Function at 0x1008de6
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x101803c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0x14]
xor ebx, ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x98], edi
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x48], ebx
call fcn.01005bd9
push eax
push 0x2001b
push ebx
push dword [ebp - 0x7c]
push edi
call fcn.01005c13
add esp, 0x14
cmp eax, ebx
je 0x1008e5c
cmp eax, 2
jne 0x1008e4d
mov bl, 1
lea ecx, [ebp - 0x48]
call fcn.01005bf7
mov al, bl
jmp 0x1009291
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x88]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x48]
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x60], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp eax, ebx
jne 0x1008e4d
cmp dword [ebp - 0x88], ebx
je 0x1008e4b
mov eax, dword [ebp - 0x8c]
cmp eax, ebx
jne 0x1008e9d
mov eax, 0x10017b0
push eax
push dword [esi + 4]
push dword [ebp - 0x7c]
push dword [ebp - 0x6c]
push 0x1002e14
call fcn.0100d383
inc dword [ebp - 0x60]
push dword [ebp - 0x60]
mov byte [ebp - 0x2d], bl
call fcn.0100d7aa
add esp, 0x18
mov dword [ebp - 0x58], eax
cmp eax, ebx
jne 0x1008ecd
mov byte [ebp - 0x2d], 1
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x38], ebx
xor esi, esi
mov dword [ebp - 0x70], ebx
jmp 0x100922b
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x58]
push dword [ebp - 0x70]
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 0x94], eax
cmp eax, ebx
jne 0x100924c
mov edi, dword [ebp - 0x48]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x34], ebx
call fcn.01005bd9
push eax
push 0x2001b
push ebx
push dword [ebp - 0x58]
push edi
call fcn.01005c13
add esp, 0x14
test eax, eax
jne 0x1009236
push ebx
push ebx
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x4c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov edi, eax
cmp edi, ebx
jne 0x1009236
cmp dword [ebp - 0x4c], ebx
jbe 0x10091a4
cmp esi, ebx
je 0x1008f72
push esi
call fcn.0100d79a
pop ecx
cmp dword [ebp - 0x38], ebx
je 0x1008f80
push dword [ebp - 0x38]
call fcn.0100d79a
pop ecx
inc dword [ebp - 0x5c]
push dword [ebp - 0x5c]
call fcn.0100d7aa
inc dword [ebp - 0x4c]
push dword [ebp - 0x4c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x78], eax
call fcn.0100d7aa
mov esi, eax
mov eax, dword [ebp - 0x4c]
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
cmp esi, ebx
je 0x1009236
cmp dword [ebp - 0x38], ebx
je 0x1009236
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x38]
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x74], ebx
push ebx
jmp 0x1009185
cmp dword [ebp - 0x74], 7
mov byte [ebp - 0x39], bl
mov dword [ebp - 0x64], ebx
jne 0x1009162
cmp esi, ebx
je 0x1009162
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x44], eax
cmp byte [ebp - 0x2d], bl
jne 0x100911f
cmp byte [esi], bl
je 0x100911f
inc dword [ebp - 0x64]
push 0x28
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.01007bf5
add esp, 0xc
test eax, eax
jne 0x100911b
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x8c]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
test eax, eax
jne 0x1009105
dec dword [ebp - 0x64]
mov byte [ebp - 0x39], 1
mov dword [ebp - 0x40], esi
call edi
or ecx, 0xffffffff
sub ecx, eax
add dword [ebp - 0x50], ecx
push esi
call edi
push esi
cmp byte [eax + esi + 1], bl
jne 0x100906d
call edi
