Function at 0x103bdc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x23
push 0
push 0
dec ecx
jne 0x103be4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x10443c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.000143f0
mov byte [ebp - 0x31], 0
lea eax, [ebp - 0x54]
call fcn.00027684
mov eax, dword [ebp - 0x54]
lea edx, [ebp - 0x50]
call fcn.00027578
mov edx, dword [ebp - 0x50]
lea eax, [ebp - 0x28]
mov ecx, 0x104458
call fcn.00013ff4
lea eax, [ebp - 0x60]
call fcn.00027b40
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.00027578
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x64]
call fcn.00025994
mov edx, dword [ebp - 0x64]
pop eax
call fcn.00013fb0
mov eax, dword [ebp - 0x5c]
lea edx, [ebp - 0x58]
call fcn.00027578
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x68]
call fcn.00026ad0
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0xc]
pop edx
call fcn.00013ff4
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
mov eax, dword [0x2514d0]
mov eax, dword [eax]
add eax, 0xf003f
push eax
push 0
lea eax, [ebp - 0x6c]
call fcn.00026f34
mov eax, dword [ebp - 0x6c]
call fcn.0001416c
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x103cea
push ebp
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 0x20]
call fcn.00027478
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x74]
mov edx, 0x104470
call fcn.00013ff4
mov edx, dword [ebp - 0x74]
lea eax, [ebp - 0x70]
call fcn.000145ac
mov eax, dword [ebp - 0x70]
call fcn.00103b4c
pop ecx
jmp 0x1042f1
call fcn.0002cc64
lea edx, [ebp - 0x88]
mov eax, dword [ebp - 0x28]
call fcn.00019e2c
lea eax, [ebp - 0x88]
lea edx, [ebp - 0x38]
call fcn.0001a30c
mov bl, 1
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x28]
call fcn.0002db98
mov esi, eax
cmp esi, 0x400
jl 0x103d2a
cmp esi, 0xa00000
jle 0x103d8e
push ebp
push 0x104484
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x94]
call fcn.00027444
push dword [ebp - 0x94]
push 0x104498
lea edx, [ebp - 0x98]
mov eax, dword [ebp - 0x20]
call fcn.00027478
push dword [ebp - 0x98]
lea eax, [ebp - 0x90]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0x90]
lea eax, [ebp - 0x8c]
call fcn.000145ac
mov eax, dword [ebp - 0x8c]
call fcn.00103b4c
pop ecx
xor ebx, ebx
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0002db98
mov edi, eax
cmp edi, 0x400
jl 0x103dab
cmp edi, 0xa00000
jle 0x103e0f
push ebp
push 0x1044a4
mov eax, edi
cdq
push edx
push eax
lea eax, [ebp - 0xa4]
call fcn.00027444
push dword [ebp - 0xa4]
push 0x104498
lea edx, [ebp - 0xa8]
mov eax, dword [ebp - 0x20]
call fcn.00027478
push dword [ebp - 0xa8]
lea eax, [ebp - 0xa0]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xa0]
lea eax, [ebp - 0x9c]
call fcn.000145ac
mov eax, dword [ebp - 0x9c]
call fcn.00103b4c
pop ecx
xor ebx, ebx
test bl, bl
je 0x103e19
cmp edi, esi
je 0x103e19
xor ebx, ebx
lea eax, [ebp - 0x3c]
mov edx, 0x40
call fcn.000271f0
mov dword [ebp - 0x1c], 0x40
xor eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
call fcn.00026ad0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x3c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x103eb7
cmp dword [ebp - 0x18], 1
jne 0x103eb7
cmp dword [ebp - 0x1c], 0
jbe 0x103eb7
cmp dword [ebp - 0x1c], 0x40
jae 0x103eb7
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 0x3c]
