Function at 0x100c3220
Capabilities:
Query or enumerate registry value
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1018f7ba
mov eax, dword fs:[0]
push eax
mov eax, 0x1a48
call fcn.1014e870
mov eax, dword [0x101d8724]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x190c], 0
mov byte [ebp - 0x415], 1
push 0
mov ecx, 0x101dafb0
call fcn.1007df30
push 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.1008f170
add esp, 8
mov dword [ebp - 0x208], eax
mov byte [ebp - 0x62d], 0
mov dword [ebp - 0x62c], 0xffffffff
mov dword [ebp - 0x628], 0xffffffff
push str._meta_size
mov ecx, dword [ebp - 0x208]
push ecx
call fcn.1014f9da
add esp, 8
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
je 0x100c33cd
mov dword [ebp - 0x63c], 0
mov dword [ebp - 0x638], 0
mov edx, dword [ebp - 0x634]
add edx, 0x16
mov dword [ebp - 0x634], edx
mov eax, dword [ebp - 0x634]
movzx ecx, word [eax]
cmp ecx, 0x22
jne 0x100c3302
mov edx, dword [ebp - 0x634]
add edx, 2
mov dword [ebp - 0x634], edx
mov eax, dword [ebp - 0x634]
movzx ecx, word [eax]
cmp ecx, 0x30
jl 0x100c334b
mov edx, dword [ebp - 0x634]
movzx eax, word [edx]
cmp eax, 0x39
jg 0x100c334b
mov ecx, dword [ebp - 0x63c]
imul ecx, ecx, 0xa
mov edx, dword [ebp - 0x634]
movzx eax, word [edx]
lea ecx, [ecx + eax - 0x30]
mov dword [ebp - 0x63c], ecx
mov edx, dword [ebp - 0x634]
add edx, 2
mov dword [ebp - 0x634], edx
jmp 0x100c3302
mov eax, dword [ebp - 0x634]
add eax, 2
mov dword [ebp - 0x634], eax
mov ecx, dword [ebp - 0x634]
movzx edx, word [ecx]
cmp edx, 0x30
jl 0x100c33a3
mov eax, dword [ebp - 0x634]
movzx ecx, word [eax]
cmp ecx, 0x39
jg 0x100c33a3
mov edx, dword [ebp - 0x638]
imul edx, edx, 0xa
mov eax, dword [ebp - 0x634]
movzx ecx, word [eax]
lea edx, [edx + ecx - 0x30]
mov dword [ebp - 0x638], edx
mov eax, dword [ebp - 0x634]
add eax, 2
mov dword [ebp - 0x634], eax
jmp 0x100c335a
cmp dword [ebp - 0x63c], 0
je 0x100c33cd
cmp dword [ebp - 0x638], 0
je 0x100c33cd
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x62c], ecx
mov edx, dword [ebp - 0x638]
mov dword [ebp - 0x628], edx
push str._meta_noclose_
mov eax, dword [ebp - 0x208]
push eax
call fcn.1014f9da
add esp, 8
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
je 0x100c33f7
mov byte [ebp - 0x62d], 1
mov cx, word [0x101a0fe4]
mov word [ebp - 0x624], cx
push 0x206
push 0
lea edx, [ebp - 0x622]
push edx
call fcn.1014e270
add esp, 0xc
mov ax, word [0x101a0fe4]
mov word [ebp - 0x414], ax
push 0x206
push 0
lea ecx, [ebp - 0x412]
push ecx
call fcn.1014e270
add esp, 0xc
lea edx, [ebp - 0x2c]
push edx
call fcn.100e2850
add esp, 4
mov dword [ebp - 0x1a44], eax
mov eax, dword [ebp - 0x1a44]
mov dword [ebp - 0x1860], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1860]
cmp dword [ecx + 0x14], 8
jb 0x100c347f
mov edx, dword [ebp - 0x1860]
mov eax, dword [edx]
mov dword [ebp - 0x1a48], eax
jmp 0x100c348b
mov ecx, dword [ebp - 0x1860]
mov dword [ebp - 0x1a48], ecx
mov edx, dword [ebp - 0x1a48]
push edx
lea eax, [ebp - 0x624]
push eax
call fcn.1014eafb
add esp, 8
mov dword [ebp - 4], 1
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10085cf0
mov dword [ebp - 4], 0xffffffff
push 0x101a3d78
lea ecx, [ebp - 0x8c]
call fcn.100e1330
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x624]
push ecx
lea ecx, [ebp - 0xec]
call fcn.100e1330
mov byte [ebp - 4], 3
push 0
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0xec]
push eax
lea ecx, [ebp - 0x108]
push ecx
call fcn.100e2ac0
add esp, 0x10
mov dword [ebp - 0x1a4c], eax
mov edx, dword [ebp - 0x1a4c]
mov dword [ebp - 0x1864], edx
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x1864]
cmp dword [eax + 0x14], 8
jb 0x100c3539
mov ecx, dword [ebp - 0x1864]
mov edx, dword [ecx]
mov dword [ebp - 0x1a50], edx
jmp 0x100c3545
mov eax, dword [ebp - 0x1864]
mov dword [ebp - 0x1a50], eax
mov ecx, dword [ebp - 0x1a50]
push ecx
lea edx, [ebp - 0x414]
push edx
call fcn.1014eafb
add esp, 8
mov byte [ebp - 4], 5
push 0
push 1
lea ecx, [ebp - 0x108]
call fcn.10085cf0
mov byte [ebp - 4], 3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xec]
call fcn.10063f10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8c]
call fcn.10063f10
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x16c]
call fcn.100e1330
mov dword [ebp - 4], 6
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x16c]
push ecx
call fcn.100e2cc0
add esp, 0x1c
mov dword [ebp - 0x20c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x16c]
call fcn.10063f10
cmp dword [ebp - 0x20c], 0xffffffff
je 0x100c36ad
mov dword [ebp - 0x6a0], 0
mov edx, dword [ebp - 0x208]
push edx
lea ecx, [ebp - 0x69c]
call fcn.100e1330
mov dword [ebp - 4], 7
lea eax, [ebp - 0x188]
push eax
lea ecx, [ebp - 0x69c]
call fcn.100e14c0
mov dword [ebp - 0x1a54], eax
mov ecx, dword [ebp - 0x1a54]
mov dword [ebp - 0x18b0], ecx
mov byte [ebp - 4], 8
mov edx, dword [ebp - 0x18b0]
mov eax, dword [edx + 0x10]
mov dword [ebp - 0x18b4], eax
push 0
lea ecx, [ebp - 0x6a0]
push ecx
mov edx, dword [ebp - 0x18b4]
push edx
lea ecx, [ebp - 0x69c]
call fcn.100e1c10
push eax
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov byte [ebp - 4], 9
push 0
push 1
lea ecx, [ebp - 0x188]
call fcn.10042350
mov byte [ebp - 4], 7
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x69c]
call fcn.10063f10
jmp 0x100c36b4
mov byte [ebp - 0x415], 0
movzx edx, byte [ebp - 0x415]
cmp edx, 1
jne 0x100c3dc8
mov byte [ebp - 0x6a1], 1
push str.file:__
lea eax, [ebp - 0x624]
push eax
call fcn.1014eafb
add esp, 8
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x624]
push edx
call fcn.1014eaca
add esp, 8
movzx eax, byte [ebp - 0x415]
cmp eax, 1
jne 0x100c3dc8
movzx ecx, byte [ebp + 0x1c]
test ecx, ecx
setne dl
movzx eax, dl
push eax
movzx ecx, byte [ebp - 0x6a1]
push ecx
movzx edx, byte [ebp - 0x62d]
push edx
mov eax, dword [ebp - 0x628]
push eax
mov ecx, dword [ebp - 0x62c]
push ecx
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x624]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1013dca0
add esp, 0x28
mov byte [ebp - 0x6a2], al
movzx ecx, byte [ebp - 0x6a2]
test ecx, ecx
jne 0x100c376c
mov byte [ebp - 0x415], 0
jmp 0x100c3dc1
push str.close:websitenoreopen
mov edx, dword [ebp + 0x14]
push edx
call fcn.1015d9f0
add esp, 8
test eax, eax
jne 0x100c37ca
mov eax, dword [0x101dd540]
mov dword [ebp - 0x18d8], eax
mov ecx, dword [ebp - 0x18d8]
call fcn.10073c00
test eax, eax
je 0x100c37c5
push 0
movsx ecx, byte [0x101e9070]
neg ecx
sbb ecx, ecx
and ecx, 0x101e9070
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [0x101dd540]
call fcn.100791f0
mov byte [ebp - 0x6a1], 0
jmp 0x100c3dc1
push str.close:website
mov eax, dword [ebp + 0x14]
push eax
call fcn.1015d9f0
add esp, 8
test eax, eax
je 0x100c37f8
push str.close:buynow
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.1015d9f0
add esp, 8
test eax, eax
jne 0x100c38d4
mov ecx, 0x101db658
call fcn.10072740
and eax, 1
je 0x100c3885
mov edx, dword [0x101dd540]
mov dword [ebp - 0x18dc], edx
mov eax, dword [ebp - 0x18dc]
