Function at 0x100bc980
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x10], 0
jne 0x100bca84
mov dword [ebp - 4], 0
jmp 0x100bc9af
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov dword [ebp - 0x61c], 0x200
mov dword [ebp - 0x418], 0x200
lea ecx, [ebp - 0x418]
push ecx
lea edx, [ebp - 0x410]
push edx
lea eax, [ebp - 0x414]
push eax
push 0
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x618]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x100bca24
mov edx, dword [ebp - 0x418]
push edx
lea eax, [ebp - 0x410]
push eax
mov ecx, dword [ebp - 0x414]
push ecx
push 0
lea edx, [ebp - 0x618]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100bca26
jmp 0x100bca2b
jmp 0x100bc9a6
mov dword [ebp - 4], 0
jmp 0x100bca3d
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
push 0x200
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100bca7b
mov edx, dword [ebp + 0x14]
add edx, 1
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100bc980
add esp, 0x10
jmp 0x100bca7d
jmp 0x100bca7f
jmp 0x100bca34
jmp 0x100bcbd8
lea eax, [ebp - 8]
push eax
call fcn.100bc6e0
or eax, 0x20019
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100bcbd8
lea eax, [ebp - 0x620]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
call fcn.100bc6e0
or eax, 0xf003f
push eax
push 0
push 0x101a0fc1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x100bcbce
mov dword [ebp - 4], 0
jmp 0x100bcaf4
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov dword [ebp - 0xa2c], 0x200
mov dword [ebp - 0x828], 0x200
lea edx, [ebp - 0x828]
push edx
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x824]
push ecx
push 0
lea edx, [ebp - 0xa2c]
push edx
lea eax, [ebp - 0xa28]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x100bcb69
mov eax, dword [ebp - 0x828]
push eax
lea ecx, [ebp - 0x820]
push ecx
mov edx, dword [ebp - 0x824]
push edx
push 0
lea eax, [ebp - 0xa28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x100bcb6b
jmp 0x100bcb70
jmp 0x100bcaeb
mov dword [ebp - 4], 0
jmp 0x100bcb82
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
push 0x200
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x100bcbc0
mov eax, dword [ebp + 0x14]
add eax, 1
push eax
lea ecx, [ebp - 0x210]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.100bc980
add esp, 0x10
jmp 0x100bcbc2
jmp 0x100bcbc4
jmp 0x100bcb79
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret