Function at 0x1033448
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x910
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
xor edi, edi
inc edi
mov dword [ebp - 0x904], ecx
mov ecx, dword [ebp + 0x1c]
mov dword [ebp - 0x8f0], eax
mov dword [ebp - 0x910], ecx
mov dword [ebp - 0x8e8], ebx
mov dword [ebp - 0x8ec], ebx
mov dword [ebp - 0x8e4], edi
mov dword [ebp - 0x8fc], ebx
mov dword [ebp - 0x8f4], ebx
mov dword [ebp - 0x90c], edi
mov dword [ebp - 0x900], edi
mov dword [ebp - 0x8f8], ebx
cmp eax, ebx
je 0x1033e73
push 0x1006b20
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
jne 0x10334e1
push dword [ebp - 0x8f0]
mov dword [ebp - 0x8f8], edi
push esi
push 0x1006ae0
jmp 0x103350b
push 0x1006ad8
push dword [ebp - 0x8f0]
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
push dword [ebp - 0x8f0]
push esi
test eax, eax
jne 0x1033506
push 0x1006a98
jmp 0x103350b
push 0x1006a70
lea eax, [ebp - 0x48c]
push 0x121
push eax
call fcn.01027f64
add esp, 0x14
push dword [ebp - 0x8f0]
lea eax, [ebp - 0x248]
push 0x1006a3c
push 0x121
push eax
call fcn.01027f64
add esp, 0x10
push ebx
lea eax, [ebp - 0x8e8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x248]
push eax
mov edi, 0x80000000
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x103361a
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10335df
cmp dword [ebp - 0x8e4], 1
je 0x10335b3
cmp dword [ebp - 0x8e4], 2
jne 0x10335df
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0103172f
test eax, eax
jne 0x103360e
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10335d3
jmp 0x10335f2
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10335e8
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x8e8]
call esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e8]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [ebp - 0x8f0]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033dff
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x8e0]
push eax
push 1
push ebx
push 0x1006498
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8e0], ebx
call edi
test eax, eax
jne 0x10337a1
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033795
cmp dword [ebp - 0x8e4], 1
jne 0x1033795
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1033795
lea eax, [ebp - 0x248]
push 0x100648c
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1033795
push 0x1006a28
push 0x122
lea eax, [ebp - 0x248]
push eax
mov dword [ebp - 0x908], ebx
call fcn.01027edd
lea eax, [ebp - 0x908]
push eax
push 1
push ebx
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e0]
call edi
test eax, eax
jne 0x1033795
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x908]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033789
cmp dword [ebp - 0x8e4], 1
je 0x1033759
cmp dword [ebp - 0x8e4], 2
jne 0x1033789
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1033789
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8f0]
push 2
call fcn.01032084
mov dword [ebp - 0x900], eax
mov dword [ebp - 0x90c], ebx
push dword [ebp - 0x908]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x10064d8
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033df3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call edi
test eax, eax
jne 0x10338fd
cmp dword [ebp - 0x8e4], 1
je 0x1033818
cmp dword [ebp - 0x8e4], 2
jne 0x10338fd
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x10338fd
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8f0]
push 2
call fcn.01032084
test eax, eax
je 0x1033944
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x8fc], eax
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x8dc]
push eax
call fcn.01027e68
lea eax, [ebp - 0x8dc]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x8dc]
push eax
call fcn.01031552
test eax, eax
jne 0x10338c3
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033893
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x10064bc
push dword [ebp - 0x8e0]
call esi
jmp 0x10338cf
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x8f4], eax
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0103172f
test eax, eax
jne 0x1033944
lea eax, [ebp - 0x48c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10338ef
sub eax, edx
jmp 0x103392a
mov eax, dword [ebp - 0x900]
mov dword [ebp - 0x8fc], eax
mov eax, dword [ebp - 0x90c]
mov dword [ebp - 0x8f4], eax
lea eax, [ebp - 0x48c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
cmp dx, bx
jne 0x103391e
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x48c]
push eax
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8fc], ebx
je 0x1033df3
push 0x105
lea eax, [ebp - 0x8a4]
push eax
call fcn.0102fc69
test eax, eax
je 0x1033df3
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8ec], 0x244
call edi
test eax, eax
