Function at 0x1000a1f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1013b598
mov eax, dword fs:[0]
push eax
sub esp, 0xbc
push ebx
push esi
push edi
mov eax, dword [0x1019b120]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x78]
call fcn.1000be9e
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
call fcn.1000c3bc
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1000a250
push 0x80004005
call fcn.100032c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x48], eax
mov byte [ebp - 4], 2
call fcn.1000c3bc
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1000a27d
push 0x80004005
call fcn.100032c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], 0
lea eax, [ebp - 0x50]
mov byte [ebp - 4], 4
push eax
call fcn.10123115
add esp, 4
mov byte [ebp - 0x11], 1
lea edx, [ebp - 0x48]
call fcn.10004fa0
mov ebx, dword [ebp - 0x48]
lea eax, [ebp - 0x28]
push eax
push 0xf003f
push 0
push ebx
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000a2d7
mov dword [ebp - 0x28], 0
jmp 0x1000a4f6
lea eax, [ebp - 0x18]
push eax
push str.AllowedKMEventsUntil
lea ecx, [ebp - 0x28]
call fcn.10004ec0
mov esi, dword [ebp - 0x18]
test eax, eax
je 0x1000a4f6
cmp dword [esi - 0xc], 0
je 0x1000a4f6
push esi
call fcn.10123166
cdq
add esp, 4
cmp dword [ebp - 0x4c], edx
jg 0x1000a4f6
jl 0x1000a31b
cmp dword [ebp - 0x50], eax
ja 0x1000a4f6
lea eax, [ebp - 0x18]
mov byte [ebp - 0x11], 0
push eax
push str.AllowedKMEventType
lea ecx, [ebp - 0x28]
call fcn.10004ec0
mov esi, dword [ebp - 0x18]
or ebx, 0xffffffff
mov eax, dword [esi - 0xc]
test eax, eax
je 0x1000a4f3
js 0x1000a491
push 0x1017d194
push esi
call fcn.101228e4
add esp, 8
test eax, eax
je 0x1000a491
sub eax, esi
sar eax, 1
mov dword [ebp - 0x40], eax
js 0x1000a491
push eax
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
call fcn.10004ad0
mov ebx, eax
mov byte [ebp - 4], 5
test ebx, ebx
je 0x1000a3bf
xor edi, edi
cmp edi, 6
jge 0x1000a3bf
mov ecx, dword [edi*8 + 0x1017d240]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1000a3a4
push 0x80004005
call fcn.100032c0
push ecx
push dword [ebx]
call fcn.10123183
add esp, 8
test eax, eax
jne 0x1000a3bc
mov edi, dword [edi*8 + 0x1017d244]
jmp 0x1000a3c4
inc edi
jmp 0x1000a383
mov edi, 0xfffffffe
mov byte [ebp - 4], 4
or ecx, 0xffffffff
mov edx, dword [ebp - 0x20]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000a3e5
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp edi, 0xfffffffe
je 0x1000a41c
mov ebx, dword [ebp - 0x38]
push ecx
push dword [ebx + 0x570]
lea ecx, [ebx + 0x568]
call fcn.1000b2c0
mov dword [eax + 8], edi
mov ecx, dword [ebx + 0x570]
test ecx, ecx
je 0x1000a410
mov dword [ecx], eax
jmp 0x1000a416
mov dword [ebx + 0x56c], eax
mov dword [ebx + 0x570], eax
mov ebx, dword [ebp - 0x40]
xor eax, eax
mov edi, dword [esi - 0xc]
inc ebx
cmovs ebx, eax
mov eax, SysReAllocString
sub eax, ebx
jns 0x1000a43b
push 0x80070216
call fcn.100032c0
cmp ebx, edi
cmovg ebx, edi
test ebx, ebx
jle 0x1000a333
sub edi, ebx
cmp dword [esi - 4], 1
jle 0x1000a45e
push dword [esi - 0xc]
lea ecx, [ebp - 0x18]
call fcn.10003140
mov esi, dword [ebp - 0x18]
lea ecx, [edi*2 + 2]
push ecx
lea eax, [esi + ebx*2]
push eax
push ecx
push esi
call fcn.1012206e
push eax
call fcn.10002c00
add esp, 0x14
test edi, edi
js 0x1000a4b3
cmp edi, dword [esi - 8]
jg 0x1000a4b3
xor eax, eax
mov dword [esi - 0xc], edi
mov word [esi + edi*2], ax
jmp 0x1000a333
cmp dword [esi - 0xc], 0
lea edx, [esi - 0x10]
mov edi, dword [edx]
mov byte [ebp - 0x11], 1
je 0x1000a336
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x1000a4ce
cmp dword [esi - 8], 0
jge 0x1000a4bd
push 0x80070057
call fcn.100032c0
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x1000a336
mov eax, ebx
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1000a4e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
