Function at 0x1002ca90
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a123d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x854
push ebx
push esi
push edi
xor edi, edi
push 8
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call fcn.10079cc9
lea ecx, [ebp - 0x30]
add esp, 4
mov dword [eax + 4], edi
mov dword [ebp - 0x30], eax
mov dword [eax], ecx
mov dword [ebp - 4], 1
xor esi, esi
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + esi*2]
mov eax, dword [ebx + eax*8]
mov dword [ebp - 0x14], esi
cmp eax, reloc.OLEAUT32.dll_SysStringLen
je 0x1002cc13
cmp eax, 0x80000005
je 0x1002cc13
test ecx, ecx
je 0x1002cb5b
push ecx
call edx
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
test edx, edx
je 0x1002cb5b
mov eax, dword [ebp - 0x24]
dec eax
add edx, eax
mov eax, dword [ebp - 0x28]
mov ecx, edx
dec eax
shr ecx, 2
and edx, 3
and ecx, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + edx*4]
sub dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ecx
jne 0x1002cb51
mov dword [ebp - 0x24], 0
mov edx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ecx, ecx
jne 0x1002cb15
lea eax, [esi + esi*2]
xor edi, edi
mov edx, dword [ebx + eax*8]
mov dword [ebp - 0x34], edi
test edx, edx
je 0x1002d24f
mov edi, dword [ebp + 0x10]
lea eax, [esi + esi*2]
mov ebx, dword [ebx + eax*8 + 0x14]
test edi, edi
je 0x1002cbca
mov ecx, dword [ebp + 0xc]
lea eax, [esi + esi*2]
mov eax, dword [ecx + eax*8 + 4]
test bl, 1
je 0x1002cbac
push eax
push edx
call sym.dopuslib32.dll_recursiveDeleteKey
mov ecx, dword [ebp - 0x10]
add esp, 8
cmp eax, 5
je 0x1002cc0c
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x34], 1
jmp 0x1002cccf
lea ecx, [ebp - 0x10]
push ecx
push 0xf003f
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
jmp 0x1002cccf
test bl, 8
mov ebx, dword [ebp + 0xc]
je 0x1002cbde
mov dword [ebp - 0x34], 1
jmp 0x1002cccf
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esi + esi*2]
push dword [ebx + eax*8 + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, dword [ebp - 0x10]
test eax, eax
je 0x1002cccf
xor ebx, ebx
jmp 0x1002d254
test edi, edi
jne 0x1002d23f
cmp eax, 0x80000005
jne 0x1002cc62
test ecx, ecx
je 0x1002cc2e
push ecx
call edx
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x20]
test edx, edx
je 0x1002cc62
mov eax, dword [ebp - 0x24]
dec eax
add edx, eax
mov eax, dword [ebp - 0x28]
mov ecx, edx
dec eax
shr ecx, 2
and edx, 3
and ecx, eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + edx*4]
sub dword [ebp - 0x20], 1
mov dword [ebp - 0x10], ecx
jne 0x1002cc62
mov dword [ebp - 0x24], 0
mov edi, dword [ebp + 0x10]
lea eax, [esi + esi*2]
mov eax, dword [ebx + eax*8 + 4]
test eax, eax
je 0x1002cccf
mov dword [ebp - 0x18], 0
test edi, edi
je 0x1002cc98
test ecx, ecx
je 0x1002d23f
lea edx, [ebp - 0x18]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x1002ccbd
lea edx, [ebp - 0x40]
push edx
lea edx, [ebp - 0x18]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1002d248
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
call fcn.1002d300
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
test ecx, ecx
je 0x1002d23f
lea eax, [esi + esi*2]
mov edx, dword [ebx + eax*8 + 0xc]
test edx, edx
je 0x1002d23f
lea eax, [esi + esi*2]
test edi, edi
je 0x1002cd04
push dword [ebx + eax*8 + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x10]
inc esi
mov edi, dword [ebp - 0x34]
jmp 0x1002caec
lea eax, [esi + esi*2]
cmp edx, 4
jne 0x1002cd28
mov eax, dword [ebx + eax*8 + 0x10]
push edx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push edx
push 0
lea eax, [esi + esi*2]
push dword [ebx + eax*8 + 8]
push ecx
jmp 0x1002d232
cmp edx, 1
je 0x1002cd36
cmp edx, 2
