Function at 0x106ac99
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x534
mov eax, dword [0x1099a38]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push edi
push 0x1023330
mov dword [ebp - 4], eax
mov dword [ebp - 0x524], edi
mov dword [ebp - 0x52c], esi
mov dword [ebp - 0x51c], esi
mov dword [ebp - 0x520], esi
mov dword [ebp - 0x528], esi
call fcn.01071ac0
pop ecx
pop ecx
mov ebx, 0x104
push ebx
lea eax, [ebp - 0x518]
push eax
push edi
push 0x100af40
call fcn.01070fc9
lea eax, [ebp - 0x520]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x518]
push eax
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, esi
jne 0x106ad49
lea eax, [ebp - 0x530]
push eax
lea eax, [ebp - 0x51c]
push eax
push esi
push esi
push 0x1023320
push dword [ebp - 0x520]
mov dword [ebp - 0x530], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, esi
je 0x106ad6d
cmp eax, 2
je 0x106ad6d
cmp eax, 3
je 0x106ad6d
push eax
lea eax, [ebp - 0x518]
push eax
push 0x10232fc
call fcn.01071ac0
add esp, 0xc
jmp 0x106b149
push ebx
lea eax, [ebp - 0x108]
push eax
push 0x100c934
push 0x10f54c0
call fcn.01070fc9
mov eax, edi
mov esi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106ad88
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x106ad98
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x106adb5
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x100c934
mov esi, 0x10232f8
push 0x10f54c0
movsw word es:[edi], word [esi]
call fcn.01070fc9
mov eax, dword [ebp - 0x524]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106ade3
lea edi, [ebp - 0x20c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x106adf3
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x20c]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x106ae10
mov esi, 0x10232f4
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x20c]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106ae29
mov cl, byte [ebp - 0x51c]
sub eax, esi
add cl, 0x30
lea edi, [ebp - 0x20c]
mov byte [ebp + eax - 0x20d], cl
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x106ae49
push ebx
lea eax, [ebp - 0x310]
push eax
push 0x100c934
mov esi, 0x10232f8
push 0x10f54c0
movsw word es:[edi], word [esi]
call fcn.01070fc9
mov eax, dword [ebp - 0x524]
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106ae77
lea edi, [ebp - 0x310]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x106ae87
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x310]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x106aea4
mov esi, 0x10232f4
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x310]
movsb byte es:[edi], byte [esi]
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106aebd
sub eax, esi
lea edi, [ebp - 0x310]
mov byte [ebp + eax - 0x311], 0x54
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x106aed5
mov ecx, dword [ebp - 0x51c]
mov eax, dword [ebp - 0x524]
inc dword [ebp - 0x51c]
mov esi, 0x10232f8
movsw word es:[edi], word [esi]
mov dword [eax + 0x13c], ecx
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.01073f21
test eax, eax
je 0x106af35
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0106ac1e
test eax, eax
je 0x106b149
mov dword [ebp - 0x528], 1
jmp 0x106af47
push dword [ebp - 0x524]
push 0x10232c8
call fcn.01071ac0
pop ecx
pop ecx
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x100f858
push 0x10f54c0
call fcn.01070fc9
mov esi, dword [ebp - 0x524]
push ebx
lea eax, [ebp - 0x414]
push eax
push esi
push eax
call fcn.01070fc9
push ebx
lea eax, [ebp - 0x414]
push eax
push 0x10232a8
push eax
call fcn.01070fc9
cmp dword [0x109a030], 0
mov ebx, dword [0x109a498]
je 0x106afb4
mov eax, dword [ebx + 0xc]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106af9a
lea edi, [ebp - 0x414]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x106afaa
jmp 0x106afd4
lea eax, [esi + 0x104]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x106afbc
lea edi, [ebp - 0x414]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x106afcc
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push dword [ebx + 0xc]
mov esi, dword [ebp - 0x524]
push esi
push 0x102326c
call fcn.01071ac0
add esp, 0xc
lea eax, [ebp - 0x534]
push eax
xor ebx, ebx
push ebx
lea eax, [ebp - 0x414]
push eax
call fcn.01070db7
cmp eax, ebx
jne 0x106b01d
push ebx
push 0x102323c
jmp 0x106b043
mov eax, dword [ebp - 0x534]
xor edi, edi
inc edi
cmp eax, ebx
mov dword [esi + 0x128], eax
mov dword [esi + 0x124], edi
je 0x106b0b5
cmp eax, 0xbc2
je 0x106b0af
push eax
push 0x1023224
call fcn.01071ac0
cmp dword [ebp - 0x528], ebx
pop ecx
pop ecx
je 0x106b149
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.01074378
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.01073f21
test eax, eax
je 0x106b097
lea eax, [ebp - 0x310]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0106ac1e
push 1
lea eax, [ebp - 0x310]
push eax
call fcn.01074378
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0106ac1e
jmp 0x106b149
mov dword [0x109a930], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea eax, [ebp - 0x51c]
push eax
push 4
push 0
push 0x1010a24
push dword [ebp - 0x520]
mov dword [ebp - 0x51c], edi
call ebx
test eax, eax
je 0x106b0f2
push eax
push 0x1023200
call fcn.01071ac0
pop ecx
pop ecx
mov dword [esi + 0x134], edi
mov eax, dword [esi + 0x13c]
inc eax
push 4
mov dword [ebp - 0x51c], eax
lea eax, [ebp - 0x51c]
push eax
push 4
push 0
push 0x1023320
push dword [ebp - 0x520]
call ebx
test eax, eax
je 0x106b136
push eax
push 0x1023320
push 0x10231e0
call fcn.01071ac0
add esp, 0xc
mov dword [esi + 0x134], edi
push esi
push 0x10231b0
mov dword [ebp - 0x52c], edi
call fcn.01071ac0
pop ecx
pop ecx
cmp dword [ebp - 0x520], 0
pop edi
pop esi
pop ebx
je 0x106b161
push dword [ebp - 0x520]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x52c]
call fcn.0106bc50
leave
ret 4