Function at 0x100c716
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 8]
push eax
xor ebx, ebx
push ebx
push 0x20006
push ebx
push 0x1001b84
push ebx
push 0x102e030
push 0x80000001
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100c9d0
push edi
lea eax, [esi + 0x84]
push eax
mov dword [ebp - 4], ebx
call dword [fcn.01001068]
mov edi, dword [esi + 0x64]
cmp edi, ebx
je 0x100c856
mov eax, edi
mov ebx, dword [eax + 8]
cmp dword [ebx + 0x7c], 0
mov edi, dword [edi]
je 0x100c7ae
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x100c799
add eax, 0xc
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
add ebx, 0xc
push ebx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
test edi, edi
jne 0x100c76d
cmp dword [ebp - 4], edi
je 0x100c856
add dword [ebp - 4], 2
push dword [ebp - 4]
push 0x40
call dword [0x10010bc]
mov edi, eax
test edi, edi
mov dword [ebp - 0xc], edi
je 0x100c864
mov eax, dword [esi + 0x64]
test eax, eax
je 0x100c82f
jmp 0x100c7e3
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax + 8]
cmp dword [ebx + 0x7c], 0
mov ecx, dword [eax]
mov dword [ebp - 0x10], ecx
je 0x100c829
mov eax, dword [ebx + 0x80]
test eax, eax
je 0x100c812
add eax, 0xc
push eax
push edi
call dword [0x10010a0]
push 0x1001cf4
push edi
call dword [0x100109c]
add ebx, 0xc
push ebx
push edi
call dword [0x100109c]
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea edi, [edi + eax*2 + 2]
cmp dword [ebp - 0x10], 0
jne 0x100c7e0
push dword [ebp - 4]
and word [edi], 0
push dword [ebp - 0xc]
push 7
push 0
push str.Favorites
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [fcn.01001050]
jmp 0x100c864
push str.Favorites
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea edi, [esi + 0x7c]
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
mov eax, dword [esi + 0x134]
push 4
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
push 4
xor ebx, ebx
push ebx
push str.ConnectionsPersistent
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [esi + 0x134], ebx
je 0x100c971
lea eax, [esi + 0x84]
push eax
mov dword [ebp - 4], ebx
call dword [fcn.01001068]
mov ebx, dword [esi + 0x64]
jmp 0x100c8d3
mov eax, ebx
mov eax, dword [eax + 8]
cmp dword [eax + 4], 4
mov ebx, dword [ebx]
jne 0x100c8d3
add eax, 0xc
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x100c8b1
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
add dword [ebp - 4], 2
push dword [ebp - 4]
push 0x40
call dword [0x10010bc]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 0xc], ebx
je 0x100c97f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
lea eax, [esi + 0x84]
push eax
call dword [fcn.01001068]
mov esi, dword [esi + 0x64]
jmp 0x100c941
mov eax, esi
mov eax, dword [eax + 8]
cmp dword [eax + 4], 4
mov esi, dword [esi]
jne 0x100c941
add eax, 0xc
push eax
push dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
push ebx
call fcn.0100c4ab
push dword [ebp - 0x1c]
call dword [sym.imp.msvcrt.dll_wcslen]
inc eax
add eax, eax
add ebx, eax
sub dword [ebp - 0x10], eax
pop ecx
test esi, esi
jne 0x100c912
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x1c]
push dword [ebp - 4]
and word [ebx], si
push dword [ebp - 0xc]
push 7
push esi
push str.Connections
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [fcn.01001050]
jmp 0x100c97f
push str.Connections
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
call sub.MFC42u.dll_AfxGetModuleState
mov eax, dword [eax + 4]
mov eax, dword [eax + 0x23c]
mov eax, dword [eax + 0x120]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x14], esi
pop edi
je 0x100c9b0
push esi
push esi
push 0x13a9
push dword [eax + 0x20]
call dword [fcn.010016c4]
mov dword [ebp - 0x14], eax
push 4
lea eax, [ebp - 0x14]
push eax
push 4
push esi
push str.TreeViewStates
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
leave
ret