jne 0x1002d23f
lea eax, [esi + esi*2]
mov eax, dword [ebx + eax*8 + 0x10]
mov dword [ebp - 0x18], eax
test eax, eax
je 0x1002d1fe
mov edi, str._MODULE_
mov ecx, eax
sub ecx, edi
mov esi, 8
mov dword [ebp - 0x1c], ecx
lea esp, [esp]
test esi, esi
js 0x1002cd6b
mov eax, esi
dec esi
test eax, eax
jle 0x1002cdad
movzx eax, word [edi + ecx]
push eax
call fcn.10086fcc
movzx ebx, ax
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
add esp, 8
cmp bx, ax
jne 0x1002cd99
test bx, bx
je 0x1002cdad
mov ecx, dword [ebp - 0x1c]
add edi, 2
jmp 0x1002cd60
test ax, ax
jne 0x1002cda3
cmp esi, 0xffffff9d
je 0x1002cdad
mov ecx, ebx
sub ecx, eax
jne 0x1002ce77
push 0x104
lea eax, [ebp - 0x450]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [ebp - 0x18]
add edi, 0x10
jne 0x1002cde1
mov esi, dword [ebp - 0x14]
lea ebx, [ebp - 0x450]
xor eax, eax
mov word [ebp - 0x450], ax
jmp 0x1002d208
mov ecx, 0x208
lea eax, [ebp - 0x450]
lea esp, [esp]
cmp word [eax], 0
je 0x1002cdfe
add eax, 2
sub ecx, 1
jne 0x1002cdf0
mov eax, 0x208
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x1002ce69
mov ecx, 0x208
lea eax, [ebp - 0x450]
lea eax, [eax + edx*2]
sub ecx, edx
je 0x1002ce61
mov edx, SysReAllocString
sub edi, eax
lea ebx, [ebx]
test edx, edx
je 0x1002ce64
movzx esi, word [eax + edi]
test si, si
je 0x1002ce5d
mov word [eax], si
dec edx
add eax, 2
sub ecx, 1
jne 0x1002ce30
mov esi, dword [ebp - 0x14]
lea ebx, [ebp - 0x450]
sub eax, 2
mov word [eax], cx
jmp 0x1002d208
test ecx, ecx
jne 0x1002ce64
sub eax, 2
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x14]
lea ebx, [ebp - 0x450]
jmp 0x1002d208
mov ecx, dword [ebp - 0x18]
mov edi, str._APPPATH_
sub ecx, edi
mov esi, 9
mov dword [ebp - 0x1c], ecx
lea esp, [esp]
test esi, esi
js 0x1002ce9b
mov eax, esi
dec esi
test eax, eax
jle 0x1002cedb
movzx eax, word [edi + ecx]
push eax
call fcn.10086fcc
movzx ebx, ax
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
add esp, 8
cmp bx, ax
jne 0x1002cec9
test bx, bx
je 0x1002cedb
mov ecx, dword [ebp - 0x1c]
add edi, 2
jmp 0x1002ce90
test ax, ax
jne 0x1002ced3
cmp esi, 0xffffff9d
je 0x1002cedb
mov ecx, eax
mov eax, ebx
sub eax, ecx
jne 0x1002cf11
push 0x104
lea eax, [ebp - 0x450]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, dword [ebp - 0x14]
lea ebx, [ebp - 0x450]
xor ecx, ecx
mov word [eax - 2], cx
jmp 0x1002d208
mov ecx, dword [ebp - 0x18]
mov edi, str._DOPUSRT_
sub ecx, edi
mov esi, 9
mov dword [ebp - 0x1c], ecx
test esi, esi
js 0x1002cf2e
mov eax, esi
dec esi
test eax, eax
jle 0x1002cf72
movzx eax, word [edi + ecx]
push eax
call fcn.10086fcc
movzx ebx, ax
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
add esp, 8
cmp bx, ax
jne 0x1002cf5c
test bx, bx
je 0x1002cf72
mov ecx, dword [ebp - 0x1c]
add edi, 2
jmp 0x1002cf23
test ax, ax
jne 0x1002cf66
cmp esi, 0xffffff9d
je 0x1002cf72
mov ecx, eax
mov eax, ebx
sub eax, ecx
jne 0x1002d0b8
push 0x104
lea eax, [ebp - 0x44e]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x44e]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
xor ecx, ecx
mov word [eax], cx
mov eax, 0x22
mov word [ebp - 0x450], ax
mov ecx, 0x208
lea eax, [ebp - 0x450]
cmp word [eax], 0
je 0x1002cfbe
add eax, 2
sub ecx, 1
jne 0x1002cfb0
mov eax, 0x208
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x1002d017
mov ecx, 0x208
lea eax, [ebp - 0x450]
lea eax, [eax + edx*2]
sub ecx, edx
je 0x1002d00f
mov edi, str.dopusrt.exe_
mov edx, SysReAllocString
sub edi, eax
nop
test edx, edx
je 0x1002d012
movzx esi, word [eax + edi]
test si, si
je 0x1002d00b
mov word [eax], si
dec edx
add eax, 2
sub ecx, 1
jne 0x1002cff0
jmp 0x1002d00f
test ecx, ecx
jne 0x1002d012
sub eax, 2
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x18]
