dword [ebp - 0xab0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10350c0
mov dword [ebx], esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 0xc