Function at 0x103cc65
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x103f058]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
push edi
lea ecx, [ebp - 0x62c]
mov dword [ebp - 0x60c], esi
call fcn.01031eac
xor edi, edi
inc edi
mov dword [ebp - 0x608], edi
cmp ebx, esi
jne 0x103ccbe
lea ecx, [ebp - 0x62c]
call fcn.01031ecd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0102df7d
leave
ret 0xc
cmp dword [ebp + 0x10], esi
je 0x103ccd3
lea eax, [ebp - 0x62c]
push eax
call fcn.0103802c
test eax, eax
je 0x103cca0
push ebx
push dword [0x103f06c]
lea eax, [ebp - 0x4c8]
push 0x100c3ac
push 0x103
push eax
call fcn.01027f64
add esp, 0x14
test eax, eax
jl 0x103cca0
lea eax, [ebp - 0x60c]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x4c8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x103cd29
lea ecx, [ebp - 0x62c]
call fcn.01031ecd
mov eax, esi
jmp 0x103ccad
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x10042dc
push dword [ebp - 0x60c]
mov dword [ebp - 0x5f8], esi
mov dword [ebp - 0x604], 0x208
mov dword [ebp - 0x600], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x103cf6e
cmp dword [ebp - 0x600], 1
jne 0x103cf6e
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01027e68
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103cdbf
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x130]
push eax
push dword [0x103f06c]
lea eax, [ebp - 0x2c0]
push 0x1006e4c
push 0xc7
push eax
call fcn.01027f64
add esp, 0x14
cmp dword [ebp + 0xc], esi
je 0x103ce77
test eax, eax
jl 0x103ce52
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x10416f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103ce36
push 8
push 0x1001e30
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103ce58
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.010396f5
test eax, eax
jne 0x103ce58
mov dword [ebp - 0x608], esi
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103cf6e
inc eax
inc eax
jmp 0x103cd8d
test eax, eax
jl 0x103ce52
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x10416f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x103cebf
push 6
push 0x100559c
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103ce58
lea eax, [ebp - 0x5f8]
push eax
push 0x20006
push esi
lea eax, [ebp - 0x2c0]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x103ce58
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x10042a0
push dword [ebp - 0x5f8]
mov dword [ebp - 0x604], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103cf29
cmp dword [ebp - 0x600], 1
je 0x103cf49
lea eax, [ebp - 0x130]
push eax
push 0x1006dec
lea eax, [ebp - 0x5f4]
push 0x95
push eax
call fcn.01027f64
add esp, 0x10
push 0x100648c
lea eax, [ebp - 0x5f4]
push eax
lea eax, [ebp - 0x130]
push eax
call fcn.010350d6
push dword [ebp - 0x5f8]
call edi
jmp 0x103ce58
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x1008d3c
push dword [ebp - 0x60c]
mov dword [ebp - 0x604], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d0ce
cmp dword [ebp - 0x600], 1
jne 0x103d0ce
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01027e68
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103cfec
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x130]
push eax
push dword [0x103f06c]
lea eax, [ebp - 0x2c0]
push 0x1008fa8
push 0xc7
push eax
call fcn.01027f64
add esp, 0x14
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x10416f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], esi
je 0x103d07f
test eax, eax
jne 0x103d05b
push 8
push 0x1001e30
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103d0b3
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.01039746
test eax, eax
jne 0x103d0b3
mov dword [ebp - 0x608], esi
jmp 0x103d0b3
test eax, eax
jne 0x103d0a2
push 6
push 0x100559c
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103d0b3
lea eax, [ebp - 0x130]
push eax
call fcn.0103cc2d
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103d0ce
inc eax
inc eax
jmp 0x103cfba
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x1008d28
push dword [ebp - 0x60c]
mov dword [ebp - 0x604], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d22e
cmp dword [ebp - 0x600], 1
jne 0x103d22e
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01027e68
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103d14c
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x130]
push eax
push dword [0x103f06c]
lea eax, [ebp - 0x2c0]
push 0x10068ac
push 0xc7
push eax
call fcn.01027f64
add esp, 0x14
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x10416f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], esi
je 0x103d1df
test eax, eax
jne 0x103d1bb
push 8
push 0x1001e30
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103d213
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.010397a3
test eax, eax
jne 0x103d213
mov dword [ebp - 0x608], esi
jmp 0x103d213
test eax, eax
jne 0x103d202
push 6
push 0x100559c
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103d213
lea eax, [ebp - 0x130]
push eax
call fcn.01032be7
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103d22e
inc eax
inc eax
jmp 0x103d11a
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x4c8]
push eax
lea eax, [ebp - 0x600]
push eax
push esi
push 0x1008d18
push dword [ebp - 0x60c]
mov dword [ebp - 0x604], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x103d38e
cmp dword [ebp - 0x600], 1
jne 0x103d38e
lea eax, [ebp - 0x4c8]
push eax
mov dword [ebp - 0x5fc], eax
push 0x95
lea eax, [ebp - 0x130]
push eax
call fcn.01027e68
lea eax, [ebp - 0x130]
push 0x20
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103d2ac
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x130]
push eax
push dword [0x103f06c]
lea eax, [ebp - 0x2c0]
push 0x1008fe8
push 0xc7
push eax
call fcn.01027f64
add esp, 0x14
push esi
lea eax, [ebp - 0x5f8]
push eax
push esi
push 2
push esi
push esi
push esi
lea eax, [ebp - 0x2c0]
push eax
push dword [0x10416f8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp dword [ebp + 0xc], esi
je 0x103d33f
test eax, eax
jne 0x103d31b
push 8
push 0x1001e30
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103d373
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x62c]
push eax
call fcn.01039825
test eax, eax
jne 0x103d373
mov dword [ebp - 0x608], esi
jmp 0x103d373
test eax, eax
jne 0x103d362
push 6
push 0x100559c
push 1
push esi
push 0x100669c
push dword [ebp - 0x5f8]
call ebx
push dword [ebp - 0x5f8]
call edi
cmp dword [ebp + 0x10], esi
je 0x103d373
lea eax, [ebp - 0x130]
push eax
call fcn.010317b8
push 0x20
push dword [ebp - 0x5fc]
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
cmp eax, esi
je 0x103d38e
inc eax
inc eax
jmp 0x103d27a
push dword [ebp - 0x60c]
call edi
mov esi, dword [ebp - 0x608]
jmp 0x103cd1a