Function at 0x1038b39
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor eax, eax
inc eax
push edi
mov dword [ebp - 0x250], eax
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x258]
push eax
xor edi, edi
mov ebx, 0x2001f
push ebx
push edi
push ecx
push 0x80000000
mov dword [ebp - 0x258], edi
mov dword [ebp - 0x254], edi
call esi
test eax, eax
jne 0x10390ff
lea eax, [ebp - 0x24c]
push eax
push ebx
push edi
push 0x100a35c
push dword [ebp - 0x258]
mov dword [ebp - 0x24c], edi
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, 0x100a340
jne 0x1038d05
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1038ced
cmp dword [ebp - 0x250], 1
je 0x1038c15
cmp dword [ebp - 0x250], 2
jne 0x1038ced
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x1038ced
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.01038841
test eax, eax
jne 0x1038c62
push dword [ebp - 0x24c]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x258]
call esi
jmp 0x10390ff
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1038ce7
cmp dword [ebp - 0x250], 1
je 0x1038ca5
cmp dword [ebp - 0x250], 2
jne 0x1038ce7
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1038cae
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call ebx
jmp 0x1038ced
mov dword [ebp - 0x25c], edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x25c], edi
je 0x1038e5a
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x100a328
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1038e6a
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push 0x10059e4
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1038db6
cmp dword [ebp - 0x250], 1
je 0x1038d72
cmp dword [ebp - 0x250], 2
jne 0x1038db6
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x1038db6
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x248]
mov dword [esp], 0x10029bc
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x1038db6
push 0x10059e4
push dword [ebp - 0x24c]
call ebx
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1038e43
cmp dword [ebp - 0x250], 1
je 0x1038df9
cmp dword [ebp - 0x250], 2
jne 0x1038e43
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x1038e43
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1038e12
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x1038e44
push edi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1038e6a
push 0x100a328
push dword [ebp - 0x258]
call fcn.01033666
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x100a31c
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1038fa8
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push edi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1038eff
cmp dword [ebp - 0x250], 1
jne 0x1038eff
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x1038eff
lea eax, [ebp - 0x248]
push 0x1004598
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
neg eax
sbb eax, eax
pop ecx
inc eax
pop ecx
mov dword [ebp - 0x260], eax
je 0x1038f90
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1038f7f
cmp dword [ebp - 0x250], 1
jne 0x1038f7f
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x1038f7f
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1038f52
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
jmp 0x1038f88
cmp dword [ebp - 0x25c], edi
jne 0x1038f90
push edi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x260], edi
je 0x10390f3
lea eax, [ebp - 0x24c]
push eax
push 0x2001f
push edi
push 0x1009aec
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103906d
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x24c]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1039061
cmp dword [ebp - 0x250], 1
je 0x1039011
cmp dword [ebp - 0x250], 2
jne 0x1039061
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x1039061
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x103902a
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x250]
push edi
push edi
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x24c]
call ebx
push dword [ebp - 0x24c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x250]
push eax
push edi
push esi
push dword [ebp - 0x258]
mov dword [ebp - 0x254], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10390f3
cmp dword [ebp - 0x250], 1
jne 0x10390f3
lea eax, [ebp - 0x248]
push eax
call fcn.010387a2
test eax, eax
je 0x10390f3
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10390c0
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push edi
push edi
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
push dword [ebp - 0x258]
call ebx
push dword [ebp - 0x258]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 4