Function at 0x10253d5
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x102a0ec]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
push ebx
push 5
mov dword [ebp - 4], eax
mov dword [ebp - 0x418], ebx
mov dword [ebp - 0x424], ebx
mov dword [ebp - 0x430], ebx
call fcn.01018dae
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
mov dword [ebp - 0x438], eax
mov dword [ebp - 0x434], ebx
cmp dword [ebp - 0x434], ebx
jne 0x1025436
mov dword [ebp - 0x428], ebx
mov eax, 0x1007838
jmp 0x1025445
mov dword [ebp - 0x428], 1
mov eax, 0x1004428
push ebx
lea ecx, [ebp - 0x430]
push ecx
push ebx
push 0x20006
push ebx
push ebx
push ebx
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10267a3
cmp dword [ebp - 0x428], ebx
je 0x10254ed
cmp dword [ebp - 0x438], ebx
je 0x10254ed
push 0x103
push 1
lea eax, [ebp - 0x414]
push eax
call fcn.010190e9
test eax, eax
je 0x10254ed
lea eax, [ebp - 0x414]
push eax
call fcn.01016cfc
push 0x1002570
push 0x104
lea eax, [ebp - 0x414]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x10254ed
lea eax, [ebp - 0x414]
push eax
call fcn.01016f8a
test eax, eax
je 0x10254ed
lea eax, [ebp - 0x414]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push ebx
push 0x1009798
push dword [ebp - 0x430]
call esi
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x1007270
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1025afe
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a108]
cmp eax, ebx
je 0x1025adb
cmp dword [ebp - 0x428], ebx
jne 0x102554b
mov ecx, dword [ebp - 0x41c]
cmp dword [ecx + 0x102a148], ebx
je 0x1025adb
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
test eax, eax
jl 0x1025adb
lea eax, [ebp - 0x20c]
push 0x100b990
mov dword [ebp - 0x42c], eax
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x420], eax
je 0x1025593
add dword [ebp - 0x420], 2
mov word [eax], bx
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1025a96
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a10c]
cmp eax, ebx
je 0x10255f3
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a10c]
push 1
push ebx
push 0x100732c
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x428], ebx
je 0x1025625
mov eax, dword [ebp - 0x41c]
lea eax, [eax + 0x102a150]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x1025625
cmp ecx, 0xffffffff
je 0x1025625
push 4
push eax
push 4
push ebx
push 0x100b980
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
lea eax, [eax + 0x102a154]
mov ecx, dword [eax]
cmp ecx, ebx
je 0x102564f
cmp ecx, 0xffffffff
je 0x102564f
push 4
push eax
push 4
push ebx
push 0x100b968
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a158]
cmp eax, ebx
je 0x1025684
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a158]
push 1
push ebx
push 0x1004230
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a110]
cmp eax, ebx
je 0x102572a
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102572a
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10098f0
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a110]
lea eax, [ebp - 0x20c]
push 0x10066f4
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
test eax, eax
jl 0x102572a
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10098c0
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x428], ebx
mov eax, dword [ebp - 0x41c]
je 0x1025771
mov eax, dword [eax + 0x102a14c]
cmp eax, ebx
je 0x10257a0
push ebx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x10257a0
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
jmp 0x1025790
mov eax, dword [eax + 0x102a114]
cmp eax, ebx
je 0x10257a0
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a114]
push 1
push ebx
push 0x100991c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a118]
cmp eax, ebx
je 0x10257d7
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a118]
push 1
push ebx
push 0x1009878
push dword [ebp - 0x418]
call esi
jmp 0x10257e8
push 0x1009878
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x428], ebx
mov eax, dword [ebp - 0x41c]
je 0x1025817
mov eax, dword [eax + 0x102a120]
cmp eax, ebx
je 0x1025848
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a120]
jmp 0x102585a
mov eax, dword [eax + 0x102a11c]
cmp eax, ebx
je 0x1025848
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a11c]
push 1
push ebx
push 0x1007890
push dword [ebp - 0x418]
call esi
jmp 0x1025872
push 0x10078a8
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10078a8
push 1
push ebx
push 0x1007890
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x428], ebx
jne 0x1025894
push 0x1002570
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1002570
push 1
push ebx
push 0x10078b0
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a124]
cmp eax, ebx
je 0x1025902
cmp dword [ebp - 0x438], ebx
je 0x10258d2
push 0x1003870
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10258d2
push 0x1007d90
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1007d90
jmp 0x10258f2
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a124]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a124]
push 1
push ebx
push 0x100995c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a138]
cmp eax, ebx
je 0x1025937
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a138]
push 1
push ebx
push 0x100158c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a128]
cmp eax, ebx
je 0x102596c
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a128]
push 1
push ebx
push 0x10097c8
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a12c]
cmp eax, ebx
je 0x10259a1
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a12c]
push 1
push ebx
push 0x1009398
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a134]
cmp eax, ebx
je 0x10259d6
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a134]
push 1
push ebx
push 0x1009854
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a130]
cmp eax, ebx
je 0x1025a29
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1025a29