call fcn.00013ee0
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x24]
call fcn.000140b8
jne 0x103eb7
push ebp
mov eax, 0x1044b4
call fcn.00103a2c
pop ecx
mov eax, dword [ebp - 0xc]
call fcn.0002e598
test al, al
jne 0x103eb3
push ebp
mov eax, 0x1044d4
call fcn.00103abc
pop ecx
jmp 0x103eb7
mov byte [ebp - 0x31], 1
cmp byte [ebp - 0x31], 0
je 0x103ec5
test bl, bl
jne 0x1042df
cmp esi, 0x400
jl 0x103ed5
cmp esi, 0xa00000
jle 0x103f3c
push ebp
push 0x104510
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0xb4]
call fcn.00027444
push dword [ebp - 0xb4]
push 0x104498
lea edx, [ebp - 0xb8]
mov eax, dword [ebp - 0x20]
call fcn.00027478
push dword [ebp - 0xb8]
lea eax, [ebp - 0xb0]
mov edx, 4
call fcn.00014068
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 0xac]
call fcn.000145ac
mov eax, dword [ebp - 0xac]
call fcn.00103b4c
pop ecx
jmp 0x1042df
lea eax, [ebp - 8]
mov edx, esi
call fcn.000271f0
lea eax, [ebp - 0xbc]
mov edx, dword [ebp - 0x28]
call fcn.000145ac
mov eax, dword [ebp - 0xbc]
xor edx, edx
call fcn.0002e1b4
mov ebx, eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
cmp ebx, 0xffffffff
jne 0x103fb7
push ebp
lea edx, [ebp - 0xc8]
mov eax, dword [ebp - 0x20]
call fcn.00027478
mov ecx, dword [ebp - 0xc8]
lea eax, [ebp - 0xc4]
mov edx, 0x104524
call fcn.00013ff4
mov edx, dword [ebp - 0xc4]
lea eax, [ebp - 0xc0]
call fcn.000145ac
mov eax, dword [ebp - 0xc0]
call fcn.00103b4c
pop ecx
jmp 0x1042c9
mov edx, dword [ebp - 8]
mov ecx, esi
mov eax, ebx
call fcn.0002e140
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov eax, esi
cdq
cmp edx, dword [ebp - 0x2c]
jne 0x103fdd
cmp eax, dword [ebp - 0x30]
je 0x104066
push ebp
push 0x104538
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
lea eax, [ebp - 0xd4]
call fcn.00027444
push dword [ebp - 0xd4]
push 0x104498
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0xd8]
call fcn.00027444
push dword [ebp - 0xd8]
push 0x104498
lea edx, [ebp - 0xdc]
mov eax, dword [ebp - 0x20]
call fcn.00027478
push dword [ebp - 0xdc]
lea eax, [ebp - 0xd0]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0xd0]
lea eax, [ebp - 0xcc]
call fcn.000145ac
mov eax, dword [ebp - 0xcc]
call fcn.00103b4c
pop ecx
jmp 0x1042c9
mov edi, dword [ebp - 8]
xor eax, eax
xor edx, edx
mov dword [ebp - 0x4c], edx
jmp 0x10408b
mov eax, 0x250bec
mov ecx, 0xc
mov edx, edi
call fcn.001039ec
test al, al
jne 0x10408b
inc edi
inc dword [ebp - 0x4c]
test al, al
jne 0x104099
mov edx, esi
sub edx, 0xc
cmp edx, dword [ebp - 0x4c]
jg 0x104072
test al, al
jne 0x1040ae
push ebp
mov eax, 0x104548
call fcn.00103b4c
pop ecx
jmp 0x1042c9
lea eax, [ebp - 0xe0]
call fcn.000252ec
mov eax, dword [ebp - 0xe0]
mov al, byte [eax]
mov byte [0x250bfa], al
lea eax, [ebp - 0xe4]
call fcn.000252ec
mov eax, dword [ebp - 0xe4]
mov al, byte [eax + 1]
mov byte [0x250bfc], al
lea eax, [ebp - 0xe8]
call fcn.000252ec
mov eax, dword [ebp - 0xe8]
mov al, byte [eax + 2]
mov byte [0x250bfe], al
mov edx, edi
mov eax, 0x250bf8
mov ecx, 0xc
call fcn.0001291c
lea eax, [ebp - 0xec]
mov edx, dword [ebp - 0xc]
call fcn.000145ac
mov eax, dword [ebp - 0xec]
mov edx, 2
call fcn.0002e118
mov edi, eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
cmp edi, 0xffffffff
jne 0x10417d
push ebp
