Function at 0x1035c9a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
lea ecx, [ebp - 0x62c]
mov dword [ebp - 0x60c], esi
call fcn.01039115
xor edi, edi
inc edi
cmp ebx, esi
mov dword [ebp - 0x608], edi
jne 0x1035cf3
lea ecx, [ebp - 0x62c]
call fcn.01039136
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 0xc
cmp dword [ebp + 0x10], esi
je 0x1035d08
lea eax, [ebp - 0x62c]
push eax
call fcn.01040cfa
test eax, eax
je 0x1035cd5
push ebx
push dword [0x10472a0]
lea eax, [ebp - 0x4c8]
push 0x10077ec
push 0x103
push eax
call fcn.01028b64
add esp, 0x14
test eax, eax
jl 0x1035cd5
lea eax, [ebp - 0x60c]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x4c8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1035d5e
lea ecx, [ebp - 0x62c]
call fcn.01039136
mov eax, esi
jmp 0x1035ce2
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x10077d4
push dword [ebp - 0x60c]
mov dword [ebp - 0x5f8], esi
mov dword [ebp - 0x604], 0x208
mov dword [ebp - 0x600], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jne 0x1035fa2
cmp dword [ebp - 0x600], 1
jne 0x1035fa2
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01028a67
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x1035df2
mov word [eax], si
lea eax, [ebp - 0x130]
push eax
push dword [0x10472a0]
lea eax, [ebp - 0x2c0]
push 0x10078dc
push 0xc7
push eax
call fcn.01028b64
add esp, 0x14
cmp dword [ebp + 0xc], esi
je 0x1035eaa
test eax, eax
jl 0x1035e85
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x104941c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1035e69
push 8
push 0x10024b0
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x1035e8b
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.010424d0
test eax, eax
jne 0x1035e8b
mov dword [ebp - 0x608], esi
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x1035fa2
inc eax
inc eax
jmp 0x1035dc2
test eax, eax
jl 0x1035e85
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x104941c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1035ef2
push 6
push 0x1006914
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x1035e8b
lea eax, [ebp - 0x5f8]
push eax
push 0x20006
push esi
lea eax, [ebp - 0x2c0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1035e8b
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x1007890
push dword [ebp - 0x5f8]
mov dword [ebp - 0x604], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1035f5c
cmp dword [ebp - 0x600], 1
je 0x1035f7c
lea eax, [ebp - 0x130]
push eax
push 0x1007880
lea eax, [ebp - 0x5f4]
push 0x95
push eax
call fcn.01028b64
add esp, 0x10
push 0x1004598
push esi
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.0103c333
push dword [ebp - 0x5f8]
call edi
jmp 0x1035e8b
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x1007868
push dword [ebp - 0x60c]
mov dword [ebp - 0x604], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1036102
cmp dword [ebp - 0x600], 1
jne 0x1036102
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01028a67
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x103601e
mov word [eax], si
lea eax, [ebp - 0x130]
push eax
push dword [0x10472a0]
lea eax, [ebp - 0x2c0]
push 0x1007844
push 0xc7
push eax
call fcn.01028b64
add esp, 0x14
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x104941c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], esi
je 0x10360b1
test eax, eax
jne 0x103608d
push 8
push 0x10024b0
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x10360e7
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.01042521
test eax, eax
jne 0x10360e7
mov dword [ebp - 0x608], esi
jmp 0x10360e7
test eax, eax
jne 0x10360d4
push 6
push 0x1006914
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x10360e7
push 1
lea eax, [ebp - 0x130]
push eax
call fcn.010433d0
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x1036102
inc eax
inc eax
jmp 0x1035fee
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x10077b0
push dword [ebp - 0x60c]
mov dword [ebp - 0x604], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1036260
cmp dword [ebp - 0x600], 1
jne 0x1036260
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01028a67
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x103617e
mov word [eax], si
lea eax, [ebp - 0x130]
push eax
push dword [0x10472a0]
lea eax, [ebp - 0x2c0]
push 0x1007824
push 0xc7
push eax
call fcn.01028b64
add esp, 0x14
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x104941c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], esi
je 0x1036211
test eax, eax
jne 0x10361ed
push 8
push 0x10024b0
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x1036245
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.0104257e
test eax, eax
jne 0x1036245
mov dword [ebp - 0x608], esi
jmp 0x1036245
test eax, eax
jne 0x1036234
push 6
push 0x1006914
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x1036245
lea eax, [ebp - 0x130]
push eax
call fcn.01039e45
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x1036260
inc eax
inc eax
jmp 0x103614e
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x10077c4
push dword [ebp - 0x60c]
mov dword [ebp - 0x604], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10363be
cmp dword [ebp - 0x600], 1
jne 0x10363be
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01028a67
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x10362dc
mov word [eax], si
lea eax, [ebp - 0x130]
push eax
push dword [0x10472a0]
lea eax, [ebp - 0x2c0]
push 0x1007808
push 0xc7
push eax
call fcn.01028b64
add esp, 0x14
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x104941c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], esi
je 0x103636f
test eax, eax
jne 0x103634b
push 8
push 0x10024b0
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x10363a3
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.01042600
test eax, eax
jne 0x10363a3
mov dword [ebp - 0x608], esi
jmp 0x10363a3
test eax, eax
jne 0x1036392
push 6
push 0x1006914
push 1
push esi
push 0x10078b4
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x10363a3
lea eax, [ebp - 0x130]
push eax
call fcn.01038b39
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
cmp eax, esi
pop ecx
pop ecx
je 0x10363be
inc eax
inc eax
jmp 0x10362ac
push dword [ebp - 0x60c]
call edi
mov esi, dword [ebp - 0x608]
jmp 0x1035d4f