Function at 0x101ff1e
Capabilities:
Delete registry key
Delete registry value
Get common file path
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Query or enumerate registry value
Read .ini file
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xcc4
mov eax, dword [0x102a0ec]
push ebx
xor ebx, ebx
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi + 0x34]
xor eax, eax
inc eax
test byte [0x102c6a8], al
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc9c], edi
mov dword [ebp - 0xc78], ebx
mov dword [ebp - 0xc80], ebx
mov dword [ebp - 0xc7c], eax
mov dword [ebp - 0xc88], ecx
mov dword [ebp - 0xcac], ebx
mov dword [ebp - 0xcc0], ebx
mov dword [ebp - 0xca0], ebx
mov dword [ebp - 0xcb4], ebx
mov dword [ebp - 0xcb8], ebx
jne 0x101ff99
or dword [0x102c6a8], eax
push ebx
push 4
call fcn.01017179
mov dword [0x102c6a4], eax
push dword [esi]
call fcn.0101b431
test eax, eax
je 0x1021e02
push dword [esi + 8]
call fcn.0101b431
test eax, eax
je 0x1021e02
mov eax, dword [edi + 0x14]
mov dword [ebp - 0xc8c], eax
mov eax, dword [edi]
mov dword [ebp - 0xc94], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0xca8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0xc98], eax
call fcn.0101b3ae
test eax, eax
jne 0x1020004
push 8
call fcn.0101b35d
test eax, eax
je 0x1020004
push dword [esi]
call fcn.0101b66e
test eax, eax
mov dword [ebp - 0xcb0], 1
jne 0x102000a
mov dword [ebp - 0xcb0], ebx
mov ecx, dword [esi + 0x30]
push ecx
call fcn.0101b431
test eax, eax
je 0x102001d
mov dword [ebp - 0xc8c], ecx
mov eax, dword [esi + 0x2c]
cmp eax, ebx
je 0x102002a
mov dword [ebp - 0xc98], eax
mov ecx, dword [esi + 0x28]
push ecx
call fcn.0101b431
test eax, eax
je 0x102003d
mov dword [ebp - 0xca8], ecx
mov ecx, dword [esi + 0x24]
push ecx
call fcn.0101b431
test eax, eax
je 0x1020050
mov dword [ebp - 0xc94], ecx
push dword [esi + 0x20]
call fcn.0101b431
test eax, eax
je 0x1020254
push 0x122
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1020254
push 0x1007db8
push 0x122
lea eax, [ebp - 0x824]
push eax
call fcn.0100d4ff
push dword [esi + 0x20]
push 0x100843c
call dword [sym.imp.msvcrt.dll__wcsicmp]
mov edi, eax
neg edi
sbb edi, edi
pop ecx
neg edi
cmp dword [0x102c6a4], ebx
pop ecx
mov eax, 0x1007db0
jne 0x10200ba
mov eax, 0x1007da4
lea ecx, [ebp - 0x824]
push ecx
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
push dword [0x102a024]
push dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x102013d
cmp dword [0x102c6a4], ebx
mov eax, 0x1007d78
jne 0x10200f3
mov eax, 0x1007d5c
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
test eax, eax
pop ecx
pop ecx
jne 0x102013a
push dword [esi + 0x20]
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x100843c
call edi
test eax, eax
pop ecx
pop ecx
je 0x1020254
lea eax, [ebp - 0x20c]
push eax
push dword [0x102a024]
call edi
test eax, eax
pop ecx
pop ecx
jne 0x1020254
xor edi, edi
inc edi
cmp edi, ebx
je 0x1020254
push dword [esi + 0x20]
push 0x100843c
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10201a5
mov edi, dword [0x102c6a4]
cmp edi, ebx
mov eax, 0x1007d78
jne 0x102016d
mov eax, 0x1007d5c
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
cmp edi, ebx
mov eax, 0x1007db0
jne 0x102018d
mov eax, 0x1007da4
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp - 0x20c]
push ecx
push dword [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esi]
inc eax
inc eax
push eax
push 0x103
lea eax, [ebp - 0x20c]
push eax
call fcn.0100c535
push 0x122
lea eax, [ebp - 0x450]
push eax
push dword [0x102a024]
lea eax, [ebp - 0x20c]
push eax
mov edi, 0x100462c
push edi
call dword [sym.imp.KERNEL32.dll_GetProfileStringW]
test eax, eax
je 0x1020230
lea eax, [ebp - 0x450]
push eax
push dword [0x102a024]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1020230
cmp dword [0x102c6a4], ebx
jne 0x1020254
lea eax, [ebp - 0x450]
push eax
push 0x1003870
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1020254
push dword [esi + 0x20]
lea eax, [ebp - 0x20c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
jmp 0x1020254
push dword [esi + 0x20]
lea eax, [ebp - 0x20c]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteProfileStringW]
call edi
push dword [esi + 0x20]
lea eax, [ebp - 0x20c]
push eax
push 0x1007d34
call edi
push dword [0x102a0f8]
lea eax, [ebp - 0x5e0]
push dword [esi]
push 0x1008414
push 0xc7
push eax
call fcn.0100d4d1
add esp, 0x14
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10202a8
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi]
lea eax, [ebp - 0x5e0]
push 0x10083ec
push 0xc7
push eax
call fcn.0100d4d1
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add esp, 0x10
test eax, eax
jl 0x102030f
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102030f
push ebx
push ebx
push ebx
push ebx
push dword [esi + 8]
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1008398
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1020363
push 0x1003c14
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push ebx
push dword [esi]
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1008340
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10203b7
push 0x1003c14
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push ebx
push dword [esi]
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x10082c8
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102040b
push 0x1003c14
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push ebx
push dword [esi]
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push 0x1008250
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102045f
push 0x1003c14
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push ebx
push dword [esi]
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push dword [esi]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1021e02
push dword [esi + 0xc]
mov dword [ebp - 0xc84], ebx
call fcn.0101b431
test eax, eax
je 0x10204f7
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x1008234
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10204d5
cmp dword [ebp - 0xc7c], 1
je 0x10204f7
push dword [esi + 0xc]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0xc]
push 1
push ebx
push 0x1008234
push dword [ebp - 0xc78]
call edi
push dword [esi + 0x10]
call fcn.0101b431
test eax, eax
je 0x1020563
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x1004230
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1020541
cmp dword [ebp - 0xc7c], 1
je 0x1020563
push dword [esi + 0x10]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0x10]
push 1
push ebx
push 0x1004230
push dword [ebp - 0xc78]
call edi
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x10081d0
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
cmp dword [ebp - 0xcb0], ebx
je 0x10206c8
push ebx
lea eax, [ebp - 0xc84]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10205e0
push 0x1002fa0
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1002fa0
push 1
push ebx
push ebx
push dword [ebp - 0xc84]
call edi
push dword [ebp - 0xc84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x1008170
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0xc84]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1020651
push 0x1002ed8
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1002ed8
push 1
push ebx
push ebx
push dword [ebp - 0xc84]
call edi
push dword [ebp - 0xc84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x1008110
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0xc84]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1020736
push 0x10031c8
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10031c8
push 1
push ebx
push ebx
push dword [ebp - 0xc84]
call edi
push dword [ebp - 0xc84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1020736
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x1008170
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esi + 8]
lea eax, [ebp - 0x20c]
push 0x1008110
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1020bc3
cmp dword [ebp - 0xc7c], 1
jne 0x1020bc3
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x1020bc3
push dword [esi]
call fcn.0101e485
test eax, eax
jne 0x10207eb
push dword [esi + 8]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x10207c5
push 0x1007de0
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1007de0
jmp 0x10207db
push 0x10080fc
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x10080fc
push 1
push ebx
push 0x1007df0
push dword [ebp - 0xc78]
call edi
cmp dword [ebp - 0xc88], ebx
jne 0x1020be7
lea eax, [ebp - 0x450]
push eax
push 0x100759c
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc90], 1
mov dword [ebp - 0xcbc], ebx
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0xc84]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10208c6
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc84]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10208bb
cmp dword [ebp - 0xc7c], 1
je 0x102088d
cmp dword [ebp - 0xc7c], 2
jne 0x10208bb
lea eax, [ebp - 0xa68]
push eax
call fcn.0101b431
test eax, eax
je 0x10208bb
lea ecx, [ebp - 0xa68]
push ecx
push dword [esi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 0xcbc], eax
call fcn.0101de76
mov dword [ebp - 0xc90], eax
push dword [ebp - 0xc84]
jmp 0x102097c
push dword [esi]
lea eax, [ebp - 0xc74]
push dword [0x102a0f4]
mov dword [ebp - 0xca4], ebx
push 0x1007378
push 0x104
push eax
call fcn.0100d4d1
add esp, 0x14
test eax, eax
jl 0x102098e
lea eax, [ebp - 0xca4]
push eax
push 1
push ebx
lea eax, [ebp - 0xc74]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102098e
lea eax, [ebp - 0xcc4]
push eax
lea eax, [ebp - 0xc74]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x10078ec
push dword [ebp - 0xca4]
mov dword [ebp - 0xcc4], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1020976
cmp dword [ebp - 0xc7c], 1
jne 0x1020976
lea eax, [ebp - 0xc74]
push 0x1001780
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1020976
push dword [ebp - 0xca4]
jmp 0x1021dfc
push dword [ebp - 0xca4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc90], ebx
je 0x1020b28
lea eax, [ebp - 0x450]
push eax
push 0x10075e4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0xc84]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020b20
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc84]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1020b14
cmp dword [ebp - 0xc7c], 1
jne 0x1020b14
lea eax, [ebp - 0xa68]
push eax
call fcn.0101b431
test eax, eax
je 0x1020b14
lea eax, [ebp - 0xa68]
push 0x1007570
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1020b14
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0x450]
push eax
push 0x1007548
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xca4], ebx
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0xca4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020b14
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0xa68]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xca4]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1020b08
cmp dword [ebp - 0xc7c], 1
je 0x1020ada
cmp dword [ebp - 0xc7c], 2
jne 0x1020b08
lea eax, [ebp - 0xa68]
push eax
call fcn.0101b431
test eax, eax
je 0x1020b08
lea ecx, [ebp - 0xa68]
push ecx
push dword [esi]
xor eax, eax
inc eax
push eax
mov dword [ebp - 0xcbc], eax
call fcn.0101de76
mov dword [ebp - 0xc90], eax
push dword [ebp - 0xca4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc84]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc90], ebx
jne 0x1020b3c
cmp dword [ebp - 0xcbc], ebx
je 0x1020b3c
mov dword [ebp - 0xc88], 1
jmp 0x1020bae
push dword [esi + 8]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1020b7c
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push 1
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
push dword [esi + 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 8]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
push dword [esi + 8]
lea eax, [ebp - 0x450]
push 0x121
push eax
call fcn.0100c535
cmp dword [ebp - 0xc90], ebx
jne 0x1020be7
cmp dword [ebp - 0xcbc], ebx
je 0x1020be7
jmp 0x1021df6
push dword [esi + 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 8]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
mov dword [ebp - 0xc88], ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc88], ebx
lea eax, [ebp - 0x450]
jne 0x1020c04
mov eax, dword [esi + 8]
push eax
push 0xc7
lea eax, [ebp - 0x5e0]
push eax
call fcn.0100c535
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
mov dword [ebp - 0xc90], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1021cab
push 4
lea eax, [ebp - 0xc80]
push eax
push 4
push ebx
push 0x10080cc
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 1
call edi
push dword [esi]
call fcn.0101b63f
test eax, eax
je 0x1020ca9
push 4
lea eax, [ebp - 0xc88]
push eax
push 3
push ebx
push 0x1007b1c
push dword [ebp - 0xc78]
mov byte [ebp - 0xc88], bl
mov byte [ebp - 0xc87], bl
mov byte [ebp - 0xc86], 1
mov byte [ebp - 0xc85], bl
call edi
jmp 0x1020cba
push 0x1007b1c
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5e0]
push eax
push 0x100759c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10211fb
