Function at 0x1000983b
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete cl
cmp dword [0x1002d214], 0xa
setl al
or al, cl
push eax
sub esp, 0x208
mov edi, esp
push eax
mov ecx, esp
test al, al
je 0x10009861
mov dword [ebp - 0x10], ecx
push eax
mov dword [ebp - 0x14], esp
push eax
mov dword [ebp - 0x18], esp
push str.RunOnce
push str.SoftwareMicrosoftWindowsCurrentVersion
push str._s_s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d214], 0xa
jl 0x1000992e
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x1000992e
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersion
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov eax, str.RunOnce
push eax
push ebx
mov eax, str._s_s
push eax
push edi
call esi
add esp, 0x10
mov eax, str.RunOnce
push eax
push ebx
mov eax, str._s_s
push eax
push edi
call esi
add esp, 0x10
cmp dword [0x1002d214], 0xa
jl 0x100098fc
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100098bd
push str.RunOnce
push str.SoftwareMicrosoftWindowsCurrentVersion
push str._s_s
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d214], 0xa
jl 0x1000992e
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x100098bd
xor ecx, ecx
movaps xmm0, xmmword [0x10024360]
mov eax, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, dword [ebp - 0x10]
mov dword [ebx], ecx
sub esp, 0x24
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ecx
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], 0x80000001
mov esi, eax
call eax
cmp dword [0x1002d214], 0xa
jl 0x100099ba
mov ecx, dword [0x1002d210]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x100099ba
mov ebx, dword [ebp - 0x10]
xor eax, eax
mov dword [ebx], eax
sub esp, 0x24
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], eax
movaps xmm0, xmmword [0x10024360]
movups xmmword [esp + 8], xmm0
mov dword [esp + 4], edi
mov dword [esp], 0x80000001
call esi
xor ecx, ecx
mov eax, esi
movaps xmm0, xmmword [0x10024360]
jmp 0x1000993f
test eax, eax
je 0x100099c6
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp dword [ebp + 8], 0
je 0x100099e2
push dword [0x1002cd7c]
mov ebx, dword [ebp - 0x10]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x10009e2d
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [ebp - 0x20], eax
cmp dword [0x1002d214], 0xa
jl 0x10009a28
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10009a28
mov eax, 0x20a
mov ebx, 8
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
push ebx
mov edi, dword [ebp - 0x20]
push edi
call esi
mov eax, 0x20a
push eax
push ebx
push edi
call esi
jmp 0x100099eb
push 0x20a
push 8
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
cmp dword [0x1002d214], 0xa
jl 0x10009a53
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009a04
test esi, esi
mov ebx, dword [ebp - 0x10]
je 0x10009e2d
push str.Silverlight.Configuration.exe
push dword [0x1002cd58]
push 0x10027760
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
cmp dword [0x1002d214], 0xa
jl 0x10009b26
mov edx, dword [0x1002d210]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
je 0x10009b26
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [edx + 1]
imul ecx, edx
test cl, 1
jne 0x10009ada
push str.Silverlight.Configuration.exe
push dword [0x1002cd58]
push 0x10027760
push esi
call edi
add esp, 0x10
cmp dword [0x1002d214], 0xa
jl 0x10009af2
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10009af2
push str.Silverlight.Configuration.exe
push dword [0x1002cd58]
push 0x10027760
push esi
call edi
add esp, 0x10
jmp 0x10009aab
push str.Silverlight.Configuration.exe
push dword [0x1002cd58]
push 0x10027760
push esi
call edi
add esp, 0x10
cmp dword [0x1002d214], 0xa
jl 0x10009b26
mov edx, dword [0x1002d210]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
jne 0x10009aa0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], esi
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov edx, dword [ebp - 0x18]
mov dword [edx], 1
mov esi, dword [ebx]
push ecx
push eax
push edx
push eax
push str.Silverlight.Configuration.exe
mov dword [ebp - 0x20], esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [0x1002d214], 0xa
jl 0x10009bb4
mov ecx, dword [0x1002d210]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10009bb4
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x20]
push edi
xor eax, eax
push eax
push esi
push eax
mov eax, str.Silverlight.Configuration.exe
