Function at 0x1005582
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x208]
sub esp, 0x288
mov eax, dword [0x10171b0]
push esi
push edi
push 0x2c
mov dword [ebp + 0x204], eax
call fcn.01012125
test eax, eax
pop ecx
je 0x10055b4
mov ecx, eax
call fcn.0100bfa7
mov esi, eax
jmp 0x10055b6
xor esi, esi
test esi, esi
je 0x10055d4
mov eax, dword [esi]
lea ecx, [ebp - 0x44]
push ecx
push 0x1001550
push esi
call dword [eax]
mov edi, eax
mov eax, dword [esi]
push esi
call dword [eax + 8]
test edi, edi
je 0x10055db
xor eax, eax
jmp 0x1005821
mov eax, dword [ebp - 0x44]
push ebx
mov ebx, dword [ebp + 0x210]
test ebx, ebx
lea edi, [ebp + 0x1f4]
je 0x1005838
and dword [ebp - 0x34], 0
and dword [ebp - 0x3c], 0
mov ebx, 0x10014e0
mov esi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
movsd dword es:[edi], dword [esi]
push 0
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
cmp eax, 0x80070002
jne 0x100564e
mov eax, dword [ebp - 0x44]
mov esi, ebx
lea edi, [ebp + 0x1f4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x34]
push edx
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
push 0
push 0x1001b38
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov dword [ebp - 0x3c], 1
test eax, eax
jne 0x100576b
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push 5
pop esi
push esi
push eax
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x48]
push edx
push eax
call dword [ecx + 0x30]
test eax, eax
jne 0x1005762
mov eax, dword [ebp - 0x48]
lea edx, [ebp - 0x80]
push edx
mov word [ebp - 0x80], 0x30
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
test eax, eax
jl 0x1005759
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x60], esi
lea edx, [ebp - 0x80]
xor esi, esi
push edx
mov word [ebp - 0x80], 0x30
mov dword [ebp - 0x64], esi
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
lea edx, [ebp - 0x38]
push edx
push eax
call dword [ecx + 0x5c]
test eax, eax
jl 0x1005750
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
lea edx, [ebp - 0x4c]
push edx
push eax
call dword [ecx + 0x74]
test eax, eax
jl 0x10056fe
mov eax, dword [ebp + 0x218]
mov ecx, dword [ebp - 0x4c]
neg eax
sbb eax, eax
and eax, 0xffffffc0
add eax, 0x40
and ecx, 0xffffffbf
or eax, ecx
mov ecx, dword [ebp - 0x38]
or eax, 0x2000
push eax
mov dword [ebp - 0x4c], eax
mov edx, dword [ecx]
push ecx
call dword [edx + 0x70]
cmp dword [ebp - 0x3c], esi
je 0x1005728
push 0x111
push 0x1001b34
lea eax, [ebp - 0x30]
push eax
mov word [ebp - 0x30], si
call fcn.01013330
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push esi
lea edx, [ebp - 0x30]
push edx
push eax
call dword [ecx + 0x78]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x214]
push eax
call dword [ecx + 0x28]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa8]
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x58]
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ebx, dword [ebp + 0x210]
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor edi, edi
push 0x10013e0
push edi
push edi
lea ecx, [ebp + 0x1f8]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x50], 4
call fcn.01004750
push 0xffffffffffffffff
lea ecx, [ebp + 0x1f8]
call fcn.0100479a
push 1
push 0x2001f
push 2
call fcn.01004a79
cmp eax, edi
mov dword [ebp - 0x3c], eax
je 0x1005808
lea ecx, [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x40]
push ecx
push edi
push 0x10
mov esi, 0x1001b28
push esi
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x10057fc
mov eax, dword [ebp - 0x40]
neg ebx
sbb ebx, ebx
and eax, 0xffffffdf
push 4
and ebx, 0x20
or ebx, eax
lea eax, [ebp - 0x40]
push eax
push 4
push edi
push esi
push dword [ebp - 0x3c]
mov dword [ebp - 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edi, edi
inc edi
lea ecx, [ebp + 0x1f8]
call fcn.010047c3
lea ecx, [ebp + 0x1f8]
call fcn.01004775
mov eax, edi
pop ebx
mov ecx, dword [ebp + 0x204]
pop edi
pop esi
call fcn.0101204b
add ebp, 0x208
leave
ret 0xc
mov esi, 0x10014e0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edx, [ebp + 0x1f4]
push edx
movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
jmp 0x1005771