Function at 0x103c333
Capabilities:
Delete registry value
Get common file path
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x1046190]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x80c], ecx
mov ecx, dword [ebp + 0x14]
xor esi, esi
xor ebx, ebx
inc ebx
push eax
mov dword [ebp - 0x800], eax
mov dword [ebp - 0x7f8], ecx
mov dword [ebp - 0x7ec], esi
mov dword [ebp - 0x7f0], esi
mov dword [ebp - 0x804], esi
mov edi, ebx
call fcn.01039910
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
push dword [ebp - 0x800]
mov dword [ebp - 0x7f4], ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103c6d1
cmp dword [ebp - 0x808], esi
mov dword [ebp - 0x7f0], 0x190
je 0x103c417
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x100aa94
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103c417
cmp dword [ebp - 0x7f4], ebx
jne 0x103c417
lea eax, [ebp - 0x194]
push 0x100aa84
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov edi, eax
neg edi
pop ecx
sbb edi, edi
pop ecx
inc edi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103c484
cmp dword [ebp - 0x7f4], ebx
jne 0x103c484
lea eax, [ebp - 0x194]
push eax
call fcn.010387a2
test eax, eax
je 0x103c484
lea eax, [ebp - 0x7fc]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push dword [ebp + 0x10]
mov dword [ebp - 0x7fc], ebx
push eax
call fcn.0103b0e6
jmp 0x103c48a
mov dword [ebp - 0x7fc], esi
cmp edi, esi
je 0x103c49a
cmp dword [ebp - 0x7fc], esi
jne 0x103c55b
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
mov edi, 0x100a340
push edi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103c55b
cmp dword [ebp - 0x7f4], ebx
jne 0x103c55b
lea eax, [ebp - 0x194]
push eax
call fcn.010387a2
test eax, eax
je 0x103c55b
lea eax, [ebp - 0x808]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push dword [ebp + 0x10]
mov dword [ebp - 0x808], ebx
push eax
call fcn.0103b0e6
cmp dword [ebp - 0x808], esi
je 0x103c55b
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x103c51f
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x7fc], ebx
cmp dword [ebp - 0x80c], esi
lea eax, [ebp - 0x194]
je 0x103c57c
push dword [ebp - 0x80c]
push 0xc7
push eax
call fcn.01028a67
jmp 0x103c595
push dword [ebp - 0x800]
push 0x1007880
push 0xc7
push eax
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 0x7f8]
lea eax, [ebp - 0x194]
push dword [ebp + 0x10]
push eax
call fcn.0103b0e6
cmp dword [ebp - 0x7fc], esi
jne 0x103c5f9
cmp dword [ebp - 0x804], esi
je 0x103c5f9
lea eax, [ebp - 0x194]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x103c5ca
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x7fc], ebx
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7fc], esi
jne 0x103c6d1
lea eax, [ebp - 0x7ec]
push eax
push ebx
push esi
push dword [ebp - 0x800]
mov dword [ebp - 0x7f8], ebx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103c6c1
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x10044c8
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call edi
test eax, eax
jne 0x103c676
mov dword [ebp - 0x7f8], esi
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x194]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x100aa74
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f0], 0x190
call edi
test eax, eax
jne 0x103c6ad
mov dword [ebp - 0x7f8], esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7f8], esi
je 0x103c6d1
push dword [ebp - 0x800]
push 0x80000000
call fcn.01033666
push 0x103
lea eax, [ebp - 0x7e8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x103c8d2
push 0x100aa5c
mov edi, 0x104
push edi
lea eax, [ebp - 0x7e8]
push eax
call fcn.01028adc
lea eax, [ebp - 0x7e8]
push eax
push edi
lea eax, [ebp - 0x39c]
push eax
push dword [0x104601c]
push 0x1008ec8
push 0x100aa50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x103c762
lea eax, [ebp - 0x39c]
push eax
push dword [0x104601c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103c762
lea eax, [ebp - 0x39c]
push 0x100aa34
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x7f8], esi
je 0x103c768
mov dword [ebp - 0x7f8], ebx
lea eax, [ebp - 0x7e8]
push eax
push edi
lea eax, [ebp - 0x39c]
push eax
push dword [0x104601c]
push 0x1003ff0
push 0x100aa50
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x103c7c8
lea eax, [ebp - 0x39c]
push eax
push dword [0x104601c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103c7c8
lea eax, [ebp - 0x39c]
push 0x100aa34
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x7fc], esi
je 0x103c7ce
mov dword [ebp - 0x7fc], ebx
cmp dword [ebp - 0x7f8], esi
jne 0x103c7e2
cmp dword [ebp - 0x7fc], esi
je 0x103c8d2
mov eax, dword [ebp - 0x800]
add eax, 2
push eax
push 0x103
lea eax, [ebp - 0x39c]
push eax
call fcn.01028a67
mov edi, dword [sym.imp.KERNEL32.dll_GetProfileStringW]
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x104601c]
lea eax, [ebp - 0x39c]
push eax
push 0x100aa0c
call edi
test eax, eax
je 0x103c8d2
lea eax, [ebp - 0x5e0]
push eax
push dword [0x104601c]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103c8d2
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x100aa0c
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push 0x122
lea eax, [ebp - 0x5e0]
push eax
push dword [0x104601c]
lea eax, [ebp - 0x39c]
push eax
push 0x100a9ec
call edi
test eax, eax
je 0x103c8d2
cmp dword [ebp - 0x7f8], esi
je 0x103c89f
lea eax, [ebp - 0x5e0]
push eax
push 0x1008ec8
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x103c8bf
cmp dword [ebp - 0x7fc], esi
je 0x103c8d2
lea eax, [ebp - 0x5e0]
push eax
push 0x1003ff0
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103c8d2
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x100a9ec
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
push dword [ebp - 0x800]
lea eax, [ebp - 0x39c]
push 0x100a968
push 0x103
push eax
mov dword [ebp - 0x804], ebx
call fcn.01028b64
add esp, 0x10
lea eax, [ebp - 0x7ec]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x39c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103caaa
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push 0x100a7f0
push dword [ebp - 0x7ec]
mov edi, 0x244
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103ca74
cmp dword [ebp - 0x7f4], ebx
jne 0x103ca74
lea eax, [ebp - 0x5e0]
push 0x10024b0
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103ca74
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
push esi
push esi
push dword [ebp - 0x7ec]
mov dword [ebp - 0x7f4], ebx
mov dword [ebp - 0x7f0], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103ca74
cmp dword [ebp - 0x7f4], ebx
jne 0x103ca74
lea eax, [ebp - 0x5e0]
push eax
call fcn.010387a2
test eax, eax
je 0x103ca74
lea eax, [ebp - 0x5e0]
push 0x100a910
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x103ca74
lea eax, [ebp - 0x7f0]
push eax
lea eax, [ebp - 0x5e0]
push eax
lea eax, [ebp - 0x7f4]
push eax
mov dword [ebp - 0x7f0], edi
push esi
mov edi, 0x100a340
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103ca6e
cmp dword [ebp - 0x7f4], ebx
jne 0x103ca6e
lea eax, [ebp - 0x5e0]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x103ca36
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x5e0]
push eax
push ebx
push esi
push esi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x103ca74
mov dword [ebp - 0x804], esi
push 0x100a7f0
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7ec]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x804], esi
jne 0x103caaa
lea eax, [ebp - 0x39c]
push eax
push 0x80000002
call fcn.01033666
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01031a01
leave
ret 0x10