lea esi, [esi + eax + 1]
mov eax, dword [ebp - 0x40]
mov byte [eax], bl
jmp 0x10090c4
call edi
push esi
lea edi, [eax + esi + 1]
mov dword [ebp - 0x54], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
or ecx, 0xffffffff
sub ecx, eax
add dword [ebp - 0x44], ecx
je 0x10090bd
cmp byte [edi], bl
je 0x10090bd
jmp 0x100909f
mov al, byte [edi]
cmp al, bl
je 0x10090a7
inc dword [ebp - 0x54]
mov ecx, dword [ebp - 0x40]
inc dword [ebp - 0x40]
mov byte [ecx], al
inc edi
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x44]
jb 0x100908d
mov al, byte [edi]
mov ecx, dword [ebp - 0x40]
inc dword [ebp - 0x40]
inc edi
inc dword [ebp - 0x54]
mov byte [ecx], al
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x44]
jb 0x1009087
mov al, byte [edi]
mov ecx, dword [ebp - 0x40]
mov byte [ecx], al
push dword [ebp - 0x50]
push dword [ebp - 0x6c]
push 7
push ebx
push dword [ebp - 0x38]
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x100911b
push dword [ebp - 0x58]
mov eax, dword [ebp - 0x80]
push dword [eax + 4]
push dword [ebp - 0x38]
push dword [eax + 8]
push 0x1002de8
call fcn.0100d383
add esp, 0x14
mov byte [0x101977a], 1
jmp 0x1009001
call edi
lea esi, [esi + eax + 1]
push esi
call edi
or ecx, 0xffffffff
sub ecx, eax
add dword [ebp - 0x44], ecx
jmp 0x1009001
mov byte [ebp - 0x2d], 1
mov esi, dword [ebp - 0x6c]
cmp byte [ebp - 0x39], bl
je 0x1009162
cmp dword [ebp - 0x64], ebx
jne 0x1009162
push dword [ebp - 0x38]
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x1009143
inc dword [ebp - 0x68]
mov byte [ebp - 0x2d], 1
push dword [ebp - 0x38]
mov eax, dword [ebp - 0x80]
push dword [eax + 8]
push 0x1002dd0
call fcn.0100d383
add esp, 0xc
mov byte [0x101977a], 1
jmp 0x1009165
inc dword [ebp - 0x68]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x50]
push eax
push esi
lea eax, [ebp - 0x74]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x38]
push dword [ebp - 0x68]
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
je 0x1008fd7
cmp edi, 0x103
jne 0x1009236
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x90]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
cmp edi, eax
je 0x1009236
cmp dword [ebp - 0x90], ebx
jne 0x1009217
push ebx
lea ecx, [ebp - 0x34]
call fcn.01005bb5
push dword [ebp - 0x58]
push dword [ebp - 0x48]
call fcn.01005c4a
pop ecx
pop ecx
test eax, eax
jne 0x1009240
cmp dword [ebp - 0x98], 0x80000002
mov eax, 0x1002c04
je 0x10091fa
mov eax, 0x1002dc8
push dword [ebp - 0x58]
push dword [ebp - 0x7c]
push eax
push 0x1002db0
call fcn.0100d383
add esp, 0x10
mov byte [0x101977a], 1
jmp 0x100921a
inc dword [ebp - 0x70]
mov eax, dword [ebp - 0x60]
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x84], eax
call fcn.01005bf7
cmp byte [ebp - 0x2d], bl
je 0x1008ee3
jmp 0x1009258
lea ecx, [ebp - 0x34]
call fcn.01005bf7
jmp 0x1009258
lea ecx, [ebp - 0x34]
mov byte [ebp - 0x2d], 1
call fcn.01005bf7
cmp dword [ebp - 0x94], 0x103
je 0x100925c
mov byte [ebp - 0x2d], 1
cmp dword [ebp - 0x38], ebx
je 0x100926a
push dword [ebp - 0x38]
call fcn.0100d79a
pop ecx
cmp esi, ebx
je 0x1009275
push esi
call fcn.0100d79a
pop ecx
cmp dword [ebp - 0x58], ebx
je 0x1009283
push dword [ebp - 0x58]
call fcn.0100d79a
pop ecx
lea ecx, [ebp - 0x48]
call fcn.01005bf7
cmp byte [ebp - 0x2d], bl
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d419
leave
ret