Function at 0x101c1b2
Capabilities:
Delete registry key
Delete registry value
Persist via default file association registry key
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x7f4
mov eax, dword [0x102a0ec]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x7d0], eax
mov dword [ebp - 0x7dc], ecx
mov dword [ebp - 0x7f4], ebx
mov dword [ebp - 0x7c4], esi
mov dword [ebp - 0x7cc], esi
mov dword [ebp - 0x7c8], 1
mov dword [ebp - 0x7d4], esi
je 0x101d1cf
push edi
lea ecx, [ebp - 0x7c4]
push ecx
push 0x2001f
push esi
push eax
mov edi, 0x80000000
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101d1cc
push dword [ebp - 0x7c4]
inc eax
mov dword [ebp - 0x7e4], esi
mov dword [ebp - 0x7d8], eax
mov dword [ebp - 0x7ec], esi
mov dword [ebp - 0x7e0], eax
mov dword [ebp - 0x7e8], esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7d0]
mov ebx, 0x103
push 0x100759c
lea eax, [ebp - 0x450]
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c416
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push esi
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c40a
cmp dword [ebp - 0x7c8], 1
je 0x101c2e4
cmp dword [ebp - 0x7c8], 2
jne 0x101c40a
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101c40a
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.0101b4c4
test eax, eax
je 0x101c40a
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7d8], esi
mov dword [ebp - 0x7e4], 1
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c40a
cmp dword [ebp - 0x7c8], 1
je 0x101c379
cmp dword [ebp - 0x7c8], 2
jne 0x101c40a
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x694]
push eax
call fcn.0100c535
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x694]
push eax
call fcn.0101b4c4
test eax, eax
jne 0x101c40a
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x100770c
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x694]
push eax
call fcn.0101b567
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7d8], 1
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x10076d8
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c57a
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x100158c
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7f0], esi
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c558
cmp dword [ebp - 0x7c8], 1
jne 0x101c558
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
lea eax, [ebp - 0x248]
push eax
push dword [0x102a0fc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0xc
test eax, eax
jne 0x101c558
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x100770c
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c54e
cmp dword [ebp - 0x7c8], 1
jne 0x101c54e
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push 0x100158c
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x100770c
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x101c558
mov dword [ebp - 0x7f0], 1
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7f0], esi
je 0x101c57a
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x7e4], esi
je 0x101c7ac
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x10076bc
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x7c4]
push eax
push 0x20006
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c5dd
push 0x10076a0
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x100766c
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
cmp dword [ebp - 0x7d4], esi
je 0x101c6ca
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c6ca
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x1007640
push ebx
push eax
mov dword [ebp - 0x7d4], esi
call fcn.0100d4d1
add esp, 0x10
push esi
lea eax, [ebp - 0x7d4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101c696
push dword [ebp - 0x7d4]
push dword [ebp - 0x7c4]
call fcn.0101773d
test eax, eax
je 0x101c68a
mov dword [ebp - 0x7d8], 1
push dword [ebp - 0x7d4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x100766c
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.01017d6c
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x10076bc
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
cmp dword [ebp - 0x7d8], esi
je 0x101c79f
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c7ac
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c791
cmp dword [ebp - 0x7c8], 1
jne 0x101c791
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1007504
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101c7ac
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.01017d6c
cmp dword [ebp - 0x7dc], esi
mov dword [ebp - 0x7d4], esi
je 0x101cc27
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x450]
push dword [ebp - 0x7d0]
push 0x1007548
push ebx
push eax
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101cc27
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push esi
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c9d6
cmp dword [ebp - 0x7c8], 1
je 0x101c84d
cmp dword [ebp - 0x7c8], 2
jne 0x101c9d6
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101c9d6
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x248]
push eax
call fcn.0101b4c4
test eax, eax
je 0x101c9d6
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x450]
push dword [ebp - 0x7d0]
mov dword [ebp - 0x7d8], esi
push 0x1007628
push ebx
push eax
mov dword [ebp - 0x7e0], esi
mov dword [ebp - 0x7ec], 1
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0x7d8]
push eax
push 0x20006
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101c8f6
push 0x10076a0
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101c9d6
cmp dword [ebp - 0x7c8], 1
je 0x101c945
cmp dword [ebp - 0x7c8], 2
jne 0x101c9d6
lea eax, [ebp - 0x248]
push eax
push 0x121
lea eax, [ebp - 0x694]
push eax
call fcn.0100c535
lea eax, [ebp - 0x694]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x694]
push eax
call fcn.0101b4c4
test eax, eax
jne 0x101c9d6
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x100770c
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x694]
push eax
call fcn.0101b567
mov dword [ebp - 0x7d4], eax
mov dword [ebp - 0x7e0], 1
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7ec], esi
je 0x101cc27