mov cl, byte [eax + 0x58c]
mov byte [ebp - 0x18dd], cl
movzx edx, byte [ebp - 0x18dd]
test edx, edx
jne 0x100c3885
push 0
push 0
movsx eax, byte [0x101e9070]
neg eax
sbb eax, eax
and eax, 0x101e9070
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.100c2c20
add esp, 0x14
mov byte [ebp - 0x6a3], al
movzx edx, byte [ebp - 0x6a3]
test edx, edx
je 0x100c3866
jmp 0x100c3883
call fcn.100c2450
cmp eax, 0x4c7
jne 0x100c3883
push str.close:close
mov eax, dword [ebp + 0x14]
push eax
call fcn.1014e930
add esp, 8
jmp 0x100c38cf
mov ecx, dword [0x101dd540]
mov dword [ebp - 0x18e4], ecx
mov ecx, dword [ebp - 0x18e4]
call fcn.10073c00
test eax, eax
je 0x100c38ca
push 0
movsx edx, byte [0x101e9070]
neg edx
sbb edx, edx
and edx, 0x101e9070
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [0x101dd540]
call fcn.100791f0
mov byte [ebp - 0x6a1], 0
jmp 0x100c36f5
jmp 0x100c3dc1
push str.close:customerservice
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.1015d9f0
add esp, 8
test eax, eax
jne 0x100c392d
push 0
push 0
push 0
push 1
mov edx, dword [ebp + 8]
push edx
call fcn.100c2c20
add esp, 0x14
movzx eax, al
test eax, eax
jne 0x100c3928
call fcn.100c2450
cmp eax, 0x4c7
jne 0x100c3923
push str.close:close
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.1014e930
add esp, 8
jmp 0x100c3928
jmp 0x100c36f5
jmp 0x100c3dc1
push 0xd
push 0x101a3d1c
mov edx, dword [ebp + 0x14]
push edx
call fcn.10151048
add esp, 0xc
test eax, eax
jne 0x100c3b62
mov al, byte [0x101a0fc1]
mov byte [ebp - 0x10b4], al
push 0xff
push 0
lea ecx, [ebp - 0x10b3]
push ecx
call fcn.1014e270
add esp, 0xc
mov dl, byte [0x101a0fc1]
mov byte [ebp - 0x7ac], dl
push 0xff
push 0
lea eax, [ebp - 0x7ab]
push eax
call fcn.1014e270
add esp, 0xc
mov cl, byte [0x101a0fc1]
mov byte [ebp - 0x11b4], cl
push 0xff
push 0
lea edx, [ebp - 0x11b3]
push edx
call fcn.1014e270
add esp, 0xc
mov ecx, 0x101dafb0
call fcn.1007dda0
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x10b4]
push eax
push 0x101a0fc1
push str.vendor
push str.LICENSE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, 0x101dafb0
call fcn.1007dda0
push eax
push pe_nt_image_headers32
lea ecx, [ebp - 0x7ac]
push ecx
push 0x101a0fc1
push 0x101a3d10
push str.LICENSE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, 0x101dafb0
call fcn.1007dda0
push eax
push pe_nt_image_headers32
lea edx, [ebp - 0x11b4]
push edx
push 0x101a0fc1
push str.version
push str.LICENSE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x11b4]
push eax
lea ecx, [ebp - 0x7ac]
push ecx
lea edx, [ebp - 0x10b4]
push edx
push str.SoftwareDigital_RiverSoftwarePassport_s_s_s
lea eax, [ebp - 0xbb4]
push eax
call fcn.1014ea28
add esp, 0x14
mov dword [ebp - 0x11b8], 0x400
push 0x400
push 0
lea ecx, [ebp - 0xfb4]
push ecx
call fcn.1014e270
add esp, 0xc
lea edx, [ebp - 0x7b0]
push edx
lea eax, [ebp - 0x6a8]
push eax
push 0
push 0x20019
push 0
push 0
push 0
lea ecx, [ebp - 0xbb4]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea edx, [ebp - 0x11b8]
push edx
lea eax, [ebp - 0xfb4]
push eax
push 0
push 0
push str.BuyURL
mov ecx, dword [ebp - 0x6a8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp - 0xfb4]
push edx
call fcn.1014e8a0
add esp, 4
test eax, eax
jne 0x100c3b1d
movzx eax, byte [ebp - 0x6a1]
push eax
movzx ecx, byte [ebp - 0x62d]
push ecx
push 0x258
push 0x320
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, 0x101dafb0
call fcn.10080280
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.1013e4c0
add esp, 0x24
