Function at 0x10085cd
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x3ac
mov eax, dword [0x101803c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x3a8], eax
cmp eax, edi
jne 0x10085fc
mov eax, 0x10017b0
push eax
push 0x1002c10
call fcn.0100d383
lea eax, [ebp - 0x361]
push eax
lea eax, [ebp - 0x368]
push eax
movzx eax, byte [0x1019779]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push esi
push 0x1002c04
mov ebx, 0x80000002
push ebx
mov dword [ebp - 0x39c], edi
mov dword [ebp - 0x370], edi
mov dword [ebp - 0x384], edi
mov dword [ebp - 0x368], edi
mov byte [ebp - 0x362], 0
call fcn.010069c4
add esp, 0x20
test al, al
jne 0x100869b
mov bl, byte [ebp - 0x361]
lea ecx, [ebp - 0x368]
call fcn.01005bf7
lea ecx, [ebp - 0x384]
call fcn.01005bf7
lea ecx, [ebp - 0x370]
call fcn.01005bf7
lea ecx, [ebp - 0x39c]
call fcn.01005bf7
mov al, bl
jmp 0x1008ad4
cmp byte [0x1019779], 0
push 0xd
pop ecx
mov esi, 0x1002bcc
lea edi, [ebp - 0x64]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x361]
push eax
lea eax, [ebp - 0x370]
push eax
movsb byte es:[edi], byte [esi]
lea eax, [ebp - 0x64]
je 0x1008713
push 0xf013f
push eax
push 0x1002c04
push ebx
call fcn.010069c4
mov byte [ebp - 0x363], al
lea eax, [ebp - 0x361]
push eax
lea eax, [ebp - 0x384]
push eax
push 0xf023f
lea eax, [ebp - 0x64]
push eax
push 0x1002bc4
push ebx
call fcn.010069c4
add esp, 0x30
cmp byte [ebp - 0x363], 0
jne 0x100872f
test al, al
jne 0x100872f
xor bl, bl
jmp 0x1008668
push 0xf003f
push eax
push 0x1002c04
push ebx
call fcn.010069c4
add esp, 0x18
test al, al
je 0x1008662
xor esi, esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x360]
mov ebx, 0x105
push eax
mov dword [ebp - 0x374], ebx
mov dword [ebp - 0x378], 0x28
mov dword [ebp - 0x37c], esi
mov dword [ebp - 0x38c], esi
push esi
jmp 0x1008a75
mov edi, dword [ebp - 0x368]
call fcn.01005bd9
push eax
push 0x20019
push esi
lea eax, [ebp - 0x360]
push eax
push edi
call fcn.01005c13
add esp, 0x14
cmp eax, esi
jne 0x1008a3b
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x3a4]
push eax
push esi
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x398], esi
push esi
jmp 0x1008a01
inc dword [ebp - 0x398]
cmp dword [ebp - 0x3a8], esi
je 0x10087e7
push dword [ebp - 0x3a8]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x10089da
cmp byte [ebp - 0x16c], 0
je 0x10089da
cmp byte [ebp - 0x16b], 0x3f
jne 0x10089da
cmp byte [0x1019779], 0
mov byte [ebp - 0x16b], 0x3a
mov dword [ebp - 0x390], esi
je 0x100886b
lea eax, [ebp - 0x3ac]
push eax
lea eax, [ebp - 0x16c]
push eax
call fcn.01005d00
pop ecx
pop ecx
mov dword [ebp - 0x390], eax
cmp eax, 1
jne 0x1008850
cmp dword [ebp - 0x3ac], esi
jne 0x1008850
push esi
lea eax, [ebp - 0x16c]
push ebx
push eax
call fcn.010077e3
add esp, 0xc
cmp byte [0x1019779], 0
je 0x100886b
mov dword [ebp - 0x388], 2
cmp dword [ebp - 0x390], esi
je 0x1008875
mov dword [ebp - 0x388], 1
cmp dword [ebp - 0x388], esi
mov dword [ebp - 0x380], esi
jle 0x10089da
cmp byte [0x1019779], 0
je 0x10088a9
cmp dword [ebp - 0x380], esi
je 0x10088a1
cmp dword [ebp - 0x390], 1
jne 0x10088a9
mov edi, dword [ebp - 0x384]
jmp 0x10088af
mov edi, dword [ebp - 0x370]
cmp edi, esi
je 0x10089c2
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x3a4]
push eax
push esi
lea eax, [ebp - 0x16c]
push eax
push edi
mov dword [ebp - 0x3a0], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
jne 0x100899e
cmp dword [ebp - 0x36c], 1
jne 0x1008941
lea eax, [ebp - 0x16c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x1008927
lea eax, [ebp - 0x16c]
push eax
push 0x1002ba0
mov byte [0x101977a], 1
call fcn.0100d383
pop ecx
pop ecx
jmp 0x10089c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16c]
push eax
push 0x1002b58
call fcn.0100d383
jmp 0x10089bf
push dword [ebp - 0x3a0]
dec dword [ebp - 0x36c]
lea eax, [ebp - 0x36c]
push eax
push 4
push esi
lea eax, [ebp - 0x16c]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1008989
lea eax, [ebp - 0x16c]
push eax
push dword [ebp - 0x36c]
push 0x1002b2c
call fcn.0100d383
mov byte [0x101977a], 1
jmp 0x10089bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x16c]
push eax
push 0x1002ae0
jmp 0x100893a
cmp eax, 2
je 0x10089c2
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x1002aa0
call fcn.0100d383
mov byte [ebp - 0x362], 1
add esp, 0xc
inc dword [ebp - 0x380]
mov eax, dword [ebp - 0x380]
cmp eax, dword [ebp - 0x388]
jl 0x1008887
lea eax, [ebp - 0x374]
push eax
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x3a4]
push eax
push esi
lea eax, [ebp - 0x378]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x398]
push dword [ebp - 0x37c]
mov dword [ebp - 0x378], 0x28
mov dword [ebp - 0x374], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, esi
je 0x10087c1
cmp eax, 0x103
je 0x1008a57
push eax
lea eax, [ebp - 0x360]
push eax
push 0x1002a64
jmp 0x1008a48
push eax
lea eax, [ebp - 0x360]
push eax
push 0x1002a30
call fcn.0100d383
mov byte [ebp - 0x362], 1
add esp, 0xc
inc dword [ebp - 0x38c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x394]
push eax
lea eax, [ebp - 0x360]
push eax
push dword [ebp - 0x38c]
push dword [ebp - 0x368]
mov dword [ebp - 0x394], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [ebp - 0x37c]
test eax, eax
je 0x100876a
call fcn.01005bf7
lea ecx, [ebp - 0x368]
call fcn.01005bf7
lea ecx, [ebp - 0x384]
call fcn.01005bf7
lea ecx, [ebp - 0x370]
call fcn.01005bf7
lea ecx, [ebp - 0x39c]
call fcn.01005bf7
cmp byte [ebp - 0x362], 0
sete al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0100d419
leave
ret