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1020e0a
cmp dword [ebp - 0xc7c], 1
je 0x1020d5c
cmp dword [ebp - 0xc7c], 2
jne 0x1020e0a
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x1020e0a
lea eax, [ebp - 0x450]
push eax
push dword [esi]
push 1
call fcn.0101de76
test eax, eax
je 0x1020e66
lea eax, [ebp - 0x450]
push eax
push 0x121
lea eax, [ebp - 0x824]
push eax
call fcn.0100c535
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x824]
push eax
call fcn.0101b4c4
test eax, eax
jne 0x1020dee
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
jmp 0x1020e0a
lea eax, [ebp - 0x824]
push eax
call fcn.0101b453
mov dword [ebp - 0xc90], eax
mov dword [ebp - 0xcc0], 1
cmp dword [esi + 0x38], ebx
mov dword [ebp - 0xcb4], 1
je 0x1020e42
push dword [ebp - 0xc98]
call fcn.0101b431
test eax, eax
je 0x1020e42
push dword [ebp - 0xc98]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc98]
jmp 0x1020e5a
push dword [ebp - 0xc8c]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc8c]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcb4], ebx
je 0x10211fb
lea eax, [ebp - 0x5e0]
push eax
push 0x1007640
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc88], ebx
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1020f80
lea eax, [ebp - 0x5e0]
push eax
push 0x100766c
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc8c], ebx
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0xc8c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1020f3b
push dword [ebp - 0xc8c]
push dword [ebp - 0xc78]
call fcn.0101773d
push dword [ebp - 0xc8c]
mov dword [ebp - 0xc88], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc88], ebx
je 0x1020f80
lea eax, [ebp - 0x5e0]
push eax
push 0x1007640
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call fcn.01017d6c
lea eax, [ebp - 0x5e0]
push eax
push 0x10076bc
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10210c6
cmp dword [ebp - 0xcc0], ebx
mov dword [ebp - 0xc80], 0x244
jne 0x1021047
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1021047
cmp dword [ebp - 0xc7c], 1
jne 0x1021047
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x1021047
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
mov eax, dword [ebp - 0xc9c]
push dword [eax + 0x10]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
mov eax, dword [ebp - 0xc9c]
push dword [eax + 0x10]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
cmp dword [ebp - 0xcb0], ebx
je 0x10210a9
cmp dword [ebp - 0xc90], ebx
je 0x10210a9
push 0x1003c14
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push ebx
push 0x10076a0
push dword [ebp - 0xc78]
call edi
jmp 0x10210ba
push 0x10076a0
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcb0], ebx
je 0x10211fb
call fcn.01028cef
test eax, eax
jne 0x10211fb
lea eax, [ebp - 0x5e0]
push eax
push 0x10076d8
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10211fb
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push 0x100158c
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x10211c7
cmp dword [ebp - 0xc7c], 1
jne 0x10211c7
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsupr]
lea eax, [ebp - 0x450]
push eax
push dword [0x102a0fc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
add esp, 0xc
test eax, eax
je 0x10211c7
lea eax, [ebp - 0x450]
push eax
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x100770c
push dword [ebp - 0xc78]
call edi
push dword [0x102a0fc]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x102a0fc]
push 1
push ebx
push 0x100158c
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc98]
mov dword [ebp - 0xc90], ebx
call fcn.0101b431
test eax, eax
jne 0x102121f
mov dword [ebp - 0xc94], 0x1007570
jmp 0x102163d
push dword [ebp - 0xc94]
lea eax, [ebp - 0x5e0]
push eax
push 0x1007548
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x14
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102163d
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1021375
cmp dword [ebp - 0xc7c], 1
je 0x10212bb
cmp dword [ebp - 0xc7c], 2
jne 0x1021375
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x1021375
lea eax, [ebp - 0x450]
push eax
push 0x121
lea eax, [ebp - 0x824]
push eax
call fcn.0100c535
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
pop ecx
lea eax, [ebp - 0x824]
push eax
push dword [esi]
push 1
call fcn.0101de76
test eax, eax
je 0x10213a3
lea eax, [ebp - 0x824]
push eax