jne 0x10339ab
cmp dword [ebp - 0x8e4], 1
je 0x10339d9
mov eax, dword [ebp - 0x8f0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10339b4
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x8f0]
push 1
push ebx
push ebx
push dword [ebp - 0x8e8]
call esi
push ebx
push ebx
push ebx
push ebx
mov edi, 0x1006a14
push edi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1033a06
push 0xc
push 0x1006a08
push 1
push ebx
push edi
push dword [ebp - 0x8e8]
call esi
push ebx
push ebx
push ebx
push ebx
mov edi, 0x10069f4
push edi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1033a4f
push 4
lea eax, [ebp - 0x8f0]
push eax
push 3
push ebx
push edi
push dword [ebp - 0x8e8]
mov byte [ebp - 0x8f0], 2
mov byte [ebp - 0x8ef], bl
mov byte [ebp - 0x8ee], 0x10
mov byte [ebp - 0x8ed], bl
call esi
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
mov edi, 0x2001f
push edi
push ebx
push ebx
push ebx
push 0x10064a4
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033c1a
mov dword [ebp - 0x8ec], 0x244
cmp dword [ebp - 0x8f4], ebx
jne 0x1033b10
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033b10
cmp dword [ebp - 0x8e4], 1
je 0x1033ac9
cmp dword [ebp - 0x8e4], 2
jne 0x1033b10
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1033b10
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033ae2
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x10064bc
push dword [ebp - 0x8e0]
call esi
mov eax, dword [ebp - 0x910]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033b19
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x910]
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
lea eax, [ebp - 0x8a4]
push eax
push 0x10069e0
lea eax, [ebp - 0x698]
push 0x105
push eax
call fcn.01027f64
add esp, 0x10
test eax, eax
jl 0x1033c09
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
mov edi, 0x1004364
push edi
push dword [ebp - 0x8e0]
mov dword [ebp - 0x8ec], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033bda
cmp dword [ebp - 0x8e4], 1
je 0x1033bae
cmp dword [ebp - 0x8e4], 2
jne 0x1033bda
lea eax, [ebp - 0x698]
push eax
lea eax, [ebp - 0x248]
push eax
call fcn.0103172f
test eax, eax
jne 0x1033c09
lea eax, [ebp - 0x698]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033bce
jmp 0x1033bed
lea eax, [ebp - 0x698]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033be3
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x698]
push eax
push 1
push ebx
push edi
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 0x2001f
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x1006498
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033ce4
mov dword [ebp - 0x8ec], 0x244
cmp dword [ebp - 0x8f4], ebx
jne 0x1033cc5
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033cc5
cmp dword [ebp - 0x8e4], 1
jne 0x1033cc5
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1033cc5
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033c9b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push 1
push ebx
push 0x10064bc
push dword [ebp - 0x8e0]
call esi
push 0xa
push 0x1001a54
push 1
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0x8e0]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
push 0x1006474
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1033df3
mov dword [ebp - 0x8ec], 0x244
cmp dword [ebp - 0x8f4], ebx
jne 0x1033db9
lea eax, [ebp - 0x8ec]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x8e4]
push eax
push ebx
push ebx
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1033db9
cmp dword [ebp - 0x8e4], 1
je 0x1033d59
cmp dword [ebp - 0x8e4], 2
jne 0x1033db9
lea eax, [ebp - 0x248]
push eax
call fcn.010313bf
test eax, eax
je 0x1033db9
push dword [ebp - 0x904]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x1033db9
lea eax, [ebp - 0x248]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033d8b
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x8e4]
push ebx
push 0x10064bc
push dword [ebp - 0x8e0]
call esi
mov eax, dword [ebp - 0x904]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1033dc2
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x904]
push 2
push ebx
push ebx
push dword [ebp - 0x8e0]
call esi
push dword [ebp - 0x8e0]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x8f8], ebx
je 0x1033e73
cmp dword [ebp - 0x8fc], ebx
je 0x1033e73
lea eax, [ebp - 0x8e8]
push eax
push 0x2001f
push ebx
push 0x1006958
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1033e73
push 4
pop edi
push edi
lea eax, [ebp - 0x8f8]
push eax
push edi
push ebx
push 0x100694c
push dword [ebp - 0x8e8]
mov dword [ebp - 0x8f8], ebx
call esi
push edi
lea eax, [ebp - 0x8f8]
push eax
push edi
push ebx
push 0x1006938
push dword [ebp - 0x8e8]
call esi
push dword [ebp - 0x8e8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 0x18