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
xor eax, eax
push eax
push esi
push eax
mov eax, str.Silverlight.Configuration.exe
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [0x1002d214], 0xa
jl 0x10009bb4
mov ecx, dword [0x1002d210]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x10009b74
test eax, eax
je 0x10009c12
mov eax, dword [ebp - 0x24]
lea edi, [eax + eax]
add edi, 2
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, dword [ebp - 0x10]
push edi
push dword [ebp - 0x1c]
push 1
push 0
push str.Silverlight.Configuration.exe
push dword [ebx]
call esi
cmp dword [0x1002d214], 0xa
jl 0x10009d9a
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10009d9a
push edi
push dword [ebp - 0x1c]
push 1
push 0
push str.Silverlight.Configuration.exe
mov ebx, dword [ebp - 0x10]
push dword [ebx]
call esi
jmp 0x10009bca
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, dword [ebp - 0x14]
mov eax, dword [edi]
lea edi, [eax + eax]
add edi, 2
call ebx
push edi
push 8
push eax
call esi
cmp dword [0x1002d214], 0xa
jl 0x10009c66
mov edx, dword [0x1002d210]
lea ecx, [edx + 1]
imul ecx, edx
and ecx, 1
je 0x10009c66
mov edi, dword [ebp - 0x14]
mov eax, dword [edi]
lea esi, [eax + eax]
add esi, 2
call ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 8
push eax
call esi
jmp 0x10009c21
test eax, eax
je 0x10009d90
mov ecx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [ebp - 0x10]
mov edi, eax
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x20], edi
push eax
push edi
push esi
push 0
push str.Silverlight.Configuration.exe
push dword [edx]
mov ebx, ecx
call ecx
cmp dword [0x1002d214], 0xa
jl 0x10009cd0
mov ecx, dword [0x1002d210]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10009cd0
mov eax, edi
mov edi, dword [ebp - 0x14]
push edi
push eax
push esi
push 0
push str.Silverlight.Configuration.exe
mov esi, dword [ebp - 0x10]
push dword [esi]
call ebx
mov eax, edi
mov edx, esi
mov esi, dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
mov ecx, ebx
jmp 0x10009c82
xor ebx, ebx
test eax, eax
jne 0x10009d2c
push dword [ebp - 0x1c]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp dword [0x1002d214], 0xa
jl 0x10009d25
mov ecx, dword [0x1002d210]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
je 0x10009d25
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov esi, dword [ebp - 0x1c]
push esi
push edi
call ebx
push esi
push edi
call ebx
cmp dword [0x1002d214], 0xa
jl 0x10009d25
mov ecx, dword [0x1002d210]
lea edx, [ecx + 1]
imul edx, ecx
and edx, 1
jne 0x10009d03
xor ebx, ebx
test eax, eax
sete bl
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push edi
push 0
mov dword [ebp - 0x14], eax
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x1002d214], 0xa
jl 0x10009d92
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10009d92
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
xor eax, eax
push eax
push ebx
call esi
push edi
xor eax, eax
push eax
push ebx
call esi
cmp dword [0x1002d214], 0xa
jl 0x10009d8b
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009d64
mov ebx, dword [ebp - 0x18]
jmp 0x10009d92
xor ebx, ebx
test ebx, ebx
je 0x10009bb8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x1002d214], 0xa
jl 0x10009e2a
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x10009e2a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
call edi
push esi
xor ecx, ecx
push ecx
push eax
call ebx
call edi
push esi
xor ecx, ecx
push ecx
push eax
call ebx
cmp dword [0x1002d214], 0xa
jl 0x10009dff
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009dd4
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push dword [ebp - 0x1c]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [0x1002d214], 0xa
jl 0x10009e2a
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009dd4
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebx]
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [0x1002d214], 0xa
jl 0x100099be
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
je 0x100099be
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call edi
push esi
call edi
cmp dword [0x1002d214], 0xa
jl 0x10009e7c
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009e5d
push esi
call edi
cmp dword [0x1002d214], 0xa
jl 0x100099be
mov eax, dword [0x1002d210]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
jne 0x10009e5d
jmp 0x100099be