jmp 0x1000a336
mov ebx, dword [ebp - 0x48]
mov edi, dword [esi - 0x10]
lea edx, [esi - 0x10]
or eax, 0xffffffff
cmp dword [edx + 4], 0
je 0x1000a54a
cmp dword [edx + 0xc], 0
lea ecx, [edx + 0xc]
jge 0x1000a52c
cmp dword [esi - 8], 0
jge 0x1000a51e
push 0x80070057
call fcn.100032c0
xor eax, eax
mov dword [esi - 0xc], 0
mov word [esi], ax
jmp 0x1000a54a
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x1000a53d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x18], esi
cmp byte [ebp - 0x11], 0
je 0x1000ac9f
mov dword [ebp - 0x2c], 0
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0xf003f
push 0
push ebx
push SysReAllocString
call eax
test eax, eax
je 0x1000a587
mov dword [ebp - 0x2c], 0
jmp 0x1000a637
mov ecx, esi
lea edx, [ecx + 2]
lea esp, [esp]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000a590
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub ecx, edx
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push esi
push 1
push 0
push str.AllowedKMEventType
push dword [ebp - 0x2c]
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegFlushKey]
test eax, eax
jne 0x1000a5c7
push dword [ebp - 0x2c]
call esi
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
add ecx, 0x15180
mov dword [ebp - 0x50], ecx
adc eax, 0
push eax
push ecx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x18]
push 0x1017d230
push eax
call fcn.10002b40
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov edx, eax
lea ecx, [edx + 2]
mov dword [ebp - 0x20], ecx
lea ebx, [ebx]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1000a600
sub edx, dword [ebp - 0x20]
sar edx, 1
lea ecx, [edx + edx]
push ecx
push eax
push 1
push 0
push str.AllowedKMEventsUntil
push dword [ebp - 0x2c]
call edi
test eax, eax
jne 0x1000a62c
push dword [ebp - 0x2c]
call esi
lea ecx, [ebp - 0x18]
call fcn.100030c0
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0xc8]
call fcn.10001ae0
push 0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc8]
push 0
push 0x1017d198
mov dword [ebp - 0xc4], 1
mov dword [ebp - 0xbc], 0x7d0
mov dword [ebp - 0xb8], 0x7d0
mov dword [ebp - 0xb4], 0x7d0
call fcn.10001bc0
cmp al, 1
jne 0x1000ac1b
mov ecx, dword [ebp - 0x90]
xor eax, eax
cmp eax, ecx
push ecx
sbb eax, eax
lea ecx, [ebp - 0x6c]
and eax, dword [ebp - 0x94]
push eax
call fcn.10004260
push 0
push str.Reporting
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 8
call fcn.100042f0
xor ecx, ecx
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], ecx
call fcn.1000c3bc
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1000a6dd
push 0x80004005
call fcn.100032c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x58], ebx
mov byte [ebp - 4], 9
call fcn.1000c3bc
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1000a70a
push 0x80004005
call fcn.100032c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x54], edi
mov eax, dword [ebp - 0x40]
mov byte [ebp - 4], 0xa
test eax, eax
je 0x1000a725
mov eax, dword [eax + 8]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x5c], 1
nop
test eax, eax
je 0x1000a966
push eax
push str.Source
lea eax, [ebp - 0x24]
mov byte [ebp - 0x11], 0
push eax
lea ecx, [ebp - 0x6c]
mov byte [ebp - 0x34], 0
call fcn.100046f0
mov byte [ebp - 4], 0xb
lea eax, [ebp - 0x30]
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x6c]
push str.Version
push eax
call fcn.100046f0
mov byte [ebp - 4], 0xc
mov eax, dword [ebp - 0x24]
cmp dword [eax - 0xc], 0
jne 0x1000a77d
mov byte [ebp - 0x40], 1
jmp 0x1000a7b4
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax]
xor eax, eax
test ecx, ecx
setne al
test eax, eax
jne 0x1000a797
push 0x80004005
call fcn.100032c0
push ecx
push dword [ebp - 0x24]
call fcn.10123183
movzx ecx, byte [ebp - 0x11]
add esp, 8