mov dword [ebp - 0xcb8], 1
call fcn.0101b4c4
test eax, eax
jne 0x1021357
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
jmp 0x102137f
lea eax, [ebp - 0x824]
push eax
call fcn.0101b453
mov dword [ebp - 0xc90], eax
mov dword [ebp - 0xcac], 1
jmp 0x102137f
mov dword [ebp - 0xcb8], 1
push dword [ebp - 0xc98]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc98]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xcb8], ebx
je 0x102163d
push dword [ebp - 0xc94]
lea eax, [ebp - 0x5e0]
push eax
push 0x10080a4
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc9c], ebx
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10214cf
push dword [ebp - 0xc94]
lea eax, [ebp - 0x5e0]
push eax
push 0x10075f8
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xc8c], ebx
call fcn.0100d4d1
add esp, 0x14
push ebx
lea eax, [ebp - 0xc8c]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1021484
push dword [ebp - 0xc8c]
push dword [ebp - 0xc78]
call fcn.0101773d
push dword [ebp - 0xc8c]
mov dword [ebp - 0xc9c], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc9c], ebx
je 0x10214cf
push dword [ebp - 0xc94]
lea eax, [ebp - 0x5e0]
push eax
push 0x10080a4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call fcn.01017d6c
push dword [ebp - 0xc94]
lea eax, [ebp - 0x5e0]
push eax
push 0x1007628
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102163d
cmp dword [ebp - 0xcac], ebx
mov dword [ebp - 0xc80], 0x244
jne 0x102159c
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102159c
cmp dword [ebp - 0xc7c], 1
jne 0x102159c
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x102159c
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
push dword [0x102a100]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [0x102a100]
push 2
push ebx
push 0x10074dc
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xca8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xca8]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
cmp dword [ebp - 0xcb0], ebx
je 0x1021620
cmp dword [ebp - 0xc90], ebx
je 0x1021620
push 0x1003c14
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push 0x1003c14
push 1
push ebx
push 0x10076a0
push dword [ebp - 0xc78]
call edi
jmp 0x1021631
push 0x10076a0
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x5e0]
push eax
push 0x10075e4
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1021cab
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xca8], ebx
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102184d
cmp dword [ebp - 0xc7c], 1
jne 0x102184d
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x102184d
lea eax, [ebp - 0x450]
push 0x1007570
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1021714
cmp dword [ebp - 0xcb4], ebx
je 0x1021714
cmp dword [ebp - 0xcc0], ebx
je 0x102173d
mov dword [ebp - 0xca8], 1
jmp 0x102176b
cmp dword [ebp - 0xcb8], ebx
je 0x102177a
push dword [ebp - 0xc94]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x102177a
cmp dword [ebp - 0xcac], ebx
jmp 0x1021706
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
mov dword [ebp - 0xca0], 1
jmp 0x1021865
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x5e0]
push eax
push 0x1007548
lea eax, [ebp - 0x20c]
push 0x103
push eax
mov dword [ebp - 0xcac], ebx
call fcn.0100d4d1
add esp, 0x14
lea eax, [ebp - 0xcac]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10219ae
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xcac]
mov dword [ebp - 0xc80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x102183f
cmp dword [ebp - 0xc7c], 1
je 0x1021811
cmp dword [ebp - 0xc7c], 2
jne 0x102183f
lea eax, [ebp - 0x20c]
push eax
call fcn.0101b431
test eax, eax
je 0x102183f
lea eax, [ebp - 0x20c]
push eax
push dword [esi]
push 1
call fcn.0101de76
test eax, eax
je 0x102183f
mov dword [ebp - 0xca0], 1
push dword [ebp - 0xcac]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1021859
mov eax, dword [ebp - 0xcb4]
mov dword [ebp - 0xca0], eax
cmp dword [ebp - 0xca0], ebx
je 0x10219ae
push dword [ebp - 0xc94]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 0xc94]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
mov ecx, dword [esi + 0xc]
push ecx
call fcn.0101b431
test eax, eax
je 0x10219ae
push 0x100449c
push ecx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10219ae
push 0x100808c
push dword [esi + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10219ae