lea edx, [ebp - 0xf8]
mov eax, dword [ebp - 0x20]
call fcn.00027478
mov ecx, dword [ebp - 0xf8]
lea eax, [ebp - 0xf4]
mov edx, 0x104564
call fcn.00013ff4
mov edx, dword [ebp - 0xf4]
lea eax, [ebp - 0xf0]
call fcn.000145ac
mov eax, dword [ebp - 0xf0]
call fcn.00103b4c
pop ecx
jmp 0x1042bd
mov edx, dword [ebp - 8]
mov ecx, esi
mov eax, edi
call fcn.0002e16c
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x20], eax
mov eax, esi
cdq
cmp edx, dword [ebp - 0x44]
jne 0x1041a3
cmp eax, dword [ebp - 0x48]
je 0x10422c
push ebp
push 0x104578
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea eax, [ebp - 0x104]
call fcn.00027444
push dword [ebp - 0x104]
push 0x104498
mov eax, esi
cdq
push edx
push eax
lea eax, [ebp - 0x108]
call fcn.00027444
push dword [ebp - 0x108]
push 0x104498
lea edx, [ebp - 0x10c]
mov eax, dword [ebp - 0x20]
call fcn.00027478
push dword [ebp - 0x10c]
lea eax, [ebp - 0x100]
mov edx, 6
call fcn.00014068
mov edx, dword [ebp - 0x100]
lea eax, [ebp - 0xfc]
call fcn.000145ac
mov eax, dword [ebp - 0xfc]
call fcn.00103b4c
pop ecx
jmp 0x1042bd
push ebp
mov eax, 0x104588
call fcn.00103a2c
pop ecx
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0x38]
call fcn.00013db0
mov eax, dword [ebp - 0x38]
call fcn.00013fa8
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x38]
call fcn.0001416c
push eax
push 1
push 0
mov eax, dword [ebp - 0x14]
call fcn.0001416c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegSetValueExA
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x1042bd
push ebp
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 0x20]
call fcn.00027478
mov ecx, dword [ebp - 0x118]
lea eax, [ebp - 0x114]
mov edx, 0x1045b0
call fcn.00013ff4
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x110]
call fcn.000145ac
mov eax, dword [ebp - 0x110]
call fcn.00103b4c
pop ecx
cmp edi, 0xffffffff
je 0x1042c9
mov eax, edi
call fcn.0002e1ac
cmp ebx, 0xffffffff
je 0x1042d5
mov eax, ebx
call fcn.0002e1ac
lea eax, [ebp - 8]
mov edx, esi
call fcn.00027218
lea eax, [ebp - 0x3c]
mov edx, 0x40
call fcn.00027218
call fcn.0002ccb8
cmp dword [ebp - 0x10], 0
je 0x104300
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x104446
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x110]
call fcn.000143f0
lea eax, [ebp - 0x10c]
mov edx, 4
call fcn.00013d3c
lea eax, [ebp - 0xfc]
call fcn.000143f0
lea eax, [ebp - 0xf8]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0xf0]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0xe8]
mov edx, 7
call fcn.00013d3c
lea eax, [ebp - 0xcc]
call fcn.000143f0
lea eax, [ebp - 0xc8]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0xc0]
mov edx, 2
call fcn.00014408
lea eax, [ebp - 0xb8]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0xac]
call fcn.000143f0
lea eax, [ebp - 0xa8]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0x9c]
call fcn.000143f0
lea eax, [ebp - 0x98]
mov edx, 3
call fcn.00013d3c
lea eax, [ebp - 0x8c]
call fcn.000143f0
lea eax, [ebp - 0x78]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x70]
call fcn.000143f0
lea eax, [ebp - 0x6c]
mov edx, 8
call fcn.00013d3c
lea eax, [ebp - 0x38]
call fcn.00013d18
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00013d3c
lea eax, [ebp - 0x14]
call fcn.00013d18
lea eax, [ebp - 0xc]
call fcn.00013d18
ret