test eax, eax
mov eax, 1
cmove ecx, eax
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x30]
cmp dword [eax - 0xc], 0
jne 0x1000a7c7
cmp dword [edi - 0xc], 0
jne 0x1000a826
mov cl, 1
jmp 0x1000a829
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 4]
cmp dword [ecx - 0xc], 0
jl 0x1000a826
push eax
push ecx
call fcn.101228e4
add esp, 8
test eax, eax
je 0x1000a823
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 4]
sar eax, 1
jne 0x1000a823
mov eax, dword [ebp - 0x30]
mov edx, dword [eax - 0xc]
mov eax, dword [ebp - 0x34]
cmp edx, dword [edi - 0xc]
movzx eax, al
cmovg eax, dword [ebp - 0x5c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
jne 0x1000a826
mov ecx, dword [ebp - 0x24]
cmp dword [ecx - 0xc], 0
mov ecx, dword [ebp - 0x34]
je 0x1000a829
cmp dword [ebx - 0xc], 0
mov edx, 1
movzx ecx, cl
cmove ecx, edx
jmp 0x1000a829
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
cmp byte [ebp - 0x40], 0
je 0x1000a90f
test cl, cl
je 0x1000a90f
lea ecx, [eax - 0x10]
lea edx, [edi - 0x10]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x3c], edx
cmp ecx, edx
je 0x1000a89c
cmp dword [edx + 0xc], 0
lea edi, [edx + 0xc]
jl 0x1000a88a
mov ecx, dword [ecx]
cmp ecx, dword [edx]
jne 0x1000a88a
push dword [ebp - 0x20]
call fcn.10003050
add esp, 4
mov dword [ebp - 0x20], eax
or ecx, 0xffffffff
lock xadd dword [edi], ecx
dec ecx
test ecx, ecx
jg 0x1000a882
mov edx, dword [ebp - 0x3c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
lea edi, [eax + 0x10]
mov dword [ebp - 0x54], edi
jmp 0x1000a899
push dword [eax - 0xc]
lea ecx, [ebp - 0x54]
push eax
call fcn.10003310
mov edi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
lea ecx, [ebx - 0x10]
add edx, 0xfffffff0
mov dword [ebp - 0x3c], ecx
cmp edx, ecx
je 0x1000a907
cmp dword [ecx + 0xc], 0
lea ebx, [ecx + 0xc]
jl 0x1000a8f2
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x1000a8f2
push edx
call fcn.10003050
add esp, 4
mov dword [ebp - 0x20], eax
or ecx, 0xffffffff
lock xadd dword [ebx], ecx
dec ecx
test ecx, ecx
jg 0x1000a8e1
mov edx, dword [ebp - 0x3c]
push edx
mov ecx, dword [edx]
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
lea ebx, [eax + 0x10]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x20], ecx
jmp 0x1000a912
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x58]
push dword [eax - 0xc]
push eax
call fcn.10003310
mov ebx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
jmp 0x1000a912
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx + 4]
lea edx, [eax - 0x10]
mov dword [ebp - 0x1c], ecx
lea eax, [edx + 0xc]
mov byte [ebp - 4], 0xb
or ecx, 0xffffffff
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000a936
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0xa
or ecx, 0xffffffff
mov edx, dword [ebp - 0x24]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
mov eax, dword [ebp - 0x1c]
test ecx, ecx
jg 0x1000a730
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x1c]
jmp 0x1000a730
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x1000aa5a
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x24], ecx
call fcn.1000c3bc
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
jne 0x1000a993
push 0x80004005
call fcn.100032c0
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x1000aa39
lea edx, [ebp - 0x1c]
mov ecx, eax
call fcn.10004920
test al, al
je 0x1000aa2b
mov ecx, dword [ebp - 0x24]
lea edx, [ebp - 0x60]
call fcn.10004860
test al, al
je 0x1000aa2b
mov eax, dword [ebp - 0x60]
or eax, dword [ebp - 0x5c]
je 0x1000aa2b
lea ecx, [ebp - 0x1c]
call fcn.1000ada0
mov dword [ebp - 0x3c], eax
cmp eax, 0xfffffffe
je 0x1000aa2b
mov eax, dword [ebp - 0x38]
push ecx
push dword [eax + 0x570]
lea ecx, [eax + 0x568]
call fcn.1000b2c0
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov dword [eax + 8], ecx
mov ecx, dword [edx + 0x570]
test ecx, ecx
je 0x1000aa1f
mov dword [ecx], eax
mov dword [edx + 0x570], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
jmp 0x1000a9a7
mov dword [edx + 0x56c], eax
mov dword [edx + 0x570], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [ebp - 0x24], eax
jmp 0x1000a9a7
mov byte [ebp - 4], 0xa
or ecx, 0xffffffff
mov edx, dword [ebp - 0x1c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000aa5a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 0xe
push eax
mov eax, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0xf003f
push 0
push dword [ebp - 0x48]
push SysReAllocString
call eax
test eax, eax
je 0x1000aa8d
xor eax, eax
mov dword [ebp - 0x44], eax
jmp 0x1000ab3e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x56c]
test eax, eax
je 0x1000aaf4
mov edx, dword [eax + 8]
lea ecx, [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
call fcn.1000adf0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x18]
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
call fcn.10002930
mov byte [ebp - 4], 0xe
or ecx, 0xffffffff
mov edx, dword [ebp - 0x3c]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000aadd
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 1
push 0x1017d194
lea ecx, [ebp - 0x18]
call fcn.10002930
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x5c]
jmp 0x1000aa96
push esi
push str.AllowedKMEventType
lea ecx, [ebp - 0x44]
call fcn.10004e60
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x4c]
add ecx, 0x127500
mov dword [ebp - 0x50], ecx
adc eax, 0
push eax
push ecx
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x18]
push 0x1017d230
push eax
call fcn.10002b40
mov esi, dword [ebp - 0x18]
lea ecx, [ebp - 0x44]
add esp, 0x10
push esi
push str.AllowedKMEventsUntil
call fcn.10004e60
mov eax, dword [ebp - 0x44]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 0xfffffff0
mov dword [ebp - 0x44], 0
mov byte [ebp - 4], 9
or ecx, 0xffffffff
lea eax, [edi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000ab6a
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 8
or ecx, 0xffffffff
lea eax, [ebx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000ab88
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 7
call fcn.10004220
lea ecx, [ebp - 0xc8]
call fcn.10001b50
push dword [ebp - 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
call edi
add esi, 0xfffffff0
mov dword [ebp - 0x28], 0
or ebx, 0xffffffff
mov byte [ebp - 4], 2
mov ecx, ebx
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000abdd
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x48]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ebx
dec ebx
test ebx, ebx
jg 0x1000abfb
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.1000bf4d
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc8]
call fcn.10001b50
push dword [ebp - 0x2c]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call edi
push dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0
call edi
add esi, 0xfffffff0
mov dword [ebp - 0x28], 0
or edi, 0xffffffff
mov byte [ebp - 4], 2
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000ac64
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x1000ac7f
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
call fcn.1000bf4d
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x28]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xfffffff0
mov dword [ebp - 0x28], 0
or edi, 0xffffffff
mov byte [ebp - 4], 2
mov ecx, edi
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x1000accf
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
add ebx, 0xfffffff0
mov byte [ebp - 4], 1
lea eax, [ebx + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x1000abfb
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
jmp 0x1000abf8