push 0x1008070
push dword [esi + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10219ae
push 0x1008044
push dword [esi + 0xc]
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x10219ae
push dword [esi]
lea eax, [ebp - 0x20c]
push 0x1007fc8
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push 0x1007f40
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esi]
lea eax, [ebp - 0x20c]
push 0x1007ec0
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [esi + 0xc]
lea eax, [ebp - 0x20c]
push 0x1007e38
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xca0], ebx
je 0x1021cab
push dword [esi + 0x1c]
call fcn.0101b431
test eax, eax
je 0x1021aee
lea eax, [ebp - 0x5e0]
push eax
push 0x100757c
lea eax, [ebp - 0x20c]
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1021aee
cmp dword [ebp - 0xca8], ebx
mov dword [ebp - 0xc80], 0x244
jne 0x1021ac4
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1021ac4
cmp dword [ebp - 0xc7c], 1
je 0x1021a70
cmp dword [ebp - 0xc7c], 2
jne 0x1021ac4
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x1021ac4
push dword [esi + 0x1c]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1021ac4
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
push dword [esi + 0x1c]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0x1c]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 0x14]
call fcn.0101b431
test eax, eax
je 0x1021cab
lea eax, [ebp - 0xc78]
push eax
push 0x2001f
push ebx
lea eax, [ebp - 0x5e0]
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1021cab
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc9c], 1
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1021bf3
cmp dword [ebp - 0xc7c], 1
jne 0x1021bf3
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x1021bf3
push dword [esi + 0x14]
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1021bc5
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
push dword [esi]
push 0x1007e28
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1021beb
push dword [esi]
push 0x1004b08
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
jne 0x1021bf3
mov dword [ebp - 0xc9c], ebx
jmp 0x1021c11
push dword [esi + 0x14]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0x14]
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
mov ecx, dword [esi + 0x18]
push ecx
call fcn.0101b431
test eax, eax
je 0x1021c42
push ecx
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0x18]
push 1
push ebx
push 0x1007e04
push dword [ebp - 0xc78]
push ebx
call fcn.01017e70
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc9c], ebx
je 0x1021cab
push dword [esi + 0xc]
call fcn.0101b431
test eax, eax
je 0x1021cab
lea eax, [ebp - 0xc78]
push eax
push 2
push ebx
push dword [esi]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1021cab
push dword [esi + 0xc]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esi + 0xc]
push 1
push ebx
push 0x1008234
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esi + 0xc]
push ecx
call fcn.0101b431
test eax, eax
je 0x1021e02
push 0x1008044
push ecx
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1021e02
push dword [esi]
lea eax, [ebp - 0x20c]
push 0x1007cb0
push 0x103
push eax
call fcn.0100d4d1
add esp, 0x10
push ebx
lea eax, [ebp - 0xc78]
push eax
push ebx
push 0x2001f
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1021e02
lea eax, [ebp - 0xc80]
push eax
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0xc7c]
push eax
push ebx
push ebx
push dword [ebp - 0xc78]
mov dword [ebp - 0xc80], 0x244
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov esi, 0x1007c58
jne 0x1021db1
cmp dword [ebp - 0xc7c], 1
jne 0x1021db1
lea eax, [ebp - 0x450]
push eax
call fcn.0101b431
test eax, eax
je 0x1021db1
lea eax, [ebp - 0x450]
push esi
push eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x1021db1
cmp dword [ebp - 0xca0], ebx
je 0x1021df6
lea eax, [ebp - 0x450]
push eax
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 0xc7c]
push ebx
push 0x1007504
push dword [ebp - 0xc78]
call edi
cmp dword [ebp - 0xca0], ebx
je 0x1021df6
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push ebx
push dword [ebp - 0xc78]
call edi
mov esi, 0x1001780
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push ebx
push 0x10075c8
push dword [ebp - 0xc78]
call edi
push dword [ebp - 0xc78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0101672d
leave
ret 8