Function at 0x1052fc4
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x107c
call fcn.0106bfb4
mov eax, dword [0x1099a38]
or dword [ebp - 0x1054], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [sym.imp.UPDSPAPI.dll_UpdSpGetStringFieldW]
lea ecx, [ebp - 0x1060]
push ecx
mov esi, 0x104
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1044]
push ecx
mov dword [ebp - 0x104c], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 1
push eax
mov dword [ebp - 0x1048], eax
mov dword [ebp - 0x1064], ebx
mov dword [ebp - 0x1068], ebx
mov dword [ebp - 0x1058], ebx
mov dword [ebp - 0x1078], ebx
mov dword [ebp - 0x1060], esi
call edi
test eax, eax
jne 0x105304a
push dword [ebp - 0x104c]
push 0x10197dc
jmp 0x10531f1
lea eax, [ebp - 0x1070]
push eax
lea eax, [ebp - 0x1044]
push eax
call fcn.01050340
test eax, eax
je 0x10534d0
lea eax, [ebp - 0x1060]
push eax
push esi
lea eax, [ebp - 0x61c]
push eax
push 2
push dword [ebp - 0x1048]
mov word [ebp - 0x416], bx
call edi
test eax, eax
jne 0x105309d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x104c]
push 0x10197b4
jmp 0x105310b
lea eax, [ebp - 0x1060]
push eax
push esi
lea eax, [ebp - 0x414]
push eax
push 3
push dword [ebp - 0x1048]
mov word [ebp - 0x20e], bx
call edi
test eax, eax
jne 0x10530d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x104c]
push 0x101977c
jmp 0x105310b
lea eax, [ebp - 0x1060]
push eax
push esi
lea eax, [ebp - 0x1044]
push eax
push 4
push dword [ebp - 0x1048]
mov word [ebp - 0xe3e], bx
call edi
test eax, eax
jne 0x1053118
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x104c]
push 0x1019750
call fcn.01071ac0
add esp, 0xc
jmp 0x10534d0
push ebx
lea eax, [ebp - 0x1044]
push ebx
push eax
call dword [sym.imp.msvcrt.dll_wcstoul]
add esp, 0xc
test eax, 0x20000
mov dword [ebp - 0x107c], eax
je 0x1053143
mov dword [ebp - 0x1050], 2
jmp 0x1053155
test al, 8
je 0x10534b5
mov dword [ebp - 0x1050], 1
lea eax, [ebp - 0x1068]
push eax
push esi
lea eax, [ebp - 0x20c]
push eax
push 5
push dword [ebp - 0x1048]
mov word [ebp - 6], bx
mov dword [ebp - 0x1068], esi
call edi
test eax, eax
jne 0x105319a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp - 0x104c]
lea eax, [ebp - 0x61c]
push eax
push 0x101971c
jmp 0x10534c8
mov esi, dword [ebp - 0x1068]
lea eax, [ebp - 0x106c]
push eax
lea eax, [ebp - 0x1054]
push eax
mov eax, dword [ebp - 0x107c]
and eax, 0x1000
push ebx
or eax, 0x2001f0
shr eax, 4
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x61c]
push eax
push dword [ebp - 0x1070]
add esi, esi
mov dword [ebp - 0x105c], esi
mov dword [ebp - 0x106c], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x10531fd
push eax
push 0x10196e8
call fcn.01071ac0
pop ecx
pop ecx
jmp 0x10534d0
cmp dword [ebp - 0x106c], 2
jne 0x1053443
lea eax, [ebp - 0x1058]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1053443
mov ecx, dword [ebp - 0x1058]
mov eax, 0xa28
add ecx, esi
cmp ecx, eax
lea edi, [ebp - 0x1044]
mov dword [ebp - 0x1048], eax
jbe 0x1053271
lea eax, [ecx + 2]
push eax
mov dword [ebp - 0x1048], eax
call dword [sym.imp.msvcrt.dll_malloc]
mov edi, eax
cmp edi, ebx
pop ecx
je 0x1053367
mov dword [ebp - 0x1078], 1
mov eax, dword [ebp - 0x1048]
mov word [edi + eax*2 - 2], bx
lea eax, [ebp - 0x1058]
push eax
lea eax, [ebp - 0x1044]
push eax
lea eax, [ebp - 0x1074]
push eax
push ebx
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
je 0x10532c3
push eax
lea eax, [ebp - 0x414]
push eax
push 0x10196c4
call fcn.01071ac0
add esp, 0xc
jmp 0x1053353
mov eax, dword [ebp - 0x1050]
cmp eax, dword [ebp - 0x1074]
je 0x10532f5
lea ecx, [ebp - 0x414]
push ecx
lea ecx, [ebp - 0x61c]
push ecx
push eax
push dword [ebp - 0x1074]
push 0x1019694
call fcn.01071ac0
add esp, 0x14
jmp 0x1053353
test byte [ebp - 0x107c], 0x80
jne 0x1053385
mov eax, dword [ebp - 0x1058]
cmp eax, ebx
jbe 0x10533de
cmp eax, esi
jb 0x105338b
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x1053385
push dword [ebp - 0x104c]
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x1019678
call fcn.01071ac0
add esp, 0x10
mov dword [ebp - 0x1064], 1
cmp dword [ebp - 0x1078], ebx
je 0x1053367
cmp edi, ebx
je 0x1053367
push edi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
cmp dword [ebp - 0x1054], 0xffffffff
je 0x10534d0
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10534d0
mov eax, dword [ebp - 0x1058]
cmp eax, ebx
jbe 0x10533de
lea ecx, [eax - 2]
shr ecx, 1
lea ecx, [edi + ecx*2]
cmp word [ecx], bx
je 0x10533bf
lea ecx, [esi + eax]
mov dword [ebp - 0x105c], ecx
lea ecx, [ebp - 0x20c]
push ecx
push 0x1019670
push dword [ebp - 0x1048]
shr eax, 1
lea eax, [edi + eax*2]
push eax
jmp 0x10533f0
lea eax, [esi + eax - 2]
mov dword [ebp - 0x105c], eax
lea eax, [ebp - 0x20c]
push eax
push 0x1019670
push dword [ebp - 0x1048]
push ecx
jmp 0x10533f0
lea eax, [ebp - 0x20c]
push eax
mov eax, esi
push 0x1019670
shr eax, 1
push eax
push edi
call fcn.01050440
add esp, 0x10
push dword [ebp - 0x105c]
lea eax, [ebp - 0x414]
push edi
push dword [ebp - 0x1050]
push ebx
push eax
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov dword [ebp - 0x1050], eax
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x105c]
push esi
push dword [ebp - 0x1058]
push 0x1019654
call fcn.01071b14
add esp, 0x18
jmp 0x1053484
push esi
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x1050]
lea eax, [ebp - 0x414]
push ebx
push eax
push dword [ebp - 0x1054]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x1050], eax
lea eax, [ebp - 0x20c]
push eax
push 0x1019644
call fcn.01071b14
mov edi, dword [ebp - 0x1070]
pop ecx
pop ecx
cmp dword [ebp - 0x1050], ebx
je 0x1053349
push dword [ebp - 0x1050]
lea eax, [ebp - 0x414]
push dword [ebp - 0x104c]
push eax
push 0x1019610
call fcn.01071ac0
add esp, 0x10
jmp 0x1053353
lea ecx, [ebp - 0x1044]
push ecx
push dword [ebp - 0x104c]
push eax
push 0x10195f0
call fcn.01071ac0
add esp, 0x10
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1064]
pop edi
pop esi
pop ebx
call fcn.0106bc50
leave
ret 8