Function at 0x100356f
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x9c], ebx
stosw word es:[edi], ax
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
cmp dword [ebp + 8], ebx
je 0x1004b5d
cmp esi, ebx
je 0x1004b5d
lea eax, [ebp - 0x70]
xor edi, edi
push eax
inc edi
push edi
call fcn.01002865
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp + 8]
call fcn.010037c9
test eax, eax
je 0x1007155
cmp dword [ebp - 0x78], edi
je 0x100717b
lea eax, [ebp - 0x70]
push eax
call fcn.0100138a
mov dword [ebp - 0x7c], eax
cmp eax, ebx
je 0x1007183
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x14]
push ebx
or eax, 0x2001f
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0x34]
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
cmp esi, ebx
jne 0x1003728
cmp dword [ebp - 0x74], ebx
je 0x1007191
cmp dword [ebp - 0x2c], ebx
je 0x1007198
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x2c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x1003ae2
push ebx
push 0xca
call fcn.0100339e
push edi
push 0xce
mov esi, eax
call fcn.0100339e
mov edi, eax
push dword [ebp - 0x60]
push edi
push dword [ebp - 0x2c]
push esi
call fcn.010034ce
cmp eax, 2
jg 0x100368c
cmp eax, 1
jne 0x10071a5
mov eax, dword [ebp - 0x44]
xor edi, edi
inc edi
mov dword [ebp - 0x7c], edi
cmp eax, 3
je 0x1007386
jle 0x1003af9
cmp eax, 5
jg 0x10071f6
cmp dword [ebp - 0x28], ebx
je 0x1004b56
push 0xa
pop esi
push 2
push edi
push 0x100484c
push dword [ebp - 0x28]
call fcn.01004857
test eax, eax
je 0x1004b4e
push ebx
push esi
push dword [ebp - 0x28]
call fcn.010049ff
test eax, eax
je 0x1007275
push esi
push dword [ebp - 0x28]
call fcn.010048a8
mov dword [ebp - 0x84], eax
push 4
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x44]
push ebx
push dword [ebp - 0x2c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea eax, [ebp - 0x74]
push eax
call fcn.01001324
lea eax, [ebp - 0x70]
push eax
call fcn.0100307d
cmp dword [ebp - 0x7c], ebx
je 0x1007452
cmp esi, ebx
jne 0x1007473
push ebx
xor esi, esi
call fcn.01003151
push 0x20000
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.010030dc
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01002af3
leave
ret 8
cmp eax, 2
je 0x10036a7
jmp 0x10071ce
cmp dword [ebp - 0x28], ebx
je 0x1004b56
push ebx
push dword [ebp - 0x28]
call fcn.0100243e
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0x28]
mov dword [ebp - 0x84], eax
jmp 0x1003716
push 0x10
pop esi
jmp 0x10036ec
push 0x57
jmp 0x10073b7
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x1007495
push 0x20000
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x40
push eax
call fcn.010030dc
mov ebx, edi
lea eax, [ebp - 0x70]
push eax
call fcn.0100307d
mov eax, ebx
jmp 0x1003769
push edi
call fcn.01008449
jmp 0x100716b
push 0xffffffffffffffff
call fcn.01003151
push 0x20001
jmp 0x100715a
push 0x42b
jmp 0x1007185
lea eax, [ebp - 0x74]
push eax
call fcn.01001324
push 0x57
jmp 0x1007185
lea eax, [ebp - 0x74]
push eax
call fcn.01001324
push 0x4c7
call fcn.01003151
push 0x20000
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x20
push eax
call fcn.010030dc
jmp 0x100716b
push eax
call fcn.01003151
push 0x20001
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x40
push eax
call fcn.010030dc
lea eax, [ebp - 0x74]
push eax
call fcn.01001324
jmp 0x1007169
cmp eax, 7
je 0x100727f
cmp eax, 0xb
jne 0x1003af9
cmp dword [ebp - 0x28], ebx
je 0x1004b56
push 0xa
pop edi
push 2
push 1
push 0x100484c
push dword [ebp - 0x28]
call fcn.01004857
test eax, eax
jne 0x100722c
push 0x10
pop edi
mov esi, dword [sym.imp.msvcrt.dll__errno]
call esi
mov dword [eax], ebx
push edi
lea eax, [ebp - 0xa4]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.msvcrt.dll__wcstoui64]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0xa4]
add esp, 0xc
mov dword [ebp - 0x94], edx
cmp word [eax], bx
jne 0x1007275
call esi
cmp dword [eax], 0x22
je 0x1007275
push 8
lea eax, [ebp - 0x98]
jmp 0x1003715
mov dword [ebp - 0x7c], ebx
push 0x79
jmp 0x10073b7
push ebx
push dword [ebp - 0x28]
call fcn.0100243e
mov esi, eax
push ebx
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x80], esi
call fcn.0100243e
mov dword [ebp - 0xa0], eax
lea eax, [esi + esi + 6]
push eax
call fcn.010026af
mov dword [ebp - 0x8c], eax
cmp eax, ebx
je 0x10073b5
xor edi, edi
cmp dword [ebp - 0x80], ebx
mov esi, eax
jle 0x10072e3
push edi
push 1
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x28]
call fcn.0100157e
mov dword [ebp - 0x78], eax
cmp eax, 0xffffffff
je 0x1007324
cmp eax, edi
jne 0x100732a
mov dword [ebp - 0x90], 1
push ebx
push 1
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x28]
call fcn.01004857
test eax, eax
mov eax, dword [ebp - 0x8c]
jne 0x1007373
lea esi, [eax + 4]
sub esi, eax
sar esi, 1
add esi, esi
push esi
push eax
push dword [ebp - 0x44]
push ebx
push dword [ebp - 0x2c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea eax, [ebp - 0x8c]
jmp 0x1007447
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
sub eax, edi
inc eax
push eax
mov eax, dword [ebp - 0x28]
lea eax, [eax + edi*2]
push eax
push esi
call fcn.010022bd
push ebx
push esi
call fcn.0100243e
mov ecx, dword [ebp - 0x8c]
lea esi, [esi + eax*2 + 2]
mov eax, dword [ebp - 0x80]
lea ecx, [ecx + eax*2 + 4]
cmp esi, ecx
jae 0x10072e3
mov ecx, dword [ebp - 0xa0]
mov edx, dword [ebp - 0x78]
lea edi, [ecx + edx]
cmp edi, eax
jge 0x10072e3
jmp 0x10072be
inc esi
inc esi
cmp dword [ebp - 0x90], 1
jne 0x10072ff
push 0x7b
mov dword [ebp - 0x7c], ebx
pop esi
jmp 0x1007319
cmp dword [ebp - 0x28], ebx
je 0x1004b56
push ebx
push dword [ebp - 0x28]
call fcn.0100243e
mov ecx, eax
shr ecx, 1
and eax, edi
lea eax, [eax + ecx + 1]
push eax
mov dword [ebp - 0x80], eax
call fcn.010026af
mov dword [ebp - 0x88], eax
cmp eax, ebx
jne 0x10073bd
push 8
pop esi
jmp 0x1003728
mov esi, dword [ebp - 0x28]
push 6
xor edi, edi
pop ecx
lea eax, [ebp - 0xc]
mov byte [eax], bl
inc eax
dec ecx
je 0x1007416
jmp 0x10073c8
test al, 1
jne 0x10073db
mov ax, word [esi]
inc esi
inc esi
jmp 0x10073de
push 0x30
pop eax
mov word [ebp - 0xc], ax
mov ax, word [esi]
push 1
mov word [ebp - 0xa], ax
push 0x10
lea eax, [ebp - 0xc]
inc esi
push eax
inc esi
call fcn.010049ff
test eax, eax
je 0x1007464
push 0x10
lea eax, [ebp - 0xc]
push eax
call fcn.010048a8
mov ecx, dword [ebp - 0x88]
mov byte [ecx + edi], al
inc edi
cmp edi, dword [ebp - 0x80]
jae 0x100746c
push ebx
push esi
call fcn.0100243e
mov dword [ebp - 0x84], eax
cmp eax, 1
ja 0x10073d0
push edi
push dword [ebp - 0x88]
push dword [ebp - 0x44]
push ebx
push dword [ebp - 0x2c]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
lea eax, [ebp - 0x88]
push eax
call fcn.01002024
jmp 0x1003728
push esi
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x40
push eax
call fcn.0100d948
jmp 0x100748d
push 0x7a
mov dword [ebp - 0x7c], ebx
pop esi
jmp 0x1007441
mov esi, 0x42b
jmp 0x1007441
push esi
call fcn.01003151
push 0x20001
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x40
push eax
call fcn.010030dc
xor esi, esi
inc esi
jmp 0x1003767
call dword [sym.imp.msvcrt.dll___iob_func]
add eax, 0x40
push eax
call fcn.0100d7cd
xor eax, eax
inc eax
jmp 0x1003769