Function at 0x10012c80
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [0x1009e0d0]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
push edi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x6c]
push eax
xor ebx, ebx
push 0x100018c0
push 0x80000001
mov dword [ebp - 0x60], 0x50
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x6c], ebx
call esi
cmp eax, ebx
jne 0x10012d04
mov edx, dword [ebp - 0x6c]
lea ecx, [ebp - 0x68]
push ecx
push 0x100018b4
push edx
call esi
cmp eax, ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
jne 0x10012cec
mov ecx, dword [ebp - 0x68]
lea eax, [ebp - 0x58]
push eax
push 0x100018ac
push ecx
call esi
jmp 0x10012d00
cmp eax, 2
jne 0x10012d00
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x58]
push edx
push 0x100018ac
push eax
call edi
test eax, eax
je 0x10012d0c
or ebx, 0xffffffff
jmp case.default.0x10012d18
mov eax, dword [ebp + 8]
cmp eax, 9
ja case.default.0x10012d18
jmp dword [eax*4 + 0x10013024]
cmp byte [ebp + 0xc], 0x72
jne 0x10012d41
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x5c]
push eax
push 0
push 0x10001a94
push ecx
jmp 0x10012fb6
mov eax, dword [ebp - 0x58]
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push 0
push 0x10001a94
push eax
jmp 0x10012fdc
cmp byte [ebp + 0xc], 0x72
jne 0x10012d7b
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x5c]
push eax
push 0
push 0x10001a78
push ecx
jmp 0x10012fb6
mov eax, dword [ebp - 0x58]
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push 0
push 0x10001a78
push eax
jmp 0x10012fdc
cmp byte [ebp + 0xc], 0x72
jne 0x10012dc6
lea ecx, [ebp - 0x60]
push ecx
mov ecx, dword [ebp - 0x58]
lea edx, [ebp - 0x54]
push edx
lea eax, [ebp - 0x5c]
push eax
push 0
push 0x10001a64
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.default.0x10012d18
mov ebx, dword [ebp - 0x54]
jmp case.default.0x10012d18
mov eax, dword [ebp - 0x58]
push 4
lea edx, [ebp + 0x10]
push edx
push 4
push 0
push 0x10001a64
push eax
jmp 0x10012fdc
mov edx, dword [ebp - 0x58]
lea ecx, [ebp - 0x64]
push ecx
push 0x10001a5c
push edx
call esi
cmp eax, 2
jne 0x10012e01
mov ecx, dword [ebp - 0x58]
lea eax, [ebp - 0x64]
push eax
push 0x10001a5c
push ecx
call edi
cmp byte [ebp + 0xc], 0x72
jne 0x10012e46
test eax, eax
jne case.default.0x10012d18
lea edx, [ebp - 0x60]
push edx
mov edx, dword [ebp - 0x64]
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x5c]
push ecx
push 0
push 0x10001a50
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.default.0x10012d18
cmp dword [ebp - 0x5c], 4
jne case.default.0x10012d18
mov ebx, dword [ebp - 0x54]
jmp case.default.0x10012d18
mov ecx, dword [ebp - 0x64]
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push 0x10001a50
push ecx
jmp 0x10012fdc
mov eax, dword [ebp - 0x58]
lea edx, [ebp - 0x64]
push edx
push 0x10001a5c
push eax
call esi
cmp eax, 2
jne 0x10012e81
mov edx, dword [ebp - 0x58]
lea ecx, [ebp - 0x64]
push ecx
push 0x10001a5c
push edx
call edi
cmp byte [ebp + 0xc], 0x72
jne 0x10012ec6
test eax, eax
jne case.default.0x10012d18
lea eax, [ebp - 0x60]
push eax
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0x10001a48
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne case.default.0x10012d18
cmp dword [ebp - 0x5c], 4
jne case.default.0x10012d18
mov ebx, dword [ebp - 0x54]
jmp case.default.0x10012d18
mov edx, dword [ebp - 0x64]
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push 0x10001a48
jmp 0x10012fdb
cmp byte [ebp + 0xc], 0x72
jne 0x10012efb
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0x10001a3c
jmp 0x10012fb2
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push 0x10001a3c
jmp 0x10012fd8
cmp byte [ebp + 0xc], 0x72
jne 0x10012f2d
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0x10001a24
jmp 0x10012fb2
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push 0x10001a24
jmp 0x10012fd8
cmp byte [ebp + 0xc], 0x72
jne 0x10012f5c
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0x10001a14
jmp 0x10012fb2
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push 0x10001a14
jmp 0x10012fd8
cmp byte [ebp + 0xc], 0x72
jne 0x10012f88
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0x10001a00
jmp 0x10012fb2
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push 0x10001a00
jmp 0x10012fd8
cmp byte [ebp + 0xc], 0x72
jne 0x10012fc9
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x54]
push ecx
lea edx, [ebp - 0x5c]
push edx
push 0
push 0x10001898
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10012d04
mov ebx, dword [ebp - 0x54]
jmp case.default.0x10012d18
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
push 0x10001898
mov edx, dword [ebp - 0x58]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x64]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10012ff2
push eax
call esi
mov eax, dword [ebp - 0x58]
test eax, eax
je 0x10012ffc
push eax
call esi
mov eax, dword [ebp - 0x68]
test eax, eax
je 0x10013006
push eax
call esi
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x10013010
push eax
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.10007179
mov esp, ebp
pop ebp
ret 0xc