Function at 0x10002ca0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x1004f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x22a]
push ecx
mov word [ebp - 0x22c], ax
call fcn.1000ae30
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x432]
push eax
mov word [ebp - 0x434], dx
call fcn.1000ae30
push 0x104
lea ecx, [ebp - 0x434]
push ecx
push 8
call fcn.10028b20
add esp, 0x24
mov ecx, 0x10050f94
call fcn.1001b4a0
lea edx, [ebp - 0x43c]
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x10002d30
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x43c]
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push edi
push str.Enable
push eax
call esi
mov ecx, dword [ebp - 0x43c]
push str.ShowTip
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 0x104
push str.group
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002d77
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub eax, edx
mov edx, dword [ebp - 0x43c]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.type
push edx
call esi
mov ecx, dword [0x10050e00]
mov ebx, dword [sym.imp.USER32.dll_LoadStringW]
push 0x104
lea eax, [ebp - 0x22c]
push eax
push 0x6f
push ecx
call ebx
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002dd0
mov ecx, dword [ebp - 0x43c]
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.Text
push ecx
call esi
push 0x64
lea edx, [ebp - 0x434]
push edx
push str._s__d
lea eax, [ebp - 0x22c]
push 0x103
push eax
call fcn.1000c37d
lea eax, [ebp - 0x22c]
add esp, 0x14
lea ecx, [eax + 2]
jmp 0x10002e30
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10002e30
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x43c]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.Bitmap
push eax
call esi
mov ecx, 0x10050fa4
call fcn.1001b4a0
mov edx, dword [ebp - 0x43c]
lea ecx, [ebp - 0x438]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000312f
push 0x104
push str.checkbox
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10002ea0
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.type
push eax
call esi
mov edx, dword [0x10050e00]
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0x7c
push edx
call ebx
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea ecx, [ecx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10002ef0
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.text
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10002f40
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.checkvalue
push eax
call esi
push 0x104
push 0x1004110c
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10002f90
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.DefaultValue
push ecx
call esi
push 0x104
call fcn.10023f10
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10002fe0
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.RegPath
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003030
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.CheckedValue
push eax
call esi
push 0x104
push 0x100410a4
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003080
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.UncheckedValue
push ecx
call esi
push 0x104
mov ecx, 0x10050fa4
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100030d0
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.ValueName
push edx
call esi
mov ecx, dword [ebp - 0x438]
push 4
lea eax, [ebp - 0x440]
push eax
push 4
push 0
push str.HkeyRoot
push ecx
mov dword [ebp - 0x440], VariantClear
call esi
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10050fb4
call fcn.1001b4a0
mov edx, dword [ebp - 0x43c]
lea ecx, [ebp - 0x438]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100033ff
push 0x104
push str.checkbox
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003172
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.type
push eax
call esi
mov edx, dword [0x10050e00]
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0x7d
push edx
call ebx
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100031c0
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.text
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003210
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.checkvalue
push eax
call esi
push 0x104
push 0x1004110c
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003260
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.DefaultValue
push ecx
call esi
push 0x104
call fcn.10023f10
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100032b0
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.RegPath
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003300
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.CheckedValue
push eax
call esi
push 0x104
push 0x100410a4
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003350
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.UncheckedValue
push ecx
call esi
push 0x104
mov ecx, 0x10050fb4
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100033a0
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.ValueName
push edx
call esi
mov ecx, dword [ebp - 0x438]
push 4
lea eax, [ebp - 0x440]
push eax
push 4
push 0
push str.HkeyRoot
push ecx
mov dword [ebp - 0x440], VariantClear
call esi
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10050fc4
call fcn.1001b4a0
mov edx, dword [ebp - 0x43c]
lea ecx, [ebp - 0x438]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x100036cf
push 0x104
push str.checkbox
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003442
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.type
push eax
call esi
mov edx, dword [0x10050e00]
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0x7e
push edx
call ebx
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003490
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.text
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100034e0
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.checkvalue
push eax
call esi
push 0x104
push 0x1004110c
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003530
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.DefaultValue
push ecx
call esi
push 0x104
call fcn.10023f10
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003580