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100b934
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a144]
cmp eax, ebx
je 0x1025a79
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x1025a8a
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10077c4
push dword [ebp - 0x418]
call esi
jmp 0x1025a8a
push 0x10077c4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a108]
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100c535
test eax, eax
jl 0x1025adb
cmp dword [ebp - 0x420], ebx
je 0x1025adb
push 0x100b990
push dword [ebp - 0x420]
jmp 0x1025577
add dword [ebp - 0x41c], 0x54
cmp dword [ebp - 0x41c], 0x834
jb 0x102551d
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x1007304
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1025e64
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102ab80]
cmp eax, ebx
je 0x1025e41
cmp dword [ebp - 0x428], ebx
jne 0x1025b5c
mov ecx, dword [ebp - 0x41c]
cmp dword [ecx + 0x102aba4], ebx
je 0x1025e41
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
test eax, eax
jl 0x1025e41
lea eax, [ebp - 0x20c]
push 0x100b990
mov dword [ebp - 0x42c], eax
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x420], eax
je 0x1025ba4
add dword [ebp - 0x420], 2
mov word [eax], bx
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1025dfc
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 0x102ab84]
cmp ecx, ebx
je 0x1025c0a
push ecx
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102ab84]
push 1
push ebx
push 0x1007764
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 0x102ab88]
cmp ecx, ebx
je 0x1025c3f
push ecx
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102ab88]
push 1
push ebx
push 0x100773c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov ecx, dword [eax + 0x102ab8c]
cmp ecx, ebx
je 0x1025c74
push ecx
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102ab8c]
push 1
push ebx
push 0x100778c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x428], ebx
je 0x1025ca4
mov eax, dword [eax + 0x102ab98]
cmp eax, ebx
je 0x1025d53
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102ab98]
jmp 0x1025d65
mov eax, dword [eax + 0x102ab94]
cmp eax, ebx
je 0x1025d53
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102ab94]
push 1
push ebx
push 0x1007890
push dword [ebp - 0x418]
call esi
push dword [0x102a02c]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x102a02c]
push 1
push ebx
push 0x100158c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102ab9c]
cmp eax, ebx
je 0x1025daf
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x1025dc0
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10077c4
push dword [ebp - 0x418]
call esi
jmp 0x1025dc0
push 0x10078a8
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10078a8
push 1
push ebx
push 0x1007890
push dword [ebp - 0x418]
call esi
cmp dword [ebp - 0x428], ebx
je 0x1025cd7
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102ab90]
cmp eax, ebx
je 0x1025cfb
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102ab90]
jmp 0x1025ceb
push 0x10077c4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x41c]
cmp dword [eax + 0x102aba0], ebx
jne 0x1025df0
push 0x100b92c
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b92c
push 1
push ebx
push 0x100b918
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102ab80]
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100c535
test eax, eax
jl 0x1025e41
cmp dword [ebp - 0x420], ebx
je 0x1025e41
push 0x100b990
push dword [ebp - 0x420]
jmp 0x1025b88
add dword [ebp - 0x41c], 0x28
cmp dword [ebp - 0x41c], 0x320
jb 0x1025b2e
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x100724c
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026072
mov eax, dword [0x102a93c]
cmp eax, ebx
je 0x1026066
cmp dword [ebp - 0x428], ebx
jne 0x1025eaf
cmp dword [0x102a94c], ebx
je 0x1026066
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
test eax, eax
jl 0x1026066
lea eax, [ebp - 0x20c]
push 0x100b990
mov dword [ebp - 0x42c], eax
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x420], eax
je 0x1025ef7
add dword [ebp - 0x420], 2
mov word [eax], bx
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [ebp - 0x42c]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026027
mov eax, dword [0x102a940]
cmp eax, ebx
je 0x1025f4a
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x102a940]
push 1
push ebx
push 0x1007820
push dword [ebp - 0x418]
call esi
mov eax, dword [0x102a944]
cmp eax, ebx
je 0x1025f72
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x102a944]
push 1
push ebx
push 0x1004d04
push dword [ebp - 0x418]
call esi
mov eax, dword [0x102a948]
cmp eax, ebx
je 0x1025fbb
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x1025fcc
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10077c4
push dword [ebp - 0x418]
call esi
jmp 0x1025fcc
push 0x10077c4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
cmp dword [ebp - 0x428], ebx
je 0x102601b
mov eax, dword [0x102a954]
cmp eax, ebx
je 0x102601b
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x102601b
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x1007814
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [0x102a93c]
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x42c], eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
test eax, eax
jl 0x1026066
cmp dword [ebp - 0x420], ebx
je 0x1026066
push 0x100b990
push dword [ebp - 0x420]
jmp 0x1025edb
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x1007260
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10262b2
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a958]
cmp eax, ebx
je 0x1026292
cmp dword [ebp - 0x428], ebx
jne 0x10260d0
mov ecx, dword [ebp - 0x41c]
cmp dword [ecx + 0x102a96c], ebx
je 0x1026292
push eax
push 0x1007c00
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x102610e
push ebx
push ebx
push 1
push 5
call fcn.01018dae