jmp 0x100c3b56
movzx eax, byte [ebp - 0x6a1]
push eax
movzx ecx, byte [ebp - 0x62d]
push ecx
push 0x258
push 0x320
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0xfb4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.1013e4c0
add esp, 0x24
mov byte [ebp - 0x415], 1
jmp 0x100c3dc1
push 0x10
push str.close:reissuekey
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.10151048
add esp, 0xc
test eax, eax
jne 0x100c3dc1
movzx edx, byte [ebp + 0x1c]
test edx, edx
jne 0x100c3b91
mov byte [ebp - 0x415], 0
jmp 0x100c3dc1
mov al, byte [0x101a0fc1]
mov byte [ebp - 0x12bc], al
push 0xff
push 0
lea ecx, [ebp - 0x12bb]
push ecx
call fcn.1014e270
add esp, 0xc
mov dl, byte [0x101a0fc1]
mov byte [ebp - 0x17bc], dl
push 0xff
push 0
lea eax, [ebp - 0x17bb]
push eax
call fcn.1014e270
add esp, 0xc
mov cl, byte [0x101a0fc1]
mov byte [ebp - 0x16bc], cl
push 0x3ff
push 0
lea edx, [ebp - 0x16bb]
push edx
call fcn.1014e270
add esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
lea ecx, [ebp - 0x1a4]
call fcn.10083da0
mov dword [ebp - 4], 0xa
push 1
push 1
lea ecx, [ebp - 0x1a4]
push ecx
lea ecx, [ebp - 0x185c]
call fcn.100d9430
mov byte [ebp - 4], 0xd
push 0
push 1
lea ecx, [ebp - 0x1a4]
call fcn.10042350
mov byte [ebp - 4], 0xc
push 0xa
mov edx, dword [ebp - 0x185c]
mov eax, dword [edx + 4]
lea ecx, [ebp + eax - 0x185c]
call fcn.10086d50
movzx ecx, al
push ecx
push 0
push 0x14
lea edx, [ebp - 0x16bc]
push edx
lea ecx, [ebp - 0x185c]
call fcn.100dad20
push 0xa
mov eax, dword [ebp - 0x185c]
mov ecx, dword [eax + 4]
lea ecx, [ebp + ecx - 0x185c]
call fcn.10086d50
movzx edx, al
push edx
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x12bc]
push eax
lea ecx, [ebp - 0x185c]
call fcn.100dad20
push 0xa
mov ecx, dword [ebp - 0x185c]
mov edx, dword [ecx + 4]
lea ecx, [ebp + edx - 0x185c]
call fcn.10086d50
movzx eax, al
push eax
push 0
push pe_nt_image_headers32
lea ecx, [ebp - 0x17bc]
push ecx
lea ecx, [ebp - 0x185c]
call fcn.100dad20
lea edx, [ebp - 0x17bc]
push edx
lea eax, [ebp - 0x12bc]
push eax
push 0
push 2
mov ecx, dword [ebp + 8]
push ecx
call fcn.100c2c20
add esp, 0x14
movzx edx, al
test edx, edx
jne 0x100c3d6e
call fcn.100c2450
cmp eax, 0x4c7
jne 0x100c3d16
push str.close:close
mov eax, dword [ebp + 0x14]
push eax
call fcn.1014e930
add esp, 8
jmp 0x100c3d6e
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1804]
call fcn.100d9570
lea ecx, [ebp - 0x1804]
mov dword [ebp - 0x19e8], ecx
mov edx, dword [ebp - 0x19e8]
mov dword [edx], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0xe
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x19e8]
mov dword [eax], vtable.std::ios_base.0
mov ecx, dword [ebp - 0x19e8]
push ecx
call fcn.10147dd5
add esp, 4
jmp 0x100c36f5
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1804]
call fcn.100d9570
lea edx, [ebp - 0x1804]
mov dword [ebp - 0x1a00], edx
mov eax, dword [ebp - 0x1a00]
mov dword [eax], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], 0xf
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x1a00]
mov dword [ecx], vtable.std::ios_base.0
mov edx, dword [ebp - 0x1a00]
push edx
call fcn.10147dd5
add esp, 4
jmp 0x100c3dc8
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x204]
call fcn.100e1330
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 0x204]
push ecx
call fcn.100e2dd0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x204]
call fcn.10063f10
mov al, byte [ebp - 0x415]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1014c68a
mov esp, ebp
pop ebp
ret