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.RegPath
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100035d0
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.CheckedValue
push eax
call esi
push 0x104
push 0x100410a4
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003620
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.UncheckedValue
push ecx
call esi
push 0x104
mov ecx, 0x10050fc4
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003670
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.ValueName
push edx
call esi
mov ecx, dword [ebp - 0x438]
push 4
lea eax, [ebp - 0x440]
push eax
push 4
push 0
push str.HkeyRoot
push ecx
mov dword [ebp - 0x440], VariantClear
call esi
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10050fd4
call fcn.1001b4a0
mov edx, dword [ebp - 0x43c]
lea ecx, [ebp - 0x438]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000399f
push 0x104
push str.checkbox
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003712
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.type
push eax
call esi
mov edx, dword [0x10050e00]
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0x7f
push edx
call ebx
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003760
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.text
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100037b0
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.checkvalue
push eax
call esi
push 0x104
push 0x1004110c
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003800
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.DefaultValue
push ecx
call esi
push 0x104
call fcn.10023f10
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003850
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.RegPath
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100038a0
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.CheckedValue
push eax
call esi
push 0x104
push 0x100410a4
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x100038f0
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.UncheckedValue
push ecx
call esi
push 0x104
mov ecx, 0x10050fd4
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003940
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.ValueName
push edx
call esi
mov ecx, dword [ebp - 0x438]
push 4
lea eax, [ebp - 0x440]
push eax
push 4
push 0
push str.HkeyRoot
push ecx
mov dword [ebp - 0x440], VariantClear
call esi
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10050fe4
call fcn.1001b4a0
mov edx, dword [ebp - 0x43c]
lea ecx, [ebp - 0x438]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x10003c6f
push 0x104
push str.checkbox
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100039e2
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.type
push eax
call esi
mov edx, dword [0x10050e00]
push 0x104
lea ecx, [ebp - 0x22c]
push ecx
push 0x80
push edx
call ebx
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003a32
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.text
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
jmp 0x10003a80
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003a80
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.checkvalue
push eax
call esi
push 0x104
push 0x1004110c
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003ad0
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.DefaultValue
push ecx
call esi
push 0x104
call fcn.10023f10
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003b20
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.RegPath
push edx
call esi
push 0x104
push 0x1004110c
lea eax, [ebp - 0x22c]
push eax
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003b70
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0x438]
push ecx
lea edx, [ebp - 0x22c]
push edx
push 1
push 0
push str.CheckedValue
push eax
call esi
push 0x104
push 0x100410a4
lea ecx, [ebp - 0x22c]
push ecx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
lea esp, [esp]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003bc0
sub eax, ecx
mov ecx, dword [ebp - 0x438]
sar eax, 1
lea edx, [eax + eax + 2]
push edx
lea eax, [ebp - 0x22c]
push eax
push 1
push 0
push str.UncheckedValue
push ecx
call esi
push 0x104
mov ecx, 0x10050fe4
call fcn.1001b4a0
push eax
lea edx, [ebp - 0x22c]
push edx
call edi
lea eax, [ebp - 0x22c]
lea ecx, [eax + 2]
nop
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x10003c10
mov edx, dword [ebp - 0x438]
sub eax, ecx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push 0
push str.ValueName
push edx
call esi
mov ecx, dword [ebp - 0x438]
push 4
lea eax, [ebp - 0x440]
push eax
push 4
push 0
push str.HkeyRoot
push ecx
mov dword [ebp - 0x440], VariantClear
call esi
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x43c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x10050fa4
call fcn.1001b4a0
mov ecx, 0x10050fb4
mov dword [ebp - 0x460], eax
call fcn.1001b4a0
mov ecx, 0x10050fc4
mov dword [ebp - 0x45c], eax
call fcn.1001b4a0
mov ecx, 0x10050fd4
mov dword [ebp - 0x458], eax
call fcn.1001b4a0
mov ecx, 0x10050fe4
mov dword [ebp - 0x454], eax
call fcn.1001b4a0
push 0x104
push 0x1004110c
lea ecx, [ebp - 0x22c]
push ecx
mov dword [ebp - 0x450], eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor edi, edi
jmp 0x10003cf0
mov esi, dword [ebp + edi*4 - 0x460]
xor eax, eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
xor edx, edx
lea eax, [ebp - 0x44c]
push eax
lea ecx, [ebp - 0x24]
mov word [ebp - 0x24], dx
push ecx
lea edx, [ebp - 0x444]
push edx
push esi
mov dword [ebp - 0x444], 1
mov dword [ebp - 0x44c], 0x20
call fcn.10023f10
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x10003d8b
lea eax, [ebp - 0x22c]
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10003d60
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x22c]
push ecx
push 1
push esi
call fcn.10023f10
push eax
push SysReAllocString
call ebx
inc edi
cmp edi, 5
jb 0x10003cf0
mov ecx, 0x10051084
mov dword [ebp - 0x448], 2
call fcn.1001b4a0
push 4
lea edx, [ebp - 0x448]
push edx
push 4
push eax
mov ecx, 0x10051074
call fcn.1001b4a0
push eax
push SysReAllocString
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1000ae1e
mov esp, ebp
pop ebp
ret