test eax, eax
jne 0x102610e
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a958]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1026292
push ebx
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x41c]
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [eax + 0x102a958]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026292
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a95c]
cmp eax, ebx
je 0x102618e
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102618e
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a960]
cmp eax, ebx
je 0x10261dc
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x10261dc
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10074b8
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a964]
cmp eax, ebx
je 0x1026203
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a964]
jmp 0x1026215
push 0x10078a8
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10078a8
push 1
push ebx
push 0x1007890
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a968]
cmp eax, ebx
je 0x1026275
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x1026286
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10077c4
push dword [ebp - 0x418]
call esi
jmp 0x1026286
push 0x10077c4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [ebp - 0x41c], 0x18
cmp dword [ebp - 0x41c], 0x30
jb 0x10260a2
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x424]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push 0x100b908
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026797
mov dword [ebp - 0x41c], ebx
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a988]
cmp eax, ebx
je 0x1026774
cmp dword [ebp - 0x428], ebx
jne 0x1026310
mov ecx, dword [ebp - 0x41c]
cmp dword [ecx + 0x102a9a8], ebx
je 0x1026774
push eax
push 0x1001820
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x102634e
push ebx
push ebx
push 1
push 5
call fcn.01018dae
test eax, eax
jne 0x102634e
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a988]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x1026774
push ebx
lea eax, [ebp - 0x418]
push eax
mov eax, dword [ebp - 0x41c]
push ebx
push 0x20006
push ebx
push ebx
push ebx
push dword [eax + 0x102a988]
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026774
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a98c]
cmp eax, ebx
je 0x102648d
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x102648d
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x418]
call esi
push 0x103
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], 0x40
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x102648d
push 0x1009898
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x102648d
lea eax, [ebp - 0x20c]
push 0x2d
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x42c], eax
je 0x102648d
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a98c]
lea eax, [ebp - 0x20c]
push 0x10066f4
push eax
call edi
pop ecx
mov ecx, 0x103
sub ecx, eax
mov eax, dword [ebp - 0x42c]
push ecx
add eax, 2
push eax
call fcn.0100d4d1
add esp, 0x10
test eax, eax
jl 0x102648d
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x1007e04
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a990]
cmp eax, ebx
je 0x10265e2
push 0x452
push 0xa28
push 1
push 5
mov dword [ebp - 0x420], eax
call fcn.01018dae
test eax, eax
je 0x10264e5
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a988]
push 0x10018dc
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10264e5
mov dword [ebp - 0x420], 0x2727
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x10265e2
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100b8f0
push dword [ebp - 0x418]
call esi
push 0x103
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], 0x40
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x10265e2
push 0x1009898
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x10265e2
lea eax, [ebp - 0x20c]
push 0x2d
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x42c], eax
je 0x10265e2
push dword [ebp - 0x420]
lea eax, [ebp - 0x20c]
push 0x10066f4
push eax
call edi
pop ecx
mov ecx, 0x103
sub ecx, eax
mov eax, dword [ebp - 0x42c]
push ecx
add eax, 2
push eax
call fcn.0100d4d1
add esp, 0x10
test eax, eax
jl 0x10265e2
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100b8c0
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
cmp dword [eax + 0x102a994], ebx
je 0x1026668
push 0x452
push 0xa28
push 1
push 5
call fcn.01018dae
test eax, eax
je 0x1026638
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a988]
push 0x10018dc
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1026638
push 0x1009c60
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1009c60
jmp 0x1026658
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a994]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a994]
push 1
push ebx
push 0x1007270
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a998]
cmp eax, ebx
je 0x102669d
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a998]
push 1
push ebx
push 0x1007304
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a99c]
cmp eax, ebx
je 0x10266d2
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a99c]
push 1
push ebx
push 0x100724c
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a9a0]
cmp eax, ebx
je 0x1026707
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0x41c]
push dword [eax + 0x102a9a0]
push 1
push ebx
push 0x1007260
push dword [ebp - 0x418]
call esi
mov eax, dword [ebp - 0x41c]
mov eax, dword [eax + 0x102a9a4]
cmp eax, ebx
je 0x1026757
push 1
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push eax
call fcn.01028ba7
test eax, eax
jl 0x1026768
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10077c4
push dword [ebp - 0x418]
call esi
jmp 0x1026768
push 0x10077c4
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add dword [ebp - 0x41c], 0x24
cmp dword [ebp - 0x41c], 0x1f8
jb 0x10262e2
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x430]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc dword [ebp - 0x434]
cmp dword [ebp - 0x434], 2
jl 0x1025421
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b888
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102684a
push 0x100b838
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b838
push 1
push ebx
push 0x1004d04
push dword [ebp - 0x418]
call esi
push 0x100b7e8
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b7e8
push 1
push ebx
push 0x100b7d0
push dword [ebp - 0x418]
call esi
push 0x100b780
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b780
push 1
push ebx
push 0x100b76c
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b760
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026896
push 0x100b744
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b744
push 1
push ebx
push ebx
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b744
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102698d
push 0x1003c14
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push ebx
push 0x100b734
push dword [ebp - 0x418]
call esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x26c4
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1026921
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x418]
call esi
push 0x103
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x1026981
lea eax, [ebp - 0x20c]
push eax
push 0x100b6fc
lea eax, [ebp - 0x414]
push 0x104
push eax
call fcn.0100d4d1
add esp, 0x10
test eax, eax
jl 0x1026981
lea eax, [ebp - 0x414]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x414]
push eax
push 1
push ebx
push 0x1007e04
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b6c8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026a1a
push 0x103
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x1026a0e
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x100b6a4
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x1026a0e
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x452
push 0xa28
push 1
push 5
call fcn.01018dae
test eax, eax
je 0x1026e70
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b668
push 0x80000000
mov dword [ebp - 0x420], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026acf
push 0x100b618
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b618
push 1
push ebx
push 0x1004d04
push dword [ebp - 0x418]
call esi
push 0x100b7e8
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b7e8
push 1
push ebx
push 0x100b7d0
push dword [ebp - 0x418]
call esi
push 0x100b5c8
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b5c8
push 1
push ebx
push 0x100b76c
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b550
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026c9f
push 0x100b52c
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b52c
push 1
push ebx
push 0x100732c
push dword [ebp - 0x418]
call esi
push 0x103
push 1
lea eax, [ebp - 0x20c]
push eax
call fcn.010190e9
test eax, eax
je 0x1026b7a
lea eax, [ebp - 0x20c]
push eax
call fcn.01016cfc
push 0x100b6a4
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x1026b7a
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100991c
push dword [ebp - 0x418]
call esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0x26c7
push dword [0x102aec0]
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1026c09
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10098f0
push dword [ebp - 0x418]
call esi
push 0x26c7
push 0x10066f4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
test eax, eax
jl 0x1026c09
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x10098c0
push dword [ebp - 0x418]
call esi
push 0x100abb8
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100abb8
push 1
push ebx
push 0x1004230
push dword [ebp - 0x418]
call esi
push 0x1002570
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1002570
push 1
push ebx
push 0x1007890
push dword [ebp - 0x418]
call esi
push 4
lea eax, [ebp - 0x420]
push eax
push 4
push ebx
push 0x100b980
push dword [ebp - 0x418]
mov dword [ebp - 0x420], 7
call esi
push 4
lea eax, [ebp - 0x420]
push eax
push 4
push ebx
push 0x100b968
push dword [ebp - 0x418]
mov dword [ebp - 0x420], 0xf
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea ecx, [ebp - 0x20c]
mov eax, 0x26c7
push ecx
push eax
push dword [0x102aec0]
mov dword [ebp - 0x420], eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x1026e70
push 0x100b514
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x1026e70
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b498
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026d3d
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100b494
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b410
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026e20
push 0x103
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], 0x40
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
test eax, eax
je 0x1026e14
push 0x1009898
push 0x104
lea eax, [ebp - 0x20c]
push eax
call fcn.0100d4ff
test eax, eax
jl 0x1026e14
lea eax, [ebp - 0x20c]
push 0x2d
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0x42c], eax
je 0x1026e14
push dword [ebp - 0x420]
lea eax, [ebp - 0x20c]
push 0x10066f4
push eax
call edi
pop ecx
mov ecx, 0x103
sub ecx, eax
mov eax, dword [ebp - 0x42c]
push ecx
add eax, 2
push eax
call fcn.0100d4d1
add esp, 0x10
test eax, eax
jl 0x1026e14
lea eax, [ebp - 0x20c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x20c]
push eax
push 1
push ebx
push 0x100b494
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x418]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push 0x100b3a0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1026e70
push 0x100b38c
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x100b38c
push 1
push ebx
push 0x100b494
push dword [ebp - 0x418]
call esi
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret