Function at 0x101eed4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x704
mov eax, dword [0x102a0ec]
mov ecx, dword [ebp + 0x10]
push ebx
xor ebx, ebx
push esi
xor esi, esi
inc esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, ebx
mov dword [ebp - 0x6fc], ecx
mov ecx, dword [ebp + 0x1c]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6e0], eax
mov dword [ebp - 0x704], ecx
mov dword [ebp - 0x6dc], ebx
mov dword [ebp - 0x6e4], ebx
mov dword [ebp - 0x6d8], esi
mov dword [ebp - 0x6f0], ebx
mov dword [ebp - 0x6e8], ebx
mov dword [ebp - 0x6f8], esi
mov dword [ebp - 0x700], esi
mov dword [ebp - 0x6ec], ebx
je 0x101f739
push 0x1007c48
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101ef6b
push dword [ebp - 0x6e0]
mov dword [ebp - 0x6ec], esi
push edi
push 0x1007c08
jmp 0x101ef95
push 0x1007c00
push dword [ebp - 0x6e0]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
push dword [ebp - 0x6e0]
push edi
jne 0x101ef90
push 0x1007bc0
jmp 0x101ef95
push 0x1007b98
lea eax, [ebp - 0x48c]
push 0x121
push eax
call fcn.0100d4d1
add esp, 0x14
push dword [ebp - 0x6e0]
lea eax, [ebp - 0x248]
push 0x1007b64
push 0x121
push eax
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0x6dc]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
jne 0x101f029
lea eax, [ebp - 0x48c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x6dc]
call esi
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x6dc]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp - 0x6e0]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101f6c5
lea eax, [ebp - 0x6d4]
push eax
push 1
push ebx
push 0x10074d0
push dword [ebp - 0x6dc]
mov dword [ebp - 0x6d4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f1b6
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x6d8]
push eax
push ebx
push ebx
push dword [ebp - 0x6d4]
mov dword [ebp - 0x6e4], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f1aa
cmp dword [ebp - 0x6d8], 1
jne 0x101f1aa
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101f1aa
lea eax, [ebp - 0x248]
push 0x1004490
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101f1aa
push 0x1007b50
push 0x122
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x6f4], ebx
call fcn.0100d4ff
lea eax, [ebp - 0x6f4]
push eax
push 1
push ebx
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f1aa
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x6d8]
push eax
push ebx
push ebx
push dword [ebp - 0x6f4]
mov dword [ebp - 0x6e4], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f19e
cmp dword [ebp - 0x6d8], 1
je 0x101f16e
cmp dword [ebp - 0x6d8], 2
jne 0x101f19e
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101f19e
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x6e0]
push 2
call fcn.0101de76
mov dword [ebp - 0x700], eax
mov dword [ebp - 0x6f8], ebx
push dword [ebp - 0x6f4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x6d4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1007520
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101f6b9
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x6d8]
push eax
push ebx
push ebx
push dword [ebp - 0x6d4]
mov dword [ebp - 0x6e4], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f2c9
cmp dword [ebp - 0x6d8], 1
je 0x101f22b
cmp dword [ebp - 0x6d8], 2
jne 0x101f2c9
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101f2c9
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x6e0]
push 2
call fcn.0101de76
test eax, eax
je 0x101f303
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x6f0], eax
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x6d0]
push eax
call fcn.0100c535
lea eax, [ebp - 0x6d0]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x6d0]
push eax
call fcn.0101b4c4
test eax, eax
jne 0x101f2d5
lea eax, [ebp - 0x248]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x6d8]
push ebx
push 0x1007504
push dword [ebp - 0x6d4]
call esi
jmp 0x101f2e1
mov eax, dword [ebp - 0x700]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x6f8]
mov dword [ebp - 0x6e8], eax
lea eax, [ebp - 0x48c]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x6d4]
call esi
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6f0], ebx
je 0x101f6b9