add edi, 0x12
jne 0x1002d036
mov esi, dword [ebp - 0x14]
lea ebx, [ebp - 0x450]
xor eax, eax
mov word [ebp - 0x450], ax
jmp 0x1002d208
mov ecx, 0x208
lea eax, [ebp - 0x450]
cmp word [eax], 0
je 0x1002d04f
add eax, 2
sub ecx, 1
jne 0x1002d041
mov eax, 0x208
mov edx, ecx
sub eax, ecx
neg edx
sbb edx, edx
and edx, eax
test ecx, ecx
je 0x1002ce69
mov ecx, 0x208
lea eax, [ebp - 0x450]
lea eax, [eax + edx*2]
sub ecx, edx
je 0x1002ce61
mov edx, SysReAllocString
sub edi, eax
test edx, edx
je 0x1002ce64
movzx esi, word [eax + edi]
test si, si
je 0x1002ce5d
mov word [eax], si
dec edx
add eax, 2
sub ecx, 1
jne 0x1002d083
mov esi, dword [ebp - 0x14]
lea ebx, [ebp - 0x450]
sub eax, 2
mov word [eax], cx
jmp 0x1002d208
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
lea eax, [esi + esi*2]
test byte [ecx + eax*8 + 0x14], 4
je 0x1002d205
push 0x208
lea eax, [ebp - 0x658]
push 0
push eax
call fcn.1007cff0
mov ebx, dword [ebp - 0x18]
lea ecx, [ebp - 0x860]
mov eax, ecx
add esp, 0xc
mov edx, 0x104
sub ebx, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1002d11b
movzx eax, word [ecx + ebx]
test ax, ax
je 0x1002d114
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1002d0f4
jmp 0x1002d118
test edx, edx
jne 0x1002d11b
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0x860]
push eax
call sym.dopuslib32.dll_FindFilePartW
mov edi, eax
add esp, 4
test edi, edi
je 0x1002d178
lea ecx, [ebp - 0x658]
mov esi, edi
mov eax, ecx
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1002d16d
movzx eax, word [ecx + esi]
test ax, ax
je 0x1002d166
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1002d146
jmp 0x1002d16a
test edx, edx
jne 0x1002d16d
sub ecx, 2
mov esi, dword [ebp - 0x14]
xor eax, eax
mov word [ecx], ax
mov word [edi], ax
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x38]
push eax
push 0xf003f
push 0
lea eax, [ebp - 0x860]
push eax
lea eax, [esi + esi*2]
push dword [ecx + eax*8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002d1fe
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0x410
push eax
lea eax, [ebp - 0x450]
push eax
movzx eax, word [ebp - 0x658]
lea ecx, [ebp - 0x658]
neg eax
push 0
sbb eax, eax
push 0
and eax, ecx
push eax
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002d1fe
mov eax, dword [ebp - 0x14]
shr eax, 1
cmp eax, 0x208
jb 0x1002d1ec
mov dword [ebp - 0x14], 0x207
mov eax, 0x207
xor ecx, ecx
lea ebx, [ebp - 0x450]
mov word [ebp + eax*2 - 0x450], cx
jmp 0x1002d208
mov ebx, 0x100ab578
jmp 0x1002d208
mov ebx, dword [ebp - 0x18]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp + 0xc]
lea edx, [eax*2 + 2]
push edx
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [esi + esi*2]
mov ecx, dword [ecx + eax*8 + 0xc]
lea eax, [esi + esi*2]
push ecx
push 0
push dword [ebx + eax*8 + 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1002d248
mov ecx, dword [ebp - 0x10]
mov edi, dword [ebp - 0x34]
inc esi
jmp 0x1002caec
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
jmp 0x1002d254
mov ebx, 1
test ecx, ecx
je 0x1002d29d
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, edi
push ecx
call edi
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x1002d29d
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
dec edx
add edx, esi
dec eax
mov ecx, edx
and edx, 3
shr ecx, 2
and ecx, eax
mov eax, dword [ebp - 0x2c]
sub esi, 1
mov eax, dword [eax + ecx*4]
mov ecx, dword [eax + edx*4]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x20], esi
jne 0x1002d299
mov dword [ebp - 0x24], 0
test ecx, ecx
jne 0x1002d260
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.1002d390
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret