Function at 0x1007bc36
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push 0x340
mov eax, 0x10037f35
call fcn.1002cf56
mov ebx, ecx
push 7
pop ecx
mov esi, 0x100097f8
lea edi, [ebp - 0x21c]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
push 0x1ea
mov dword [ebp - 0x348], eax
movsw word es:[edi], word [esi]
mov dword [ebp - 0x344], eax
xor edi, edi
mov dword [ebp - 0x33c], eax
mov dword [ebp - 0x334], eax
mov dword [ebp - 0x340], eax
lea eax, [ebp - 0x1fe]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x338]
push 0x100a93f8
call fcn.1003a983
push 0x110
lea eax, [ebp - 0x32c]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebx], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x330], 0x114
lea ecx, [ebp - 0x330]
call fcn.100769f6
test eax, eax
jne 0x1007bd07
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007bce7
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1007bd00
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x1007bd6c
movzx esi, si
or esi, 0x80070000
jmp 0x1007bd6c
mov esi, 0x80004005
jmp 0x1007bd6c
cmp dword [ebp - 0x32c], 6
ja 0x1007bee1
jne 0x1007bd23
cmp dword [ebp - 0x328], 1
je 0x1007bee1
lea eax, [ebp - 0x340]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
jne 0x1007bd7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007bd4f
movzx eax, ax
or eax, 0x80070000
test eax, eax
jns 0x1007bd65
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x1007bd6a
movzx eax, ax
or eax, 0x80070000
jmp 0x1007bd6a
mov eax, 0x80004005
mov esi, eax
lea ecx, [ebp - 0x338]
call fcn.1003aa36
mov eax, esi
jmp 0x1007beee
cmp dword [ebp - 0x340], 0
je 0x1007bee1
push edi
lea eax, [ebp - 0x334]
push eax
push edi
push 0xf013f
push 1
push edi
push edi
push 0x10009180
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x1007bdc7
jle 0x1007bec3
movzx esi, si
or esi, 0x80070000
jmp 0x1007bec3
lea eax, [ebp - 0x33c]
mov edx, 0x104
push eax
lea ecx, [ebp - 0x21c]
call fcn.10041a2c
mov esi, eax
test esi, esi
js 0x1007bec3
mov ecx, dword [ebp - 0x33c]
lea eax, [ebp - 0x21c]
add ecx, ecx
push ecx
push eax
push 2
push edi
push 0x100091bc
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1007be1e
jg 0x1007be19
mov esi, eax
jmp 0x1007bec3
movzx esi, ax
jmp 0x1007bdbc
mov eax, 0x208
push eax
mov dword [ebp - 0x344], eax
lea eax, [ebp - 0x21c]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x348]
push eax
push edi
push 0x100091bc
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1007be10
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.1003cfc0
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x338]
call fcn.1003cf00
push edi
push 0x100091e4
lea ecx, [ebp - 0x338]
mov dword [ebp - 4], edi
call fcn.1007ab69
test eax, eax
js 0x1007bec3
mov dword [ebx], 1
jmp 0x1007bec3
cmp dword [ebp - 0x334], 0
je 0x1007bd6c
push dword [ebp - 0x334]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1007bd6c
lea ecx, [ebp - 0x338]
call fcn.1003aa36
xor eax, eax
call fcn.1002cea8
ret