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x6d8]
push eax
push ebx
push ebx
push dword [ebp - 0x6dc]
mov dword [ebp - 0x6e4], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f355
cmp dword [ebp - 0x6d8], 1
je 0x101f375
push dword [ebp - 0x6e0]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x6e0]
push 1
push ebx
push ebx
push dword [ebp - 0x6dc]
call esi
push ebx
push ebx
push ebx
push ebx
push 0x1007b3c
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x101f3b0
push 0x1007b30
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1007b30
push 1
push ebx
push 0x1007b3c
push dword [ebp - 0x6dc]
call esi
push ebx
push ebx
push ebx
push ebx
push 0x1007b1c
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x101f3fb
push 4
lea eax, [ebp - 0x6e0]
push eax
push 3
push ebx
push 0x1007b1c
push dword [ebp - 0x6dc]
mov byte [ebp - 0x6e0], 2
mov byte [ebp - 0x6df], bl
mov byte [ebp - 0x6de], bl
mov byte [ebp - 0x6dd], bl
call esi
push ebx
lea eax, [ebp - 0x6d4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x10074ec
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101f4f1
cmp dword [ebp - 0x6e8], ebx
mov dword [ebp - 0x6e4], 0x244
jne 0x101f4a1
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x6d8]
push eax
push ebx
push ebx
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f4a1
cmp dword [ebp - 0x6d8], 1
jne 0x101f4a1
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101f4a1
lea eax, [ebp - 0x248]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x6d8]
push ebx
push 0x1007504
push dword [ebp - 0x6d4]
call esi
push dword [ebp - 0x704]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x704]
push 1
push ebx
push ebx
push dword [ebp - 0x6d4]
call esi
push dword [0x102a100]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x102a100]
push 2
push ebx
push 0x10074dc
push dword [ebp - 0x6d4]
call esi
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x6d4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x10074d0
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101f5c1
cmp dword [ebp - 0x6e8], ebx
mov dword [ebp - 0x6e4], 0x244
jne 0x101f597
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x6d8]
push eax
push ebx
push ebx
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f597
cmp dword [ebp - 0x6d8], 1
jne 0x101f597
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101f597
lea eax, [ebp - 0x248]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x6d8]
push ebx
push 0x1007504
push dword [ebp - 0x6d4]
call esi
push 0x1007b10
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1007b10
push 1
push ebx
push ebx
push dword [ebp - 0x6d4]
call esi
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x6d4]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x10074b8
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101f6b9
cmp dword [ebp - 0x6e8], ebx
mov dword [ebp - 0x6e4], 0x244
jne 0x101f68d
lea eax, [ebp - 0x6e4]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x6d8]
push eax
push ebx
push ebx
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101f68d
cmp dword [ebp - 0x6d8], 1
je 0x101f63a
cmp dword [ebp - 0x6d8], 2
jne 0x101f68d
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101f68d
push dword [ebp - 0x6fc]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x101f68d
lea eax, [ebp - 0x248]
push eax
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x6d8]
push ebx
push 0x1007504
push dword [ebp - 0x6d4]
call esi
push dword [ebp - 0x6fc]
call edi
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x6fc]
push 1
push ebx
push ebx
push dword [ebp - 0x6d4]
call esi
push dword [ebp - 0x6d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x6ec], ebx
je 0x101f739
cmp dword [ebp - 0x6f0], ebx
je 0x101f739
lea eax, [ebp - 0x6dc]
push eax
push 0x2001f
push ebx
push 0x1007a88
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101f739
push 4
pop edi
push edi
lea eax, [ebp - 0x6ec]
push eax
push edi
push ebx
push 0x1007a7c
push dword [ebp - 0x6dc]
mov dword [ebp - 0x6ec], ebx
call esi
push edi
lea eax, [ebp - 0x6ec]
push eax
push edi
push ebx
push 0x1007a68
push dword [ebp - 0x6dc]
call esi
push dword [ebp - 0x6dc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret 0x18