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x450]
push dword [ebp - 0x7d0]
push 0x10075f8
push ebx
push eax
call fcn.0100d4d1
add esp, 0x14
cmp dword [ebp - 0x7d4], esi
je 0x101caed
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101caed
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x450]
push dword [ebp - 0x7d0]
mov dword [ebp - 0x7d8], esi
push 0x10075f8
push ebx
push eax
call fcn.0100d4d1
add esp, 0x14
push esi
lea eax, [ebp - 0x7d8]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x101cab3
push dword [ebp - 0x7d8]
push dword [ebp - 0x7c4]
call fcn.0101773d
test eax, eax
je 0x101caa7
mov dword [ebp - 0x7e0], 1
push dword [ebp - 0x7d8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x450]
push dword [ebp - 0x7d0]
push 0x10075f8
push ebx
push eax
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.01017d6c
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x450]
push dword [ebp - 0x7d0]
push 0x1007628
push ebx
push eax
call fcn.0100d4d1
add esp, 0x14
cmp dword [ebp - 0x7e0], esi
je 0x101cc1a
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101cc27
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101cbba
cmp dword [ebp - 0x7c8], 1
jne 0x101cbba
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1007504
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7dc]
call fcn.0101b431
test eax, eax
je 0x101cc0c
push 0x1004490
push dword [ebp - 0x7dc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101cc0c
push dword [0x102a100]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x102a100]
push 2
push esi
push 0x10074dc
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101cc27
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.01017d6c
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x10075e4
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101d14f
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push esi
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101ce90
cmp dword [ebp - 0x7c8], 1
jne 0x101ce90
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101ce90
lea eax, [ebp - 0x248]
push 0x1007570
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101cd2d
cmp dword [ebp - 0x7e4], esi
je 0x101cd2d
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7e8], 1
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101cd27
cmp dword [ebp - 0x7c8], 1
je 0x101ce51
push esi
jmp 0x101ce84
cmp dword [ebp - 0x7ec], esi
je 0x101ce90
push dword [ebp - 0x7dc]
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101ce90
push 0x1004490
push dword [ebp - 0x7dc]
mov dword [ebp - 0x7e8], 1
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101ce0a
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x10074dc
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101ce0a
cmp dword [ebp - 0x7c8], 1
je 0x101cdc2
cmp dword [ebp - 0x7c8], 2
jne 0x101ce0a
lea eax, [ebp - 0x248]
push eax
call fcn.0101b431
test eax, eax
je 0x101ce0a
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
lea eax, [ebp - 0x248]
mov dword [esp], 0x1001cd4
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
je 0x101ce0a
push 0x10074dc
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101ce90
cmp dword [ebp - 0x7c8], 1
je 0x101ce51
cmp dword [ebp - 0x7c8], 2
jne 0x101ce90
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1007504
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7e8], esi
je 0x101d14f
push 0x10074b8
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x100258c
push ebx
push eax
mov dword [ebp - 0x7d4], esi
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101cf95
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101cf81
cmp dword [ebp - 0x7c8], 1
je 0x101cf38
cmp dword [ebp - 0x7c8], 2
jne 0x101cf81
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1007504
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x7d4], 1
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7d4], esi
jne 0x101cfa2
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.01017d6c
push 0x100158c
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x100258c
push ebx
push eax
mov dword [ebp - 0x7d4], 1
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0x7c4]
push eax
push 0x2001f
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101d14f
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x10075c8
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101d12e
cmp dword [ebp - 0x7c8], 1
jne 0x101d12e
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push esi
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101d12e
cmp dword [ebp - 0x7c8], 1
jne 0x101d12e
lea eax, [ebp - 0x7c0]
push eax
call fcn.0101b431
test eax, eax
je 0x101d12e
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x7c0]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x101d12e
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x7c0]
push eax
lea eax, [ebp - 0x7c8]
push eax
push esi
push 0x1007504
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x101d128
cmp dword [ebp - 0x7c8], 1
jne 0x101d128
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x248]
push eax
push dword [ebp - 0x7c8]
push esi
push esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x1007504
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x101d12e
mov dword [ebp - 0x7d4], esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x7d4], esi
jne 0x101d14f
lea eax, [ebp - 0x450]
push eax
push edi
call fcn.01017d6c
push dword [ebp - 0x7d0]
lea eax, [ebp - 0x450]
push 0x10075e4
push ebx
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x7c4]
push eax
push 0x20019
push esi
lea eax, [ebp - 0x450]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101d1ce
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x7cc]
push eax
lea eax, [ebp - 0x248]
push eax
push esi
push dword [ebp - 0x7c4]
mov dword [ebp - 0x7cc], 0x122
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x101d1be
mov eax, dword [ebp - 0x7f4]
mov dword [eax], esi
push dword [ebp - 0x7c4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x101d1ce
mov dword [ebx], esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0101672d
leave
ret 0x10